Privacy Policy
At FitAndFit Clinic, your privacy matters deeply to us. This Privacy Policy explains what personal data we collect, why we collect it, how it is used, and what rights you have — in full compliance with Turkish Law No. 6698 (KVKK) and the EU General Data Protection Regulation (GDPR) where applicable.
1. Data Controller
| Detail | Information |
|---|---|
| Company | FitAndFit Clinic |
| Address | Korutürk Mah. Ortanca Sk. No:31, Balçova / İzmir, Turkey |
| info@fitandfit.clinic | |
| Website | https://fitandfit.clinic |
2. What Data We Collect
2.1 Contact & Identity Data
Collected via our contact form, consultation form, email, phone or WhatsApp:
- Full name, email address, phone number
- Country, city and preferred language
- Message content and enquiry details
- How you heard about us
2.2 Health & Medical Data (Special Category)
Collected via our medical consultation and aesthetic assessment forms:
- Procedure of interest (e.g. hair transplant, rhinoplasty, aesthetic surgery)
- Current health status, prior surgeries, medications (voluntarily disclosed)
- Assessment photographs uploaded by you
- Age, gender, BMI (where provided on forms)
- Preferred travel dates and companion information
- Budget range
⚕️ Important: Health data is classified as special category data under both KVKK and GDPR. It is processed only with your explicit consent, is never sold, and is shared only with the medical professionals directly involved in your treatment assessment.
2.3 Technical & Usage Data
- IP address (anonymised where possible)
- Browser type and version, operating system
- Pages visited, clicks, session duration
- Cookie identifiers and analytics data
3. Legal Bases for Processing
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Responding to enquiries and consultation requests | Contact, health | Explicit consent / Pre-contractual steps |
| Treatment coordination and medical assessment | Health, photos | Explicit consent |
| Appointment scheduling | Contact | Performance of contract |
| Email marketing and newsletters | Contact | Explicit consent (opt-in) |
| Website analytics and improvement | Technical | Legitimate interest / Consent (cookies) |
| Legal compliance and record-keeping | All categories | Legal obligation |
| Customer support and complaints | Contact | Legitimate interest |
4. Cookies & Tracking Technologies
| Cookie Type | Purpose | Duration | Consent Required |
|---|---|---|---|
| Strictly Necessary | Core website functionality (sessions, CSRF protection, language) | Session | No |
| Preference Cookies | Remembering language and display preferences | 1 year | Yes |
| Analytics (Google Analytics 4) | Anonymous visitor statistics — processed on Google LLC servers in the USA | 2 years | Yes |
| Marketing Cookies | Retargeting and ad performance | 90 days | Yes |
You can opt out of Google Analytics at any time using the Google Analytics Opt-out Add-on. To manage all cookies, use the cookie preferences panel on our website.
5. Third-Party Sharing & International Transfers
| Recipient | Country | Data Shared | Safeguard |
|---|---|---|---|
| Google LLC (Analytics, reCAPTCHA) | USA | Anonymised technical data | EU-US Data Privacy Framework / Consent |
| Email infrastructure provider | Turkey / EU | Contact data | Data processing agreement |
| Web hosting / cloud server | Turkey | All data | Data processing agreement |
| Partner doctors & specialists | Turkey | Health data (with consent) | Confidentiality agreements |
We do not sell, rent or trade your personal data to any third party under any circumstances.
6. Data Retention
| Data Category | Retention Period | Basis |
|---|---|---|
| Contact form data | 3 years from last contact | Legitimate interest |
| Medical / health consultation data | 10 years (statutory medical record requirement) | Legal obligation (Turkish health law) |
| Marketing consent records | Until consent is withdrawn | Explicit consent |
| Analytics data | 26 months (Google Analytics default) | Legitimate interest |
| Accounting / invoice records | 10 years | Legal obligation (Turkish Tax Law) |
7. Data Security
- 256-bit SSL/TLS encryption for all data in transit
- Role-based access controls — only authorised staff access personal data
- Firewall and intrusion detection systems
- Regular security audits
- Data minimisation — we collect only what is necessary
- Staff training on data protection obligations
8. Your Rights
Depending on your location, you have the following rights:
- ✅ Access — obtain a copy of the personal data we hold about you
- ✅ Rectification — correct inaccurate or incomplete data
- ✅ Erasure ("right to be forgotten") — request deletion of your data
- ✅ Restriction — limit how we process your data
- ✅ Portability — receive your data in a structured, machine-readable format
- ✅ Objection — object to processing based on legitimate interest or for direct marketing
- ✅ Withdraw consent — at any time, without affecting prior lawful processing
- ✅ Complaint — lodge a complaint with your local supervisory authority
To exercise any right, email us at info@fitandfit.clinic or write to Korutürk Mah. Ortanca Sk. No:31, Balçova / İzmir, Turkey. We will respond within 30 days. EU residents may also contact their national data protection authority.
9. Children's Privacy
Our services are intended for adults (18+). We do not knowingly collect personal data from minors. If you believe a minor has submitted data to us, please contact us immediately and we will delete it promptly.
10. Changes to This Policy
We may update this Privacy Policy to reflect changes in law, our services or technology. Significant changes will be announced on our website. The current version is always available at fitandfit.clinic/en/privacy-policy.
© 2025 FitAndFit Clinic — Compliant with Turkish KVKK (Law No. 6698) and GDPR.