Fermed Özel Sağlık Hizmetleri Ticaret A.Ş. (“Vanity”, “our clinic”, “we”), operating the Vanity Cosmetic Surgery Clinic at Bahçelievler Mah., Zübeyde Hanım Cd. No: 4, 34680 Üsküdar / Istanbul, Türkiye, values you as our patient and recognises the importance of your privacy.
This Privacy Policy explains how we collect, use, share and protect your personal data when you visit our website, contact us through our contact form, WhatsApp, e-mail or telephone, or receive our services. We act as data controller under Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”) and, for visitors and patients in the European Union or European Economic Area, the EU General Data Protection Regulation (“GDPR”). We conduct our activities in line with both regimes and other applicable law.
Personal Data We Collect
Depending on how you interact with us, we collect and process the following categories of personal data:
- Identity information — your name and surname, nationality, date of birth, signature, photograph, and passport or other identity document details where required for your treatment or travel arrangements;
- Contact information — your telephone number, WhatsApp number, e-mail address and, where relevant, postal address;
- Health and medical information — your medical history, current medications and allergies, examination and test results, photographs of the areas to be treated, treatment plans and post-operative follow-up records. This is special-category (sensitive) data and is handled as described in the “Health Data” section below;
- Financial and payment information — payment amounts, bank account or IBAN details and other data necessary to process payments;
- Travel and accommodation details — flight dates, hotel and transfer information, where we arrange these for you;
- Technical and usage data — IP address, device and browser information and pages visited, collected through cookies and similar technologies as described in the “Cookies and Analytics” section below.
Please do not send us sensitive personal data that we have not asked for (for example data revealing racial or ethnic origin, political opinions, religious beliefs, trade-union membership, or data concerning sex life or sexual orientation). Health information should only be shared through the channels we provide for that purpose.
How We Collect Your Personal Data
- Directly from you — through our website contact form, WhatsApp conversations, e-mail, telephone calls or in person at our clinic;
- During your consultation and treatment — information recorded by our physicians and medical team;
- Automatically — limited technical data collected through cookies and similar technologies when you browse our website;
- From third parties involved in your care or travel — for example hotels, transfer providers, insurers or payment providers, only to the extent necessary.
Purposes and Legal Bases of Processing
We use your personal data to:
- respond to your enquiries and provide free online consultations;
- assess your suitability for a procedure and prepare a treatment plan and quote;
- provide medical services and keep the patient records we are legally required to keep;
- arrange your travel, accommodation and transfers where included in your package;
- process payments and carry out our finance, accounting and record-keeping activities;
- improve our website and services;
- send you marketing communications, only where you have opted in, with the ability to opt out at any time;
- comply with our legal obligations and respond to lawful requests from courts and public authorities.
Under the GDPR, we rely on the legal bases in Article 6(1): your consent; performance of a contract or steps taken at your request before entering into a contract; compliance with a legal obligation; and our legitimate interests, provided these are not overridden by your interests and fundamental rights.
For special categories of personal data (your health data), we rely on Article 9(2) GDPR: your explicit consent; processing necessary for medical diagnosis and the provision of health care by professionals subject to an obligation of secrecy; and, where relevant, the establishment, exercise or defence of legal claims.
Under the KVKK, we process personal data in accordance with the principles in Article 4 and the conditions in Articles 5 and 6. Your health data is processed with your explicit consent or, where the law allows, by persons under an obligation of confidentiality for purposes of the protection of public health, preventive medicine, medical diagnosis, treatment and care services.
Health Data
As a medical clinic, the confidentiality of your health information is central to everything we do. We only ask for the health information that is genuinely needed to assess your suitability for a procedure and to plan and provide your treatment. Photographs of treatment areas are stored with restricted access and are visible only to the medical team involved in your care.
Before-and-after images are published or shown to other prospective patients only with your separate, explicit written consent, which you may refuse or withdraw at any time without any effect on your treatment. All of our physicians and staff are bound by medical confidentiality under Turkish healthcare legislation.
Cookies and Analytics
Our website uses cookies and similar technologies. Strictly necessary cookies keep the website secure and functional. For measurement we use Google Tag Manager and Google Analytics in consent mode with a default-denied setting: analytics and advertising storage are denied by default, and no analytics or advertising cookies are set unless and until consent is granted.
You can also control cookies through your browser settings, including blocking or deleting them. Blocking strictly necessary cookies may affect how the website functions.
WhatsApp Communication
We offer consultations through WhatsApp, a service operated by Meta. When you contact us on WhatsApp, your messages are transmitted through Meta's infrastructure and are also subject to WhatsApp's own terms and privacy policy, and may be processed on servers outside Türkiye and the EEA. Messages between you and our advisors are end-to-end encrypted in transit by WhatsApp.
Please share only the information our advisors ask for. If you prefer not to use WhatsApp, you can always reach us through the contact form on our website, by e-mail or by telephone. Any health information you send us through WhatsApp is treated by our team as confidential health data as described above.
How We Share Your Personal Data
We do not sell your personal data. We share it only as follows:
- with our physicians, medical staff and patient advisors involved in your care, all of whom are bound by confidentiality obligations;
- with service providers who support our operations — such as IT and hosting providers, communication tools and payment processors — under contracts requiring appropriate technical and organisational security measures;
- with travel partners such as hotels and transfer providers, limited to the details needed to provide those services (for example your name and arrival details, never your medical records);
- with government and regulatory authorities, courts and law-enforcement bodies where disclosure is required by applicable law;
- with our professional advisers and insurers where necessary to protect or exercise our legal rights.
International Transfers
We are based in Türkiye and your data is primarily processed here. If you contact us from the EU/EEA, the transmission of your data to Türkiye constitutes a transfer to a third country under the GDPR. We protect such transfers through appropriate safeguards, including contractual measures with our service providers and, where required, your explicit consent to the transfer after being informed of the possible risks.
Where we transfer personal data out of Türkiye (for example when using communication or hosting services operated abroad), we do so in accordance with Article 9 of the KVKK.
Data Retention
We retain your personal data only for as long as necessary for the purposes for which it was collected. Patient records are kept for the statutory periods required by Turkish healthcare legislation, and financial records for the periods required by tax and commercial law. To determine other retention periods we consider the amount, nature and sensitivity of the data, the potential risk of harm from unauthorised use or disclosure, and the purposes of processing. When the applicable retention period expires, we securely delete, destroy or anonymise your personal data.
Data Security
We implement appropriate technical and organisational measures to protect your personal data against loss, misuse, unauthorised access, disclosure, alteration and destruction. These include encryption of data in transit, access controls and logging on our systems, restricted access to health data on a need-to-know basis, confidentiality undertakings by our staff, and the careful selection of service providers that offer sufficient security guarantees.
Children's Personal Data
Our website and services are directed at adults; cosmetic procedures are provided only to patients aged 18 or over. We do not knowingly collect personal data from children under 16 online. If you believe a child has provided personal data to us, please contact us and we will delete it without delay.
Your Rights
If the GDPR applies to you, you have the right (with certain exceptions and restrictions) to:
- Access — obtain information about how we process your personal data and a copy of that data;
- Rectification — have inaccurate personal data corrected and incomplete data completed;
- Erasure — request the deletion of your personal data in certain circumstances;
- Restriction — ask us to restrict the processing of your personal data;
- Portability — receive the data you provided to us in a structured, commonly used, machine-readable format and have it transmitted to another organisation;
- Objection — object to processing based on our legitimate interests, and to direct marketing at any time;
- Automated decision-making — not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects;
- Complaint — lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence or place of work.
Under Article 11 of the KVKK, you additionally have the right to learn whether your personal data is processed; to request information about that processing; to learn the purpose of processing and whether the data is used in line with it; to know the third parties to whom your data is transferred in Türkiye or abroad; to request correction, deletion or destruction of your data and to have those actions notified to third parties; to object to a result that arises against you through exclusively automated analysis; and to claim compensation for damage caused by unlawful processing. You may also lodge a complaint with the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu).
To exercise any of these rights, contact us using the details in the “Contact Us” section, together with proof of your identity. We respond to KVKK applications within thirty days at the latest, and to GDPR requests within one month, free of charge except where the law permits a fee.
Withdrawing Consent
Where processing is based on your consent, you may withdraw it at any time, fully or partly, without affecting the lawfulness of processing before the withdrawal. To withdraw consent, use the opt-out link in any marketing message or contact us directly. Once we receive your withdrawal, we stop the relevant processing unless another legal basis applies — for example our legal obligation to retain patient records.
Links to Third-Party Sites
Our website contains links to and embeds from third-party services — for example YouTube videos, Google Maps and independent review platforms — whose privacy practices differ from ours. Information you provide to those services is governed by their own privacy policies, which we encourage you to read.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or in the law. Changes will be posted on this page with an updated “last updated” date and, where appropriate, notified to you by e-mail. Please check back regularly.
Contact Us
If you have questions about our privacy practices or wish to exercise any of your rights, please contact us:
- Fermed Özel Sağlık Hizmetleri Ticaret A.Ş. — Vanity Cosmetic Surgery Clinic
- Bahçelievler Mah., Zübeyde Hanım Cd. No: 4, 34680 Üsküdar / Istanbul, Türkiye
- E-mail: info@vanity.com.tr
- Telephone: 0850 441 54 44