Privacy Policy

Last updated: September 3, 2026 · Applies to www.mustafaaydinol.com and all its language versions

1. Who is responsible for your data

Patient coordination, including WhatsApp communication and the first review of your photographs, is carried out by the surgical team under Dr. Aydınol’s direction. The team members act on his behalf and are bound by confidentiality.

2. What data we collect

2.1 Data you give us

You decide what to send us. Depending on how you contact us, this may include:

• Contact form: your name, email address, telephone number, and the message you write.
• WhatsApp: your telephone number, the name shown on your WhatsApp profile, your messages, and any photographs or documents you attach.
• Email and telephone: your email address or telephone number and the content of the conversation.
• Health information: details you share about your medical history, current medications, previous surgery, allergies, smoking, weight, or planned procedure. See section 4.
• Consultation and treatment records: if you go on to have a procedure, your medical record is created and kept by the hospital where the surgery takes place, in accordance with Turkish health legislation. The hospital is a separate data controller for that record. It is not stored on this website.

2.2 Interactive tools on this site

This site offers self-assessment tools such as the Recovery Planner, the Surgery Readiness Check, and the Fotona treatment quiz. These tools run entirely in your browser. Your answers are not sent to our servers and are not stored by us. If you choose the option to send your summary on WhatsApp, the summary is transmitted through WhatsApp in the same way as any other message you send us.

2.3 Data collected automatically

When you visit the site, our systems and the service providers listed in section 5 record technical data such as your IP address, browser type and version, operating system, device type, language, the pages you view, the time and duration of your visit, the page that referred you, and approximate location derived from your IP address. This data is collected through server logs, cookies, and similar technologies. See section 10.

3. Why we use your data and on what legal basis

We process personal data for the purposes below. Where the General Data Protection Regulation (GDPR) applies to you, the legal basis is shown for each purpose. For visitors in Turkey, the corresponding bases in the Turkish Personal Data Protection Law No. 6698 (KVKK) apply.

Purpose	Data used	Legal basis
Answering your inquiry and communicating with you	Contact details, message content	Steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR)
Assessing whether a procedure may be suitable for you	Photographs, health information	Your explicit consent (Art. 9(2)(a) GDPR)
Arranging your consultation, travel, accommodation, and treatment	Contact details, travel dates, health information needed for planning	Performance of a contract (Art. 6(1)(b)); explicit consent for health data (Art. 9(2)(a))
Providing medical care and keeping medical records	Medical record (kept by the hospital where the procedure takes place)	Provision of health care (Art. 9(2)(h)); legal obligations under Turkish health law
Understanding how the website is used and improving it	Technical and usage data	Your consent for cookies and similar technologies (Art. 6(1)(a)); our legitimate interest in operating the site (Art. 6(1)(f))
Measuring the results of our online advertising	Technical data, conversion events (for example a click on the WhatsApp button)	Your consent (Art. 6(1)(a))
Protecting the site against abuse, spam, and attacks	IP address, request data	Our legitimate interest in security (Art. 6(1)(f))
Complying with legal obligations and defending legal claims	Any relevant data	Legal obligation (Art. 6(1)(c)); legitimate interest (Art. 6(1)(f))

We do not sell personal data and we do not use it for automated decisions that have legal or similarly significant effects on you. Every assessment of your case is made by a person.

4. Photographs and health information

To give you a meaningful answer about a procedure, we usually need to see photographs of the area you would like treated and to know some facts about your health. This is health data, a special category of personal data under the GDPR and sensitive personal data under the KVKK.

• We process it only with your explicit consent. Sending us photographs or health information after reading this policy, or ticking the consent box in one of our tools, is how you give that consent.
• We use it only to evaluate your case and plan your treatment. We do not use it for advertising and we do not share it with advertising platforms.
• We do not publish your photographs. Before and after images shown on this site are published only with the separate, written permission of the patients concerned, and that permission can be withdrawn at any time.
• Photographs are reviewed by the surgical team and by Dr. Aydınol. They are stored on the practice’s patient coordination phone, not on this website, and they are not passed to anyone outside the practice except a health professional involved in your care.
• You can withdraw your consent at any time by writing to us. We will then delete the material unless we are required by law to keep it as part of a medical record.

Please do not send us photographs or health information about another person without that person’s permission.

5. Service providers and third parties

We use the following services to run the website, communicate with you, and measure our advertising. Each provider processes data on our behalf under a contract, or, where noted, as an independent controller under its own privacy policy.

5.1 Communication

Service	Provider	What it does	Data involved
WhatsApp	WhatsApp Ireland Ltd. / Meta Platforms (Ireland, United States)	Messaging with the patient coordination team. Messages are end-to-end encrypted in transit. WhatsApp processes your telephone number and metadata as an independent controller under its own privacy policy.	Telephone number, profile name, messages, attachments
Contact form	Operated on our own website (Contact Form 7)	Sends your message to our mailbox.	Name, email, telephone, message
Google reCAPTCHA	Google Ireland Ltd. / Google LLC (United States)	Protects the contact form against automated spam. It analyzes your interaction with the site and may set cookies. Google privacy policy	IP address, browser and interaction data

5.2 Analytics and advertising measurement

Service	Provider	What it does	Data involved
Google Tag Manager	Google Ireland Ltd. / Google LLC (United States)	Loads and manages the measurement tags listed below. It does not itself collect personal data beyond the technical data needed to load the tags.	IP address, technical data
Google Analytics 4	Google Ireland Ltd. / Google LLC (United States)	Website usage statistics (pages viewed, session length, approximate location, device). IP addresses are truncated before storage. How Google uses data from partner sites · Opt-out add-on	Usage data, cookies, approximate location
Google Ads conversion tracking and remarketing	Google Ireland Ltd. / Google LLC (United States)	Records when a visit that came from one of our advertisements leads to an action such as a click on the WhatsApp button or the telephone number, so that we can measure our campaigns. It may also build audiences for showing our advertisements to previous visitors on Google services. Google advertising policy · Manage your ad settings	Cookies, click identifiers, conversion events, technical data
Ahrefs Web Analytics	Ahrefs Pte. Ltd. (Singapore)	Privacy-friendly traffic statistics without cookies and without storing personal identifiers. Ahrefs privacy policy	Anonymized technical data

Health information and photographs are never shared with analytics or advertising services.

5.3 Content, hosting, and security

Service	Provider	What it does	Data involved
YouTube	Google Ireland Ltd. / Google LLC (United States)	Some pages show videos hosted on YouTube. When a video loads, YouTube may set cookies and collect usage data under Google’s privacy policy.	IP address, cookies, viewing data
Web hosting	ScalaHosting	Stores the website and its server logs.	All data submitted through the site, server logs
Content delivery network	QUIC.cloud (LiteSpeed Technologies Inc., United States)	Delivers pages faster from servers close to you and filters malicious traffic.	IP address, request data
Website security	Wordfence (Defiant Inc., United States)	Blocks attacks and logs suspicious requests.	IP address, request data
Cookie policy	iubenda s.r.l. (Italy)	Generates and hosts our cookie policy.	Technical data when the policy is opened

5.4 Other recipients

Surgery takes place in a hospital. Where it is needed for your treatment, and with your knowledge, we share relevant data with that hospital and the anaesthesia team, and, if you use them, with the transfer and accommodation providers arranged for your stay. The hospital keeps your medical record under its own responsibility and its own privacy notice. We may also disclose data to public authorities, courts, or professional advisers when the law requires it or to defend our legal rights.

6. International transfers

Our practice is in Turkey. If you contact us from the European Union, the United Kingdom, or another country, your data is transferred to Turkey so that we can answer you. Turkey is not currently covered by an adequacy decision of the European Commission. The transfer takes place because you have asked us to respond and, where health data is involved, because you have given your explicit consent (Art. 49(1)(a) and (b) GDPR).

Some of the providers listed in section 5 process data in the United States. Google and Meta are certified under the EU-US Data Privacy Framework. For the other providers we rely on contractual safeguards such as the European Commission’s Standard Contractual Clauses.

7. How long we keep your data

• Inquiry messages and photographs: kept on the practice’s patient coordination phone only as long as needed to answer you and to follow up on your inquiry. Inactive inquiries are reviewed and deleted regularly. You can ask us to delete them at any time.
• Medical records: kept by the hospital where your procedure takes place, for the period required by Turkish health legislation.
• Analytics and advertising data: retained according to the settings of the respective service and then deleted or aggregated.
• Server and security logs: kept for a short period for security purposes and then deleted.

Data may be kept longer where a legal obligation requires it or where it is needed for a legal claim.

8. How we protect your data

The website is served over an encrypted connection (HTTPS). WhatsApp messages are end-to-end encrypted in transit. Access to inquiries, photographs, and medical records is limited to the members of the surgical team who need it for your care, and the website is protected by a security firewall and regular updates. No method of transmission or storage is completely secure, so please avoid sending more information than is needed for your inquiry.

9. Your rights

Depending on the law that applies to you, you have the right to:

• Access the personal data we hold about you and receive a copy.
• Correct data that is inaccurate or incomplete.
• Delete your data, unless we must keep it for a legal reason such as a medical record.
• Restrict or object to processing based on our legitimate interests, including any direct marketing.
• Withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal.
• Receive your data in a portable format where processing is based on consent or a contract.
• Complain to a supervisory authority: the data protection authority of your country of residence, or the Personal Data Protection Authority of Turkey (KVKK).

To exercise any of these rights, write to info@mustafaaydinol.com or message us on WhatsApp. We may ask you to confirm your identity. We answer within one month; if a request is complex we will tell you if we need more time. Requests are free of charge.

10. Cookies and similar technologies

The site uses cookies and similar technologies for the analytics and advertising services described in section 5. On your first visit, a cookie banner lets you accept all, reject all, or choose by purpose. Analytics and advertising tags run only after you have given consent, and Google’s tags receive your choice through Google Consent Mode. You can change or withdraw your choice at any time using the privacy button at the bottom left of every page. Details of each cookie, its purpose, and its duration are listed in our Cookie Policy. You can also delete or block cookies through your browser settings, and opt out of Google’s advertising personalization through Google Ads Settings.

11. Children

This website and our online inquiry channels are intended for adults. Any procedure for a person under 18 is discussed only with a parent or legal guardian, and we do not knowingly collect personal data from children through this website. If you believe a child has sent us personal data, please contact us and we will delete it.

12. Changes to this policy

We may update this policy when our services or the law change. The date at the top of the page shows the latest version. If a change significantly affects how we use your data, we will inform you where we have a way to contact you, and we will ask for new consent where the law requires it.

13. Definitions

Personal data

Any information that identifies you or could identify you, directly or indirectly.

Health data (special category or sensitive data)

Information about your physical or mental health, including photographs taken for the purpose of assessing treatment.

Data controller

The person who decides why and how personal data is processed. For this website, Dr. Mustafa Aydınol.

Processor

A company that processes personal data on the controller’s behalf and under his instructions, such as a hosting provider.

Usage data

Technical information collected automatically during your visit, such as IP address, browser, pages viewed, and time of access.

GDPR

The General Data Protection Regulation (EU) 2016/679, which applies to visitors in the European Economic Area, and the UK GDPR for visitors in the United Kingdom.

KVKK

The Turkish Personal Data Protection Law No. 6698.

This policy relates only to www.mustafaaydinol.com. Original policy generated with iubenda; revised and expanded by the practice.