Last updated: 7 October 2026
Privacy notice (KVKK)
Data controller
Osmanağa Mah., Osmancık Sk., Birlik İş Hanı No:3 İç Kapı No:19, 34714 Kadıköy/İstanbul, Türkiye
Tax office: Kadıköy, tax no. 104 198 4386 · Trade Registry No: 1162749 · MERSİS: 0104 1984 3860 0001
Email: info@avanaesth.com · Phone: +90 554 228 20 26
Our service
AVAN AESTH is not a hospital or clinic. We provide communication, planning, coordination and organisation services between international patients and authorised healthcare providers. Decisions on examination, diagnosis, suitability for treatment and medical intervention belong to the healthcare provider and the doctor carrying out the treatment. Our intermediary role does not remove the healthcare provider’s own medical record-keeping and data protection obligations.
We do not take advance payments. You pay AVAN AESTH in Istanbul on the day of your treatment, in cash or by credit or debit card; the healthcare provider does not ask you for any separate payment.
Personal data we process
- Identity: name and surname, date of birth or age, nationality, passport details.
- Contact: phone, email, country of residence.
- Request and coordination: the treatment you are interested in, appointment dates, written treatment plan and your correspondence with us (website form, Facebook and Instagram lead forms, WhatsApp, email, phone, social media messages).
- Travel: flight, hotel, airport pick-up and transfer details.
- Payment and invoicing: the payment you make to AVAN AESTH in cash or by credit or debit card, and related records. Your card details are processed only on the bank’s POS terminal; AVAN AESTH does not store your card number, expiry date or security code.
- Health data (special category personal data): your medical history, current conditions, medicines you take, allergies, previous operations, and photos of your hair, donor area, face, teeth or body.
- Technical: IP address, device and browser information, your cookie preferences.
Why we process your data and on what legal basis
- Responding to your request, organising the preliminary assessment with the healthcare provider, arranging the treatment plan, appointments, hotel and transfers: establishment and performance of a contract (KVKK Art. 5(2)(c)).
- Payment, invoicing and accounting records: compliance with our legal obligations (Art. 5(2)(ç)) and performance of the contract.
- Post-treatment follow-up and communication with you: performance of the contract.
- Website security and service quality: our legitimate interest (Art. 5(2)(f)).
- Health data and photos: the explicit consent you give separately (Art. 6).
- Statistics and marketing cookies: your consent.
Who we share your data with
- Authorised healthcare providers and doctors who will carry out the treatment: your health information and photos, sent as files or shown on screen.
- Hotels and the transfer company: only your name and surname, passport, flight and accommodation details. Your health information is not shared with them.
- Photography service providers: the people who take surgery and follow-up photos.
- Card payment (POS) service providers: QNB Finansbank A.Ş. and Türk Ekonomi Bankası A.Ş.
- Accounting and legal advisers.
- Service providers we use: Meta (WhatsApp, Facebook and Instagram lead forms, Meta Pixel), Google (email application, Google Sheets, Google Analytics) and our website’s hosting service in Türkiye.
- Public authorities legally entitled to request data.
International transfers
The servers of the services below are located outside Türkiye, so your data processed through these services is transferred abroad. We ask for your explicit consent to these transfers separately (see the explicit consent text).
| Service | Provider | Data transferred | Country | Purpose |
|---|---|---|---|---|
| Meta Platforms Ireland Ltd. / Meta Platforms, Inc. | Your messages, the photos and health information you send, name, phone | Ireland (EU), USA and other countries where the provider has data centres | Communicating with you, preliminary assessment and treatment coordination. Not used for advertising. | |
| Facebook and Instagram lead forms | Meta Platforms Ireland Ltd. / Meta Platforms, Inc. | The name, phone, email and treatment of interest you enter in the form | Ireland (EU), USA | Passing your request to us and getting back to you |
| Meta Pixel | Meta Platforms Ireland Ltd. / Meta Platforms, Inc. | Website usage information (only if you accept marketing cookies) | Ireland (EU), USA | Measuring the effectiveness of advertising |
| Email application (Gmail) | Google Ireland Ltd. / Google LLC | Emails and attachments you send to info@avanaesth.com | Ireland (EU), USA and other countries where the provider has data centres | Communicating with you by email |
| Google Sheets | Google Ireland Ltd. / Google LLC | Request records: name, phone, email, treatment of interest | Ireland (EU), USA | Tracking requests |
| Google Analytics | Google Ireland Ltd. / Google LLC | Website usage information (only if you accept statistics cookies) | Ireland (EU), USA | Measuring how the website is used |
Our website is hosted on servers in Türkiye; information you send through the website form is first processed on this server.
How we collect your data
Through the forms on avanaesth.com, Facebook and Instagram lead forms, WhatsApp, phone, email, our social media accounts and face-to-face meetings, electronically or on paper.
How long we keep your data
Your data is kept for as long as necessary for the purpose for which it is processed and for the retention periods set out in the applicable legislation; when these periods end, it is deleted, destroyed or anonymised. Photos and health information from enquiries that do not lead to treatment are deleted once the purpose no longer exists.
How we protect your data
Our website uses HTTPS encryption and the admin panel is protected against unauthorised login attempts. Only the AVAN AESTH manager and staff who need access for their work can access your health information and photos. If you do not consent to the transfer to a healthcare provider, your photos are not transferred and are deleted once your request has been concluded.
Under 18s
For persons under 18, information and consents are obtained from a parent or legal guardian.
Your rights
Under Article 11 of the KVKK (Turkish Personal Data Protection Law No. 6698), you have the right to:
- learn whether your personal data is processed and, if so, request information about it,
- learn the purpose of processing and whether it is used in line with that purpose,
- know the third parties in Türkiye or abroad to whom it is transferred,
- request correction if it is incomplete or inaccurate,
- request its deletion or destruction and that these actions be notified to the third parties to whom it was transferred,
- object to an outcome against you that results solely from analysis by automated systems,
- claim compensation if you suffer damage because of unlawful processing.
How to apply
You can send your requests in writing, together with information that verifies your identity, to our address above or to info@avanaesth.com. We will respond free of charge within 30 days at the latest.
Acknowledgement and explicit consent
These consents are obtained before your health information and photos are shared with the healthcare facility for assessment. Each box is separate and is not pre-ticked.
How we use your photos
- Assessment photos: those you send us for the preliminary assessment.
- Photos sent to the healthcare provider: those sent, with your explicit consent, to the provider that will carry out the assessment.
- Surgery and follow-up photos: those taken during and after treatment for follow-up.
- Promotional photos: only if you give the separate permission below.
Use of photos and videos for promotion
This is offered as a separate form during treatment. It is optional; not giving permission does not affect your service in any way.
Permission for promotional use
I allow photos and videos of my treatment to be used in the places I tick below:
Showing my face:
My face may be shown
My face must not be shown (cropped or covered)
This permission is valid until withdrawn. I can withdraw it at any time by writing to info@avanaesth.com; after withdrawal no new publication is made and content on AVAN AESTH’s own channels is removed.
For patients in the European Union and the United Kingdom
Legal bases
We process your data on the basis of a contract and pre-contractual steps (GDPR Art. 6(1)(b)), legal obligation (Art. 6(1)(c)), legitimate interest (Art. 6(1)(f)) and your consent (Art. 6(1)(a)). For your health data we rely on your explicit consent (Art. 9(2)(a)).
Your rights
You have the right to access your data, to request its rectification, erasure or the restriction of its processing, to data portability, to object to processing and to withdraw your consent at any time.
Right to complain
You can lodge a complaint with the data protection supervisory authority in the country where you live.
International transfers
Your data is processed in Türkiye; there is no European Commission adequacy decision for Türkiye. The providers used to deliver the service and the countries to which data is transferred are listed in the international transfers table above. These transfers are based on the explicit consent you give after being informed of the possible risks.
United Kingdom
For patients in the United Kingdom, the same rights apply under the UK GDPR. You can complain to the Information Commissioner’s Office (ICO).