Legal
Privacy Policy
This policy explains what happens to the information you send us. Because the subject matter is medical, we treat everything you submit as sensitive by default.
Last updated
Who is responsible for your data
[LEGAL ENTITY NAME], trading as Istanbul Penile Implant Centre, is the data controller for this website. Write to [EMAIL] or to Istanbul Penile Implant Centre, Teşvikiye, Hakkı Yeten Cd. No:23 Kat:10, Şişli, Istanbul, Turkey.
What we collect
We collect only what you choose to send us. If you never submit the consultation form, we hold no personal data about you from this site.
- Consultation form: your name, the country you live in, your email address, your phone or WhatsApp number, and — where you provide them — your age, your main medical concern, previous treatments, a preferred travel date, the implant you are interested in, and any further message.
- Optional attachments: medical documents, reports or images you upload with the form.
- The page you submitted the form from, which tells us which part of the site you were reading.
- Standard server request data generated by our hosting provider, such as your IP address and browser user agent, used for security and to keep the service running.
Why we use it, and on what basis
- To answer your enquiry and to give a clinical opinion on whether treatment is appropriate. Where you have sent health information, we rely on your explicit consent, given by choosing to submit it.
- To prepare a written quotation, and to arrange assessment, surgery and follow-up if you decide to proceed.
- To keep the records that a medical practice is legally required to keep about the care it provides.
- To protect the website against automated abuse and spam.
How it is stored
Form submissions are transmitted over an encrypted connection and written to a managed PostgreSQL database. Any document you attach is stored in a separate managed object store, and the database record holds only a reference to it. Submissions are not published, are not displayed anywhere on this website, and are not accessible through any public address.
Access is limited to the clinical and coordination staff who need it in order to answer you. Our hosting and database provider processes the data on our behalf under its own data processing terms, and infrastructure may be located outside your country of residence, including outside the European Economic Area. Where that is the case, transfers rely on the safeguards offered by that provider.
Who we share it with
- The operating surgeon and the clinical team involved in your assessment and care.
- The hospital where surgery would take place, where a booking is being arranged, and only to the extent needed for that booking.
- Our hosting, database and messaging providers, acting as processors on our instructions.
- Nobody else. We do not sell your data, we do not share it with advertisers, and we do not use it to build marketing profiles.
If you contact us on WhatsApp, that conversation takes place on Meta’s platform and is subject to WhatsApp’s own privacy terms as well as this policy. We keep WhatsApp messages that form part of your clinical record and treat them with the same confidentiality as the form.
How long we keep it
- Enquiries that do not lead to treatment: retained for [ENQUIRY RETENTION PERIOD], then deleted.
- Records relating to patients who proceed to treatment: retained for the period required by the medical record-keeping rules that apply to the practice, which is longer than the period above.
- Attachments are deleted on the same schedule as the enquiry or record they belong to.
Your rights
Subject to the record-keeping obligations described above, you can ask us for a copy of the data we hold about you, ask us to correct it, ask us to delete it, ask us to restrict how we use it, withdraw a consent you previously gave, or object to a particular use. Ask by email and we will respond within one month.
If you are unhappy with how we have handled your data you can complain to us first, and to the data protection authority in your country of residence or to Turkey’s Personal Data Protection Authority (KVKK).
Security
The site is served over HTTPS. Form submissions are validated and sanitised on the server, attachments are limited by type and size, and automated submissions are filtered. No system is completely secure, so please do not send anything you would not want stored at all.
Changes
If this policy changes materially we will update the date shown at the top of this page. Continued use of the site after a change means the revised policy applies.