On this page 10 sections
Last updated: October 8, 2026
This policy explains what we collect when you use this website or contact us, why, and what you can do about it. It is written to describe what actually happens rather than to cover every theoretical possibility.
Who we are
This site is operated by , Küçükbakkalköy, Dilek Sabancı Cd. No:4, 34750 Ataşehir/Istanbul, Turkey. Contact: info@afrohairclinicturkey.com.
What we collect
When you contact us
Through the contact form: your name, your email address, your phone number if you give one, the country you are writing from, whether you have had a transplant before, and your message. Through WhatsApp: your phone number, your messages, and anything you choose to send us.
A copy of every form submission is stored in this site’s own database, not only emailed. That is deliberate. Email can be quarantined, misdelivered or quietly lost, and an enquiry is the one thing on this site that cannot be recreated afterwards — a stored copy means a message that never reached an inbox is still not gone. The stored copy holds the fields listed above, the page you sent it from, whether the email left the server, and — only if you arrived from one of our advertisements and said yes to Google Analytics and Google Ads — the identifier that advertisement click carried. It can be read only by an administrator signed in to this site, and it is deleted automatically after 180 days. Ask us to delete yours sooner and we will.
Photographs of your hair and scalp
If you send photos for an assessment, those images — and what you tell us about your hair loss, medical history or medication — are health data. Under EU/UK data protection law this is a special category requiring your explicit consent, and we treat it that way. Sending us photos is your consent to us assessing them for that purpose. You can withdraw it at any time by asking us to delete them.
What we count, and what we do not
This site counts events, and we would rather tell you that here than have you find the request in your browser’s network tab. What gets recorded is a row of counts: which event happened — a page view, a scroll depth, a click on a WhatsApp button — the path of the page it happened on, what type of page that is, where on the page the control sat, whether the device was a phone, tablet or desktop, and the time.
What is not recorded: no IP address, no browser or device fingerprint, no cookie, no session or visitor identifier, no referrer, no query string, and nothing you type into any form — not a name, not a phone number, not a message, not a symptom. The hair pattern assessment runs entirely in your browser; we record that one was started or finished, never a single answer to it — the assessment itself explains what it can and cannot tell you, and it runs without sending us anything. There is one exception to the query-string promise and it is not in these counts: if you arrive from one of our advertisements and have said yes to Google Analytics and Google Ads, the identifier Google puts in that link is kept and attached to an enquiry if you send one. It is set out in full below, under If you arrive from one of our advertisements.
The cost of that is ours and it is real. With no identifier we cannot tell whether two events came from the same person. We can see that a pricing page was opened forty times and a WhatsApp button clicked six times, and we cannot join those together, build a funnel, or count unique visitors. That is enough to tell whether a change made the site better or worse, and not enough to build a picture of anybody. We think that trade is the right way round for a site whose visitors are researching a medical procedure. All of that describes our own counter, which runs for everyone whatever else you choose. Google Analytics and Google Ads are a separate thing. Their tag is loaded on every page in a mode that sets no cookie and stores no identifier; like any request to any server, that load shows Google your IP address. The tag starts setting cookies and recording which pages you opened only if you say yes, and stops if you withdraw that below.
We also advertise on ChatGPT, and OpenAI has a measurement pixel for it. We have set that one up differently, and the difference is deliberate: OpenAI’s own instructions say to load the pixel on every page and it switches measurement on by default. We do neither. The script is not fetched at all unless you have said yes, so if you have not, no request to OpenAI is made from this site. If you have said yes, it is told one thing and one thing only — that somebody clicked WhatsApp or finished the assessment. Not which page you read, not how long you stayed, not what you typed.
The same applies to Microsoft Advertising, where we also run ads. Its tag is not loaded unless you have said yes, it is told only that a WhatsApp click or a finished assessment happened, and Microsoft Clarity — the part that records what people do on a page — is switched off.
A tracking script we did not add
Our hosting provider injects its own script into every page on this site — tccl.min.js, served from wsimg.com. We did not put it there, we do not control it, and it cannot be removed from inside WordPress. We are not able to tell you what it collects, because it is not ours; the host’s own terms govern it. Switching it off is a change at the hosting-account level and it is on our list. Until it is gone, this paragraph stays here, because saying we run no third-party scripts while that one loads would be false.
A review widget we did add
The home page shows the star rating left on our Google Business Profile, displayed by a company called Trustindex. Unlike the script above, this one is our decision, so it is ours to explain.
When you load the home page your browser fetches about 24 KB from cdn.trustindex.io (94 KB once your browser unpacks it), and the reviewer profile pictures from Google’s image servers. Those requests tell Trustindex and Google that a browser loaded that page. We do not receive anything about you from it, we cannot see who viewed it, and nothing you do with the widget is reported back to us.
This sits awkwardly beside the rest of the site and we would rather say so than have you notice. Videos on this site load nothing from YouTube until you press play, specifically so that reading a page sends no request to anyone. The review widget does not work that way. It was a deliberate choice, and if you would rather not load it, the ratings are on our Google profile where they are counted anyway.
Google Analytics and Google Ads: what the tag does before and after you say yes
The Google tag (gtag.js) is loaded on every page in what Google calls consent mode, with every kind of storage denied: no cookie, no identifier, no advertising or analytics storage. The first time you open this site you are asked one question: may Google Analytics and Google Ads set cookies and record which pages you opened? Until you answer, the tag stays in that denied state. If you answer no, the tag stays in its denied state: no cookie, no identifier, no advertising or analytics storage. The request that loads the tag itself still reaches Google, as described above; that is the one thing a no does not switch off. The site behaves identically either way, and the counter described above keeps running whatever you choose.
If you say yes, Google Analytics 4 and the Google Ads tag set cookies in your browser and give you an identifier that persists across pages and across visits, and Google Ads can attribute an enquiry to an advertisement you clicked. It records which pages you open, roughly where you are, the site or search that sent you here, your device and browser, and how long you stay. Your IP address is used to work out the country and is then discarded by Google rather than stored. That data is processed by Google on our behalf under their terms.
Two things Analytics is able to collect are switched off at our end and will stay off. Site search would record what you typed into a search box, and on this site that could be a symptom. Form interactions would watch the enquiry form, which is a medical one. Neither belongs in an analytics report, and neither is enabled.
We turned this on because the counter above cannot tell us where visitors arrive from or whether anyone came back, and those are questions we need answered. Asking you first was the only version of it we were willing to ship.
Your answer is kept in your browser’s local storage rather than in a cookie, so choosing no leaves this site storing nothing at all. You can change your answer at any time and the question will be put to you again.
If you arrive from one of our advertisements
When you click one of our Google advertisements, Google adds an identifier to the link. It identifies the click, not you: it carries no name, no email address and nothing about you personally. On its own it tells us which advertisement brought somebody here, and nothing else.
If you have said yes to the question above, we keep that identifier in your browser for 90 days and attach it to your enquiry if you send one, where it is deleted with the rest of that record. If you have said no, or have not answered, it is not read and not stored, and sending an enquiry attaches nothing. Withdrawing your answer deletes it.
If an enquiry later leads to treatment, we may tell Google that a click carrying that identifier led to one. What goes to Google is the identifier and the date. Your name, your email address, your phone number, your photographs and anything you told us do not. We do this so we can stop paying for advertisements that bring nobody.
We would rather point at this than have you find it. It is the one thing from the address bar that this site keeps, it happens only with your consent, and it is attached to an enquiry you chose to send and to nothing else.
What we do not run
No advertising pixels, no remarketing tags, no Meta pixel. Apart from the Google tag described above, the review widget, and the host’s script named above, nothing else on this site is loaded from a third party. We are not building a profile of your browsing and we do not sell what we count. The only thing we ever send an advertiser is the one described above: an advertisement click identifier, with a date, when that click led to treatment and you consented to it being kept. WordPress and our host may also write technical cookies needed for the site to work, and keep standard server logs including IP address, for security. If any of this changes, this page changes with it.
Why we use it, and on what basis
- To answer you and assess your case — your consent, and steps taken at your request before entering a contract.
- Health data specifically — your explicit consent, for the purpose of medical assessment and planning.
- Security and site integrity — our legitimate interest in keeping the site working and unattacked.
- Measuring our advertising — your consent, given through the question described above and withdrawable at any time.
We do not sell your data. The only thing we send an advertiser is the advertisement click identifier described above, with a date, and only if you consented to it; your name, your contact details, your photographs and what you told us are never sent to anyone for advertising.
WhatsApp is the main way patients reach us, and it is operated by Meta, not by us. Anything you send through it is also handled under Meta’s own privacy terms and their infrastructure. If you would rather not use it, email works and so does the contact form.
Where your data goes
Our clinic is in Turkey, so if you contact us from the United States, the United Kingdom or the EU, your information is transferred to and processed in Turkey. Turkey is outside the UK/EEA and its data protection regime differs from GDPR. By contacting us you are sending your information there deliberately. If you want the safeguards applying to that transfer set out in writing before you send anything sensitive, ask and we will provide them.
How long we keep it
Enquiries that do not lead to treatment are kept only as long as needed to deal with them and are then deleted on request. If you become a patient, medical records are retained for the period Turkish healthcare law requires. Ask us and we will tell you what applies to your case.
Your rights
You can ask us to: show you what we hold about you; correct anything wrong; delete it; stop using it; or send it to you in a portable format. You can withdraw consent at any time, including for photographs already sent. Email info@afrohairclinicturkey.com and we will respond.
If you are in the EU or UK and think we have handled your data badly, you can complain to your national data protection authority. We would rather you told us first so we can fix it.
Publishing anything about you
We never publish your photographs, your words or your case on this site without separate written consent, given specifically for that purpose. Writing us a review or sending photos for assessment is not permission to publish them. Consent can be withdrawn later and we will take the material down.
Children
This site is not directed at anyone under 18 and we do not knowingly collect their data.
Changes
If this policy changes materially, the date at the top changes with it. What you may and may not do with the material on this site, and the limits of what it is, are a separate matter — the terms of use cover those.