Privacy Policy

Last updated: 3 September 2026

1. Who we are

Auravia Esthetic (“Auravia”, “we”, “us”) operates this website and provides aesthetic treatment coordination and clinical services in Istanbul, Türkiye. For the purposes of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and, where it applies, the EU General Data Protection Regulation (“GDPR”), Auravia Esthetic is the data controller for the personal data described in this policy.

Contact: Nişantaşı, Şişli, Istanbul, Türkiye · info@auraviaesthetic.com · +90 540 490 57 21

2. What data we collect

2.1 Data you give us

• Identity and contact data: name, country, email address, telephone and WhatsApp number, age, gender.
• Health data: the photographs you send, your description of the treatment you are considering, medical history, medication, previous procedures and any clinical documents you share. Under both KVKK and GDPR this is a special category of personal data and receives additional protection.
• Travel and booking data: preferred dates, flight details, accommodation preferences, companion details where you provide them.
• Correspondence: the content of your messages to us on WhatsApp, email or telephone.

2.2 Data collected automatically

• Technical data: IP address, browser type and version, device type, operating system, referring page and pages viewed.
• Cookie data: as described in our Cookie Policy.

3. Why we use it, and on what legal basis

Purpose	Legal basis
Assessing your enquiry and preparing a treatment plan and quote	Your explicit consent (health data); steps taken at your request prior to a contract
Providing treatment, aftercare and follow-up	Performance of a contract; provision of healthcare services by or under the responsibility of health professionals bound by professional secrecy
Arranging accommodation, transfers and interpretation	Performance of a contract
Responding to your messages and questions	Our legitimate interest in answering enquiries
Keeping medical records as required by law	Compliance with a legal obligation
Website security and fraud prevention	Our legitimate interest in operating a secure website
Analytics and marketing measurement	Your consent, given through the cookie banner
Publishing your photographs or review	Your separate, specific written consent — never assumed

4. Explicit consent for health data

We process the photographs and medical information you send only on the basis of your explicit consent, given when you tick the consent box on our form or when you send this information to us directly on WhatsApp or by email. You may withdraw that consent at any time by writing to info@auraviaesthetic.com. Withdrawal does not affect processing carried out before the withdrawal, and it does not remove records we are required by law to retain.

5. Who we share it with

We share the minimum necessary data with:

• the physicians, dental laboratories and healthcare facilities involved in your treatment;
• hotels and transfer providers, for your booking (name and dates only — never health data);
• interpreters where you have requested one;
• our IT and hosting providers, under written confidentiality and data processing terms;
• professional advisers, insurers and public authorities, where we are legally required or entitled to do so.

We do not sell your personal data, and we do not share it with advertisers.

6. International transfers

Auravia Esthetic is based in Türkiye, so if you contact us from the European Economic Area or the United Kingdom your data is transferred outside that area. We rely on your explicit consent for this transfer, and on the fact that the transfer is necessary for the performance of a contract concluded in your interest. WhatsApp messages are processed by Meta Platforms in accordance with its own privacy terms; if you prefer not to use WhatsApp, contact us by email instead.

7. How long we keep it

• Enquiries that do not lead to treatment: up to 24 months from your last contact, then deleted.
• Patient medical records: retained for the period required by Turkish health legislation, which is generally not less than 20 years.
• Financial and contractual records: 10 years, as required by Turkish commercial and tax law.
• Website analytics data: up to 14 months.

8. How we protect it

Access to your file is restricted to the clinical team and the coordinator assigned to you. Data is transmitted over encrypted connections, stored on access-controlled systems, and staff are bound by confidentiality obligations. Photographs are stored separately from marketing systems and are never uploaded to advertising platforms.

9. Your rights

Under KVKK Article 11 and, where applicable, GDPR Articles 15–22, you have the right to:

• learn whether we process your personal data, and request information about it;
• obtain a copy of the data we hold about you;
• have inaccurate data corrected;
• request erasure or destruction where the grounds for processing no longer exist;
• request restriction of processing, or object to processing based on legitimate interests;
• receive your data in a portable format and have it transmitted to another controller;
• withdraw consent at any time;
• object to decisions produced solely by automated analysis (we do not make such decisions);
• claim compensation for damage arising from unlawful processing.

10. How to exercise your rights

Write to us at info@auraviaesthetic.com from the email address you used to contact us, or send a signed written request to our address above. We will identify you before acting on a request, and we will respond within 30 days at the latest.

If you are not satisfied with our response, you may lodge a complaint with the Turkish Personal Data Protection Authority (KVKK Kurumu, kvkk.gov.tr). If you are in the EEA or the UK, you may also complain to your local supervisory authority.

11. Children

Our services are directed at adults. We do not knowingly process the data of anyone under 18 without the involvement and consent of a parent or legal guardian.

12. Changes to this policy

We may update this policy as our services or the law change. The current version is always published on this page with the date it took effect. Material changes affecting how we use health data will be notified to active patients directly.