How I handle your data

HaarTransparant is a personal initiative that guides you through a possible hair transplant in Istanbul. I am responsible for processing the data you share via this website. The full legal company details (including a Chamber of Commerce number, if applicable) will be added here once finalized.

The service and intake are intended for people aged 18 and older.

Depending on how you get in touch, I process, among other things:

• name, email address and phone number;
• your question or message, and your preference for how I get in touch;
• for an intake: age, information about hair loss and desired result;
• medical information you fill in yourself, such as medication, conditions and previous surgeries;
• photos you upload yourself;
• timestamps at which you give or withdraw consent, and which version of the consent text you saw;
• the communication and process history of your request (for example, which step your request has gone through);
• technical security data, such as an IP-address-based counter that prevents form abuse.

Most substantive data is received directly from you. In addition, limited technical data is processed for security and abuse prevention.

I use this data to get in touch with you, to practically check your question or intake for completeness and clarity, and to possibly later separately ask your consent before anything is shared with the clinic. I only use your data for the purposes described in this privacy statement.

For a general question via the contact form ("Ask your question"), I only use your name, email address and message to respond. This form does not ask for consent via a checkbox — that isn't needed for an ordinary reply to your message. Do not share medical information or photos here; the separate, more securely protected intake is meant for that (see below).

Medical information and photos you fill in or upload are used exclusively to practically assess your intake for completeness and clarity. I don't give medical advice, don't make a diagnosis, and don't assess whether a treatment is suitable or responsible. This information is not shared with the clinic without your separate consent.

Before you submit medical information or photos via the intake, I explicitly ask your consent to process this data for checking and guiding your intake. This consent is separate from the later consent to share data with the clinic.

There are two separate moments at which you give separate consent:

• For a first assessment, I share your intake information, medical information and photos with the clinic. Your name, email address and phone number are sent masked (e.g. "Thomas B."), not in full.
• Only once the clinic sees possibilities and you separately give consent afterwards do I share your full name, email address and phone number, so the clinic can contact you directly.

Both consents are voluntary. Without consent for the first assessment, I cannot present your intake to the clinic. Without consent for sharing contact details, the clinic cannot contact you directly. You can still simply keep asking me questions.

The clinic I work with is based in Istanbul, Turkey, outside the European Economic Area (EEA). When you give consent to share data with the clinic, that data is therefore processed outside the EEA. Which transfer mechanism (such as standard contractual clauses) applies here, and whether a transfer impact assessment is needed, will be confirmed before this website is production-ready. Your consent is a necessary condition for this specific sharing, but is not by itself the only mechanism governing the transfer.

To run this website and process data, I use external service providers, including for hosting, database and file storage, and sending transactional email. The final list of these providers and the agreements I make with them (including processor agreements where needed) will be added here before this website is production-ready.

I don't keep data longer than necessary for the purposes above. Below are my retention periods. With one exception, these are deliberate choices by HaarTransparant to not keep data longer than necessary (data minimization and accountability), not legally required periods.

HaarTransparant applies the following retention periods:

• incomplete, unused photo uploads: automatically deleted shortly after the upload session expires (within a few hours);
• general contact requests ("Ask your question"): 12 months after the last meaningful contact or last activity;
• an intake that stops before it's shared with the clinic (for example because you don't give consent for the first assessment): 6 months after closure or the last meaningful activity;
• an intake that has been shared with or transferred to the clinic: 12 months after closure or the last meaningful activity;
• medical information and photos: these are deleted together with the associated intake, never kept separately;
• minimal proof-of-consent for an intake (for sharing medical information or contact details with the clinic): 5 years after closure/deletion of that intake, as an internal accountability measure. A general contact request has no consent (only a displayed privacy notice) and therefore produces no separately kept proof of consent — that notice is deleted together with the contact request itself;
• rate-limit information (technical abuse prevention): 30 days;
• admin security logs and logs of the retention cleanup itself: 12 months;
• relevant financial records: 7 years, only to the extent and for as long as this is legally required (see below).

The 7-year period is a legal category for tax/financial records — at present, no invoices, commission overviews or payment data are stored within this application, so this period currently does not apply to any stored data. This period never justifies keeping medical information, intake information or photos any longer.

A retention hold can temporarily exempt a file from automatic deletion, for example during an ongoing dispute or a demonstrable legal obligation. A hold does not mean data may be kept indefinitely — longer retention only continues for as long as there is actually a demonstrable ground for it.

Data the clinic has already received itself and keeps separately falls under the clinic's own retention periods and obligations. Deleting my own copy deletes nothing from the clinic's systems.

You have the right to:

• request access to the data I process about you;
• have incorrect data corrected;
• request deletion of your data, to the extent this doesn't affect processing already lawfully carried out;
• object to processing;
• request restriction of processing;
• receive your data or have it transferred, to the extent the right to data portability applies;
• withdraw a given consent (see below);
• file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Use the separate page Submit a privacy request for these rights. I verify your identity first before providing, changing or deleting personal data.

At any time, you can:

• withdraw a given consent for future processing;
• ask me to delete your data;
• ask me for access to or correction of your data.

Withdrawing consent doesn't change anything about processing that was already lawfully carried out before that. I can't immediately delete everything in every situation: a limited minimal proof of consent or, where applicable, financial record-keeping data may still be kept for some time when that's genuinely necessary (see "How long data is kept").

If your data has already been shared with the clinic at the moment of withdrawal, I cannot enforce its deletion on the clinic's behalf merely by deleting my own copy — a request concerning the clinic itself may need to be submitted directly to the clinic as well. I'm happy to help you figure out where your request is best submitted.

Use the separate page Withdraw consent. I first verify your file number and email address before the withdrawal is carried out, so someone else can't do this on your behalf. If you had given consent to share data with the clinic and that has already happened, active access via HaarTransparant is blocked as soon as the withdrawal is carried out — earlier access by the clinic cannot be undone by that.

I take appropriate technical and organizational measures to protect your data, including limited access to systems, secure storage of photos, and encrypted connections. No system is completely watertight, but I do what is reasonably possible to prevent misuse and data breaches.

This website currently does not use any non-essential cookies for tracking, advertising or analytics. Only technically necessary storage is used, for example for the secure login session of the admin environment. If that changes in the future, this page will be updated.

For questions about your data, withdrawing consent, or a privacy request, you can email thomas@haartransparant.nl.

I may amend this privacy statement, for example if the website, the partnership with the clinic, or laws and regulations change.

Last updated: 14 July 2026.