How I handle your data

HaarTransparant is a personal initiative that guides you through a possible hair transplant in Istanbul, provided as a service of Boel Consultancy (eenmanszaak, KVK 42126326). I am responsible for processing the data you share via this website.

The service and intake are intended for people aged 18 and older.

Depending on how you get in touch, I process, among other things:

• name, email address and phone number;
• your question or message, and your preference for how I get in touch;
• for an intake: age, information about hair loss and desired result;
• medical information you fill in yourself, such as medication, conditions and previous surgeries;
• photos you upload yourself;
• timestamps at which you give or withdraw consent, and which version of the consent text you saw;
• the communication and process history of your request (for example, which step your request has gone through);
• security data, such as a technical rate-limit counter based on your IP address that prevents form abuse.

Most substantive data is received directly from you. In addition, limited technical data is processed for security and abuse prevention.

I use this data to get in touch with you, to check your question or intake for completeness and clarity, and — where relevant — to later ask your separate consent before anything is shared with the clinic. I only use your data for the purposes described in this privacy statement.

For a general question via the contact form ("Ask your question"), I only use your name, email address and message to respond. This form does not ask for consent via a checkbox — that isn't needed for an ordinary reply to your message. Do not share medical information or photos here; the separate, more securely protected intake is meant for that (see below).

Medical information and photos you provide or upload are used exclusively to check your intake for completeness and clarity. I don't give medical advice, don't make a diagnosis, and don't assess whether treatment is suitable or medically appropriate. This information is not shared with the clinic without your separate consent.

Before you submit medical information or photos via the intake, I explicitly ask your consent to process this data for checking and guiding your intake. This consent is separate from the later consent to share data with the clinic.

There are two separate moments at which you give separate consent:

• For an initial assessment, I share your intake information, medical information and photos with the clinic. Your name, email address and phone number are sent masked (e.g. "Thomas B."), not in full.
• Only once the clinic believes treatment may be an option and you separately give consent afterwards do I share your full name, email address and phone number, so the clinic can contact you directly.

Both consents are voluntary. Without consent for the initial assessment, I cannot present your intake to the clinic. Without consent for sharing contact details, the clinic cannot contact you directly. You can always keep asking me questions.

The clinic I work with is based in Istanbul, Turkey, outside the European Economic Area (EEA). I do not currently share personal data with the clinic. This will remain disabled until the required agreements, security measures and safeguards for international transfers have been completed and verified. If sharing is enabled later, assessment information and contact details will remain subject to separate, voluntary consent steps, as described above.

To run this website and process data, I use carefully selected external service providers for categories such as website hosting; database, authentication and secure file storage; transactional email delivery; and technical maintenance and security. These providers only process data where necessary for their assigned service, under appropriate contractual and security arrangements.

I don't keep data longer than necessary for the purposes above. Below are my retention periods. With one exception, these are deliberate choices by HaarTransparant to not keep data longer than necessary (data minimisation and accountability), not legally required periods.

HaarTransparant applies the following retention periods:

• incomplete, unused photo uploads: automatically deleted shortly after the upload session expires (within a few hours);
• general contact requests ("Ask your question"): 12 months after the last meaningful contact or last activity;
• an intake that stops before it's shared with the clinic (for example because you don't give consent for the initial assessment): 6 months after closure or the last meaningful activity;
• an intake that has been shared with or transferred to the clinic: 12 months after closure or the last meaningful activity;
• medical information and photos: these are deleted together with the associated intake, never kept separately;
• minimal evidence of consent for an intake (for sharing medical information or contact details with the clinic): 5 years after closure/deletion of that intake, as an internal accountability measure. A general contact request has no consent (only a displayed privacy notice) and therefore produces no separately kept evidence of consent — that notice is deleted together with the contact request itself;
• rate-limit information (technical abuse prevention): 30 days;
• security logs of the admin area and logs of the automatic cleanup process: 12 months;
• relevant financial records: 7 years, only to the extent and for as long as this is legally required (see below).

The seven-year retention period is a legal category for tax/financial records — at present, no invoices, commission overviews or payment data are stored within this application, so this period currently does not apply to any stored data. This period never justifies keeping medical information, intake information or photos any longer.

A temporary suspension of automatic deletion can mean a file is not automatically deleted, for example during an ongoing dispute or a demonstrable legal obligation. Such a suspension does not mean data may be kept indefinitely — longer retention only continues for as long as there is actually a demonstrable ground for it.

Data that the clinic has already received and retains separately falls under the clinic's own retention periods and obligations. Deleting my own copy deletes nothing from the clinic's systems.

You have the right to:

• request access to the data I process about you;
• have incorrect data corrected;
• request deletion of your data, unless a legal exception or another valid reason for continued retention applies;
• object to processing;
• request restriction of processing;
• receive your data or have it transferred, to the extent the right to data portability applies;
• withdraw consent you previously gave (see below);
• file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Use the separate Submit a privacy request page for these rights. To prevent data from being disclosed to or changed by the wrong person, I may ask for additional information where necessary to verify your identity.

At any time, you can:

• withdraw consent you previously gave for future processing;
• ask me to delete your data;
• ask me for access to or correction of your data.

Withdrawing consent doesn't change anything about processing that was already lawfully carried out before that. I can't immediately delete everything in every situation: limited, minimal evidence of consent or, where applicable, data from the financial records may still be kept for some time when that's genuinely necessary (see "How long data is kept").

If your data has already been shared with the clinic at the moment of withdrawal, I cannot enforce its deletion on the clinic's behalf merely by deleting my own copy — a request concerning the clinic itself may need to be submitted directly to the clinic as well. I'm happy to help you figure out where your request is best submitted.

Use the separate Withdraw consent page. I first verify your reference number and email address before the withdrawal is carried out, so someone else can't do this on your behalf. If you had given consent to share data with the clinic and that has already happened, active access via HaarTransparant is blocked as soon as the withdrawal is carried out — earlier access by the clinic cannot be undone by that.

I take appropriate technical and organisational measures to protect your data, including limited access to systems, secure storage of photos, and encrypted connections. No system can be completely secure, but I do what is reasonably possible to prevent misuse and data breaches.

This website currently uses no non-essential cookies for tracking, advertising or analytics. Only technically necessary cookies and similar storage are used, for example for the secure login session in the admin area. If this changes in the future, I will update this privacy statement.

For questions about your data, withdrawing consent, or a privacy request, you can email thomas@haartransparant.nl.

I may amend this privacy statement, for example if the website, the partnership with the clinic, or laws and regulations change.

Last updated: 14 July 2026.