This Privacy Policy explains how we collect and use personal data when you visit dryunusoc.com, contact us or request information about limb lengthening surgery. We process personal data in accordance with Turkish Law No. 6698 on the Protection of Personal Data (KVKK) and, where applicable, the EU General Data Protection Regulation (GDPR).
1Data controller and contact details
The data controller for the personal data described in this policy is the operator of dryunusoc.com ("we", "us"), based in Istanbul, Türkiye.
- Email: contact@dryunusoc.com
- Phone / WhatsApp: +90 531 988 30 90
2Personal data we collect
- Contact form: your full name, email address, phone number (optional) and message.
- Blog comments: your name, email address, website (optional), comment, IP address and the date and time of your comment.
- WhatsApp, email, phone and social media messages: your name, contact details and any information, photos or documents you choose to send us.
- Health information you share for medical evaluation, such as height, medical history, X-rays and test results.
- If you proceed with treatment: passport details for the medical invitation letter used in your visa application, travel details for airport transfers and accommodation, the details needed to issue your complication insurance policy, and payment and invoicing information.
- Technical and usage data: IP address, browser and device information, and — only with your consent — how you use our website (see section 7).
- Contact button statistics: when you tap our floating contact buttons, we record which button was used, the page, your device type and language, a random visitor ID stored in your browser and a one-way encrypted (hashed) form of your IP address. This is used only to count interest per channel and does not identify you by name.
Providing personal data is voluntary. However, without your contact details we cannot answer your enquiry, and we cannot carry out a medical evaluation without your health information. Our cost calculator runs only in your browser; the values you enter are not sent to us unless you choose to send your plan via WhatsApp.
3Purposes and legal bases for processing
| Purpose | Data | Legal basis (KVKK / GDPR) |
|---|---|---|
| Responding to your enquiry and contacting you | Contact data, message | Steps taken at your request before a contract — KVKK Art. 5(2)(c) / GDPR Art. 6(1)(b) |
| Medical evaluation and treatment planning | Health information | Your explicit consent — KVKK Art. 6 / GDPR Art. 9(2)(a) |
| Arranging your treatment, invitation letter, transfers, accommodation and insurance if you decide to proceed | Identity, passport, contact, travel, insurance, payment and necessary health data | Performance of a contract; explicit consent for health data |
| Publishing and moderating blog comments | Comment data | Our legitimate interest — KVKK Art. 5(2)(f) / GDPR Art. 6(1)(f) |
| Protecting forms against spam and abuse; website security | IP address, technical data | Our legitimate interest |
| Legal and accounting obligations | Relevant records | Legal obligation — KVKK Art. 5(2)(ç) / GDPR Art. 6(1)(c) |
| Website statistics and advertising measurement | Usage data, cookies | Your consent (cookie settings) |
We do not make decisions about you based solely on automated processing, and we do not sell your personal data.
4Health data
Health information is sensitive personal data. We process it only with your explicit consent, given when you send us your medical information or documents, and only for the purposes described above. You can withdraw your consent at any time by emailing contact@dryunusoc.com; this does not affect processing carried out before withdrawal.
5Recipients
We share personal data with the following recipients only to the extent necessary:
- the surgeon, hospital and healthcare professionals involved in your evaluation and treatment;
- travel and accommodation partners, if you proceed with treatment, limited to the details needed to make arrangements and excluding medical information;
- the insurance company, to issue your complication insurance policy;
- public authorities, where required by law;
- service providers acting on our behalf:
| Provider | Service | Location |
|---|---|---|
| Hetzner Online GmbH | Website hosting | Germany |
| Cloudflare, Inc. | Protection of forms against spam and abuse (Turnstile) | USA / global |
| Brevo (Sendinblue SAS) | Delivery of emails submitted through forms | France |
| Google LLC / Google Ireland Ltd. | Email (Google Workspace), Google Analytics, Google Ads, Tag Manager, YouTube | USA / EU |
| Microsoft Corporation | Microsoft Clarity website analytics | USA |
| Automattic Inc. | Akismet comment spam filtering | USA |
| CookieYes Limited | Cookie consent management | United Kingdom |
| Meta Platforms | Messaging when you contact us via WhatsApp, Instagram or Facebook | USA / EU |
| X Corp. / TikTok | Messaging when you contact us via X or TikTok | USA / global |
6International transfers
Some of the recipients above are located outside Türkiye. For transfers to service providers we use the standard contracts published by the Turkish Personal Data Protection Board under Article 9 of KVKK. Communications with you while you are abroad, and transfers needed to organise your treatment, are made where necessary for the performance of a contract with you (KVKK Art. 9(6)). Where GDPR applies, transfers rely on adequacy decisions or the European Commission's Standard Contractual Clauses.
7Cookies
Necessary cookies are used to run the website. Analytics and advertising cookies are used only after you accept them in our cookie banner. You can change your preferences or withdraw your consent at any time using the cookie settings icon on the website.
8Retention
- Enquiries that do not lead to treatment: 2 years from our last contact.
- Records related to treatment: 10 years after our services end (general limitation period under Turkish law).
- Accounting records: 10 years, as required by law.
- Blog comments: as long as the comment is published.
- Analytics data: 14 months.
- Contact button statistics: 3 months.
Once the applicable retention period has expired, we delete, destroy or anonymise the data.
9Your rights
Under Article 11 of KVKK, you may ask whether your personal data is being processed and request information about that processing; learn the purposes of processing and whether your data is used in accordance with those purposes; obtain information about the third parties in Türkiye or abroad to whom your data is transferred; request the correction, deletion or destruction of your data; request that recipients be notified of these actions; object to a result that adversely affects you and arises exclusively from automated analysis; and claim compensation for damage caused by unlawful processing. If the GDPR applies to you, you also have the right to request restriction of processing, the right to data portability, the right to object to processing and the right to withdraw your consent at any time.
Send your request to contact@dryunusoc.com. We will respond to your request free of charge within 30 days. You may also complain to the Turkish Personal Data Protection Authority (www.kvkk.gov.tr) or, in the EU, to the data protection authority of your country.