Privacy Policy

Last updated: 1 October 2026

This Privacy Policy explains how SafeFill Clinic (“we”, “us”, “our”) handles personal data when you visit safefillclinic.com, send us a consultation request or contact us by WhatsApp, phone or email. We process personal data in line with the EU General Data Protection Regulation (GDPR), the UK GDPR and the Turkish Personal Data Protection Law No. 6698 (KVKK). Under the KVKK this page also serves as our information notice (aydınlatma metni) under Article 10.

1. Who is responsible for your data

Data controller (veri sorumlusu): SafeFill Clinic, the men’s health practice of Assoc. Prof. Dr. Tuncay Taş, urologist.
Lotus Nişantaşı, Halaskargazi Mah. No:38-66 A Blok Residence Office, Floor 5, Clinic No:88, Şişli, 34371 Istanbul, Türkiye
Email: safefillclinic@gmail.com
Phone and WhatsApp: +90 532 309 45 50

2. What we collect and why

2.1 Consultation and contact requests

Our forms ask for your name, email address, phone number with country code, the subject and your message. You may also add photos or medical documents if you choose to. Because you are contacting a urology clinic, your message can contain health information. Form submissions are emailed to our clinic mailbox; they are not stored in the website database.

We use this information to answer you, to assess whether a treatment is suitable for you and to plan a consultation, travel dates or an appointment. Legal basis: your explicit consent for health related information (GDPR Art. 9(2)(a); KVKK Art. 6) and steps taken at your request before a treatment agreement (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).

2.2 WhatsApp, phone and email

If you tap a WhatsApp or call button, you leave our website and contact us through WhatsApp (Meta Platforms Ireland Ltd.) or your phone operator; their own privacy terms apply to the transmission. We keep the messages you send us for as long as we handle your request. Please share medical photos only when we ask for them and preferably by email or WhatsApp rather than social media.

2.3 Website usage and security logs

Our web server, located in Istanbul, Türkiye, records technical data such as your IP address, browser type, device, referring page, pages requested and time of visit. We use these logs to deliver the website securely, to detect abuse and to fix errors. Legal basis: our legitimate interest in running a secure and reliable website (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).

2.4 Country detection in forms

To preselect the right country code in the phone field, your browser asks the geolocation service ipinfo.io for the country of your IP address. No name or contact details are sent to this service.

2.5 Statistics, advertising measurement and session recordings

These tools load when you open our website and set cookies in your browser (see section 3). We use them to understand which pages help visitors and which of our advertisements bring consultation requests.

• Google Analytics 4 (Google Ireland Ltd.): pages viewed, traffic sources, clicks on WhatsApp, phone and form buttons. IP addresses are truncated by Google; we keep reports for 14 months.
• Google Ads (Google Ireland Ltd.): conversion measurement and remarketing for our search campaigns. When you submit a form or click a contact button, your email address and phone number may be sent to Google in hashed (scrambled) form to measure the conversion (enhanced conversions).
• Yandex Metrica (Yandex LLC): usage statistics, click maps and anonymised session recordings (Webvisor) that show how visitors move through pages. Form fields are masked in recordings.

Legal basis: our legitimate interest in measuring and improving our website and our advertising (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)). You can object at any time: block or delete these cookies in your browser, install the Google Analytics opt-out browser add-on, turn off ad personalisation in your Google account, or write to us and we will stop processing data that can be linked to you.

2.6 Embedded map and language switcher

The map on our contact page is loaded from Google Maps, which receives your IP address when the page opens. If you use the language switcher, the page is translated on your device by Google Translate, which receives the page text and your IP address. Both services are provided by Google Ireland Ltd.

2.7 Blog comments

If you comment on a blog post, we store the name, email address and comment you enter together with your IP address to prevent spam. Comments are published under the name you provide.

3. Cookies

Our website uses the following cookies:

• Functional: language switcher settings, kept until you change the language or close the browser.
• Google Analytics: _ga and _ga_*, used to distinguish visits; up to 2 years.
• Google Ads: _gcl_au and _gcl_aw, used to link a consultation request to the advertisement that was clicked; up to 90 days.
• Yandex Metrica: _ym_uid, _ym_d and related cookies, used for statistics and session recordings; up to 1 year.

You can refuse or delete cookies in your browser settings at any time. Blocking them does not affect our forms, the WhatsApp and call buttons or any other function of the website.

4. Who receives your data

We share personal data only with service providers that help us run the website and communicate with you:

• Our hosting provider in Istanbul, Türkiye (web server and logs).
• Google (Gmail as our email service, Tag Manager, Analytics, Ads, Maps, Translate).
• Yandex (Metrica).
• ipinfo.io (country of your IP address, forms only).
• Meta Platforms (WhatsApp), when you choose to message us there.

These providers act on our behalf or as independent controllers under their own privacy policies. We do not sell personal data and we do not share it with other advertisers. Medical information you send us is handled only by the clinical team involved in your care and is protected by medical confidentiality.

5. International transfers

Our clinic and web server are located in Türkiye. If you contact us from the EU or the UK, your data is transferred to Türkiye so that we can respond to you; this transfer is necessary for the steps you request before treatment (GDPR Art. 49(1)(b)). Google processes data under the EU-U.S. Data Privacy Framework and standard contractual clauses. Yandex may process data in the Russian Federation. You can prevent this transfer by blocking Yandex cookies in your browser without losing any function of the website.

6. How long we keep your data

• Consultation requests and messages: until your request is closed and at most 24 months after our last contact, unless you become a patient. Patient records are kept for the periods required by Turkish health legislation.
• Server and security logs: up to 90 days.
• Google Analytics reports: 14 months. Yandex Metrica session recordings: up to 15 days; aggregated statistics while the counter is active.
• Cookies: as listed in section 3.
• Blog comments: until you ask us to remove them.

7. Your rights

You can ask us at any time to access the personal data we hold about you, to correct or delete it, to restrict or object to its processing, to receive it in a portable format and to withdraw consent with effect for the future. Under Article 11 of the KVKK you also have the right to learn whether your data is processed, for which purpose and to whom it is transferred, to request notification of corrections to third parties, to object to results produced by automated analysis and to claim compensation for damage caused by unlawful processing.

To exercise your rights, write to safefillclinic@gmail.com from the address you used to contact us, or send a letter to the clinic address above. We answer within 30 days. You may also complain to your local data protection authority, to the UK Information Commissioner’s Office or to the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu).

8. Security

The website is served over HTTPS and protected by a web application firewall. Access to consultation requests and medical information is limited to authorised staff bound by confidentiality. The website itself does not store form submissions or medical records.

9. Children

Our services are for adults. We do not knowingly collect personal data from anyone under 18. If you believe a minor has sent us data, contact us and we will delete it.

10. Changes to this policy

We update this policy when our services, tools or the law change. The date at the top shows the current version; material changes are announced on this page.