Privacy Policy

1. Who we are

Top Surgery Doctor ("we", "us") operates this website and coordinates gender-affirming chest surgery consultations with an independent surgical team and hospital partner in Istanbul, Türkiye. For the purposes of Turkish data protection law (KVKK) and, where applicable, the EU/UK GDPR, we are the data controller for personal data collected through this website.

Contact: hello@topsurgerydoctor.com · Teşvikiye Caddesi, Nişantaşı, Şişli, 34365 Istanbul, Türkiye.

2. What we collect

We collect personal data in three ways:

• Contact form (/contact): name, email address, phone number, your technique preference, your message, and — only if you choose to attach them — photos of your chest.
• Automatically: IP address, browser user-agent, and, only if you accept optional cookies via the banner described below, basic analytics of which pages you visit.
• Reviews you submit for publication: initials, general location, technique and a short review text. We never publish a review without your explicit, separately confirmed consent — see our review verification process.

3. Photos and health information are special category data

Chest photos, and anything you tell us in your message about your body, medical history or gender identity, are treated as health data — a "special category" of personal data under both KVKK and GDPR that requires a higher standard of protection. We only collect this data when you voluntarily submit it, and only after you've ticked the dedicated consent checkbox on the contact form referencing this Privacy Policy. We use it solely to let the surgical team assess your case and prepare a consultation — never for marketing, and never published without a further, separate consent for that specific purpose.

4. Why we use it, and our legal basis

• Responding to your enquiry — necessary to take the steps you request before any treatment agreement (KVKK Art. 5; GDPR Art. 6(1)(b)).
• Processing photos / health details — your explicit consent, given via the checkbox on the contact form (KVKK Art. 6; GDPR Art. 9(2)(a)). You can withdraw this at any time; see Section 8.
• Preventing spam and abuse (e.g. the rate-limit on repeated form submissions) — our legitimate interest in keeping the enquiry inbox usable (KVKK Art. 5; GDPR Art. 6(1)(f)).
• Publishing a review — your separate, explicit consent, confirmed by our team before publication.

5. Who we share it with

Your enquiry is visible to the surgical and clinical coordination team preparing your consultation, and, once you proceed toward treatment, our JCI-accredited hospital partner in Istanbul. Infrastructure providers (web hosting, email delivery) process data on our behalf under confidentiality obligations, strictly to deliver the service. We do not sell personal data, and we do not share it with advertisers.

6. International data transfer

If you are contacting us from outside Türkiye, you are voluntarily sending your data to us for processing in Türkiye, where the surgical team and hospital are based. You do this by submitting the form and confirming the KVKK consent checkbox, which serves as your explicit consent to this transfer.

7. How long we keep it

Enquiry and message data is kept for as long as needed to respond to you and, if you proceed, to support your care — and in any case no longer than 3 years from your last contact with us, unless a longer period is required by Turkish healthcare record-keeping law. You can ask us to delete your data sooner at any time (Section 8); we'll comply unless we're legally required to keep a specific record.

8. Security

The website is served over HTTPS. Uploaded photos are stored outside the public web root and are only ever accessible to an authenticated staff member through the admin system — there is no public URL that serves them directly. Access to the admin system requires a password and is logged.

9. Your rights

Subject to applicable law, you can ask us to: tell you what data we hold about you; correct it; delete it; restrict or object to our processing of it; receive a portable copy of it; and withdraw any consent you've given (which does not affect processing carried out before the withdrawal). Turkish data subjects have the specific rights listed in KVKK Article 11. To exercise any of these rights, email hello@topsurgerydoctor.com. If you're not satisfied with our response, Turkish data subjects can complain to the Kişisel Verileri Koruma Kurumu (KVKK Kurumu); EU/UK visitors can complain to their local data protection authority.

10. Cookies

When you first visit, a banner asks whether you accept optional cookies. If you choose Reject, we set nothing beyond what's strictly necessary to run the site (e.g. your CSRF/session cookie and the record of your cookie choice itself, tsd_cookie_consent, kept for 180 days). If you choose Accept, we may additionally use cookies to remember basic preferences and, if enabled in future, anonymous analytics — this site does not currently run any third-party analytics or advertising script.

You can change your choice at any time: reopen the cookie banner, or clear cookies in your browser settings.

11. Children

This website and our services are not directed at anyone under the age of 18. Chest surgery consultations for minors, where legally possible at all, require guardian involvement handled directly by the surgical team — never through this contact form alone.

12. Changes to this policy

We may update this policy as the site or our processes change. The "last updated" date at the top of this page always reflects the current version. Material changes affecting how we handle health data will be highlighted here.