Privacy policy

Body Expert information

Updated: 2 November 2026.

Who is responsible for your data?

BODY EXPERT ULUSLARARASI TURİZM MEDİKAL VE DANIŞMANLIK TİC. LTD. ŞTİ., trading as Body Expert, is the controller for processing related to the www.bodyexpert.online website, enquiries and the coordination of its services. Contact: info@bodyexpert.online; correspondence address: Fulya Mah. Prof. Bülent Tercan Cad., Fulya Life Residence N°26, Şişli / İstanbul, Turkey.

The practitioners and facilities providing your treatment are responsible for processing within their own medical activities. They provide the information applicable to your clinical record.

Information concerned

The enquiry form collects your title, first and last name, email address, telephone number, the type of treatment you are interested in (hair, aesthetic or dental) and the page from which you send it. Depending on your later exchanges, this may also include your country, language, project, messages, communication preferences, information needed to organise your stay and contractual documents.

Browsing also generates technical data: IP address, browser details, pages visited, the events described under “Audience measurement and contact links” and your tracking preferences.

Provide only information relevant to your enquiry. Required fields are necessary to process the request. Do not include a medical file, identity document or intimate photograph in a general message, including on WhatsApp: ask your coordinator which channel to use for documents needed by the clinical team.

Purposes and legal bases

Answering enquiries and preparing proposals: steps taken at your request before entering into a contract, followed by performance of the contract for clients.
Coordinating appointments and agreed services: performance of the contract.
Billing and administrative duties: applicable legal obligations.
Website security, protecting the form against automated submissions, abuse prevention and legal claims: Body Expert’s legitimate interests, balanced against your rights.
Measuring website audience and the use of contact buttons: consent (“Statistics” category), subject to the cookieless signals described below.
Measuring the performance of Google advertising and showing Body Expert ads to people who visited the website: consent (“Marketing” category).
Electronic marketing: consent where required by law, separate from an enquiry and withdrawable at any time.

Health-related information requires additional protection. Where explicit consent is necessary for its collection or disclosure by Body Expert, that consent is obtained separately. General acceptance of this policy is not consent to treatment, marketing or the processing of health data.

Recipients

Enquiries are intended for authorised Body Expert staff. Relevant practitioners and facilities receive only the information necessary to assess or organise your care. Data are not reused for a third party’s marketing without an appropriate legal basis.

The following providers act on Body Expert’s behalf or supply a service built into the website: IONOS (hosting), NitroPack (file optimisation and delivery), Zoho (management of relationships with people who contact Body Expert), Google (audience measurement, advertising, form protection, map), PostHog (audience measurement and session recording), IPinfo (telephone country code), jsDelivr (telephone field library) and WhatsApp, if you choose that channel. The next section describes the role of each.

Audience measurement and contact links

Hosting and file delivery

The website is hosted by IONOS SE on a server located in Germany. The NitroPack service of NitroPack Ltd. (Bulgaria) optimises and delivers images, stylesheets and scripts: it receives your connection’s IP address and records it in its service logs, which are deleted automatically after 7 to 90 days according to its privacy policy.

Enquiry form

When you submit the form, your answers are sent to Zoho CRM, the software Body Expert uses to follow up enquiries. They are sent to the crm.zoho.com domain, which corresponds to Zoho’s United States data centre.

The form is protected by Google reCAPTCHA v3. The service loads on every page, because the form can be opened from any page; it gives each submission a score based on interactions with the website, to tell human submissions from automated ones, and sends Google technical information about your browser and device for that purpose. Google’s Privacy Policy and Terms of Service apply.

To pre-fill the country code of your telephone number, your browser queries the ipinfo.io service of IPinfo Inc. (United States) when the form loads: the service receives your IP address and returns the matching country, which you can change in the field. The library that formats this field is downloaded from the public jsDelivr network, which also receives your IP address.

After a successful submission, the website records a “lead submitted” event in Google Analytics that only states where the form was located (enquiry pop-up or form within the page). None of the information you entered is sent to the measurement tools.

WhatsApp link

On mobile devices, the contact bar at the bottom of the page includes a WhatsApp button that opens a conversation with Body Expert’s number. This button takes you off the website: the WhatsApp app or website then processes your data under its own rules, set out in the WhatsApp privacy policy (WhatsApp Ireland Limited for users in the European Region). Body Expert receives the messages you send and processes them to answer your request, with the same retention periods as other enquiries.

A click on this button is recorded in Google Analytics together with the button’s location. The content of your conversations is never sent to the measurement tools.

Audience measurement with Google Analytics

Body Expert measures website traffic with Google Analytics 4, a service of Google Ireland Limited and Google LLC. Google Analytics records, among other things, page views, engagement time, clicks on the WhatsApp button and successful form submissions, with the location of the button or form.

If you accept the “Statistics” category, Google Analytics sets the _ga and _ga_QZ1Q4RXM0K cookies, which recognise your browser from one visit to the next for up to two years.

The website uses Google’s consent mode in its “advanced” version. Before you make a choice, and after you reject the “Statistics” category, the Google Analytics tag still loads and sends Google cookieless signals: the page viewed, the event measured, your consent status, a random number generated for each page view and the technical information sent with any connection (IP address, browser, referring page). No identifier is stored in your browser in that case, and your page views cannot be linked to one another through a cookie. Google uses these signals to estimate, through statistical modelling, the share of traffic the website does not measure directly. For these signals, Body Expert relies on its legitimate interest in knowing the overall traffic of its website. You can block these signals through your browser settings or extensions.

According to Google, Google Analytics 4 does not log or store IP addresses. In Body Expert’s Google Analytics property, detailed event data are kept for 2 months and user-level data for 14 months; the user-level period restarts with each new visit. These periods do not apply to aggregated reports.

Audience measurement with PostHog

If you accept the “Statistics” category, Body Expert also measures website use with PostHog. The project belongs to a PostHog organisation opened in Body Expert’s name, in the European instance of the service, hosted in Frankfurt (Germany); PostHog acts on Body Expert’s behalf and IP addresses are anonymised in the project. PostHog records pages viewed and left, clicks on the WhatsApp button and requests sent through the form, without the content you type. Automatic click capture is switched off, and no individual profile is created for visitors who have not identified themselves.

PostHog also records how some visits unfold, meaning the pages displayed and the actions taken on them, so that Body Expert can replay them to identify navigation difficulties and improve the website’s usability. These recordings start only after you accept the “Statistics” category. Input fields and form text are masked: what you type into the form does not appear in the recordings. Recordings are kept for 30 days. They contain neither browser console logs nor network requests.

PostHog sets the ph_<project identifier>_posthog cookie (365 days) and stores operating data in your browser’s local storage. PostHog does not load without your consent. If you withdraw your consent, PostHog stops, and its cookie and local data are deleted. Events are kept for one year.

Advertising with Google Ads

If you accept the “Marketing” category, Body Expert’s Google Ads tag fires. It measures enquiries that follow a click on a Body Expert ad and adds your browser to lists of visitors to whom Body Expert may show its ads on Google services (remarketing). It sets the _gcl_au cookie (90 days), and Google may set its own cookies on its domains, such as doubleclick.net, depending on your browser settings. Google also uses this data for its own purposes, described on its page How Google uses information from sites or apps that use its services. The Google Ads tag does not fire before you make a choice or after a rejection. Your browser stays on these lists for no more than 540 days, the maximum allowed by Google Ads.

Google Maps

The home page includes a Google Maps map. It loads only if you accept the “Marketing” category or click on its preview; Google then receives your IP address and may set cookies.

Transfers to the United States

Google LLC complies with the EU-U.S. Data Privacy Framework and relies on standard contractual clauses where required. For Zoho and IPinfo, you may ask Body Expert for the applicable safeguards, as explained in the next section.

Changing or withdrawing your consent

The “Manage consent” tab at the bottom of each page and the cookie policy let you accept, reject or withdraw your consent for each category at any time. Withdrawing consent is as easy as giving it and does not affect earlier processing. You can also delete cookies already set through your browser settings.

Processing in Turkey and international transfers

Body Expert and its clinical teams are based in Turkey, outside the European Economic Area, where the information you send them is processed. Website hosting (IONOS), file delivery (NitroPack) and PostHog audience measurement take place in the European Union. Google, Zoho and IPinfo may process data in the United States, as described in the previous section.

Transfers falling within Chapter V of the GDPR rely on a recognised mechanism, such as an adequacy decision or standard contractual clauses together with the necessary assessment and safeguards. You may ask Body Expert for information on the recipients, countries and safeguards applicable to your data.

Retention

The GDPR does not prescribe one retention period for every type of information. Body Expert distinguishes the following purposes:

Prospect marketing without a contract: no more than three years from collection or your last active contact, with earlier deletion following withdrawal of consent or an applicable objection. A new message sent by Body Expert does not restart this period.
Client coordination: for the relationship and necessary follow-up. Afterwards, only records needed for a legal obligation or legal claim remain in restricted archives for the applicable period.
Accounting and contractual records: for the statutory obligations and limitation periods applicable to the company and service; they are not used for marketing while archived.
Medical information: limited to Body Expert’s coordination needs. Clinical record retention by healthcare professionals follows their own requirements; the three-year marketing period does not replace those rules.
Marketing objections: minimum information retained to honour your choice, for at least three years in accordance with CNIL guidance.
Google Analytics audience measurement: 2 months for detailed event data, 14 months for user-level data.
PostHog audience measurement: one year for events, 30 days for session recordings.
NitroPack delivery logs: between 7 and 90 days.
Cookies and consent choices: see the cookie policy.

At the relevant deadline, data are deleted or anonymised. These rules also cover exports and copies, subject to backup renewal cycles and any justified legal archiving.

Your rights

Subject to the GDPR’s conditions, you may request access, rectification, erasure, restriction and portability, and object to processing based on legitimate interests, including cookieless audience measurement signals. You may object to direct marketing at any time and withdraw consent without affecting the lawfulness of earlier processing; for trackers, use the “Manage consent” tab.

Write to info@bodyexpert.online explaining your request. Proportionate identity evidence will be requested only if there is reasonable doubt. The normal response period is one month; it may be extended by up to two further months under the GDPR’s conditions, in which case you are informed within the first month.

You may complain to the competent supervisory authority, including the CNIL for residents of France. Turkey’s supervisory authority is the KVKK. You may also ask for clarification about processing before sending sensitive documents.