This is a working draft based on the current website. Organisational details and actual practices are subject to review by legal counsel.
Purpose and scope
This policy describes the basic approach to storing and deleting contact requests received through the website and records that may arise from healthcare services. Data categories and periods need to be set out in the current data inventory.
Retention principle
Personal data is retained while the specific purpose continues or an applicable legal obligation requires it. Contact messages should be reviewed once the request and necessary follow-up have ended. Patient and accounting records may be subject to different legal periods.
Setting the periods
For each category, the starting event, retention period, legal reason and responsible team should be recorded in the inventory. No fixed number of years or months is promised here until those periods are verified.
Disposal and requests
When no retention ground remains, or a valid request is assessed, data should be deleted, destroyed or anonymised in a manner suited to the storage medium. Disposal actions and exceptions should be recorded. Data requests can be sent to info@istanbulstellahair.com.
