Privacy Notice — Lumière Clinic & Suites

This notice explains what personal information Lumière Clinic & Suites (“we”, “us”) collects when you contact us about treatment abroad, why we collect it, how long we keep it, and the rights you have over it. It is written to meet the UK GDPR and the Data Protection Act 2018, and the EU GDPR where you contact us from the EEA.

The short version. We only collect what you send us. We use it to answer your enquiry and coordinate your treatment. We share it with the clinic you choose — nobody else. We do not sell data, we do not run advertising trackers on this website, and you can ask us to delete everything at any time.

1. Who is responsible for your data

Who we are. Lumière Clinic & Suites is the trading name under which Eftalya Cosmetic operates this website. Registered office: Moltkestraße 42, 74072 Heilbronn, Germany. Email: biosbilgisayar@gmail.com. Eftalya Cosmetic is the data controller for the information described in this notice.

Lumière Clinic & Suites is a trading name of Eftalya Cosmetic, which operates this website and acts as the data controller for the information described here. You can reach us by email at biosbilgisayar@gmail.com, or through any of the contact routes listed on our contact section, including the UK coordinator line and WhatsApp.

2. What we collect

Category	Examples	Where it comes from
Contact details	Name, phone number, email address, country of residence, preferred language	You, when you message or call us
Enquiry content	The treatment you are asking about, your questions, preferred dates	You
Health information	Medical history, photographs, measurements, medication, previous procedures — only if you choose to send them	You
Coordination records	Appointment dates, travel and accommodation arrangements, correspondence	Generated as we arrange your treatment
Technical data	IP address and browser type in standard web server logs	Automatically, when you load a page

3. Health information is treated as special category data

Anything you tell us about your body, your medical history or a procedure you are considering is special category personal data under Article 9 of the UK GDPR. We only process it where you have given your explicit consent by choosing to send it to us, or where it is necessary for the provision of health or social care under Article 9(2)(h).

You are never required to send medical details or photographs to receive general information about a treatment or an indicative price. If you would rather not share them at this stage, say so — we will still answer your questions.

4. Why we use it, and our legal basis

Purpose	Legal basis
Answering your enquiry and giving you information	Steps taken at your request before entering a contract (Art. 6(1)(b))
Passing your case to a clinic so it can assess suitability and quote	Contract, plus your explicit consent for health data (Art. 6(1)(b) and Art. 9(2)(a))
Arranging appointments, transfers and accommodation	Contract (Art. 6(1)(b))
Aftercare follow-up once you are home	Contract, and our legitimate interest in your recovery (Art. 6(1)(b) and (f))
Keeping records of what was agreed, and meeting accounting duties	Legal obligation and legitimate interest (Art. 6(1)(c) and (f))
Keeping the website available and secure	Legitimate interest (Art. 6(1)(f))

5. Who we share it with

The clinic and treating practitioners you select. They are independent providers established in Türkiye and act as separate data controllers under their own privacy terms once your case reaches them. We share only what is needed for them to assess and treat you.
Travel and accommodation providers, where you ask us to book on your behalf — name and dates only, never health information.
Our hosting provider, which stores the website and its logs on servers in the EU.
Authorities or professional advisers, where the law requires it or where we need to establish or defend a legal claim.

We do not sell your data, we do not share it with advertising networks, and we do not use it to build marketing profiles.

Messaging apps

If you contact us over WhatsApp, your message travels through WhatsApp Ireland Ltd. and is subject to their terms and privacy policy as well as ours. Message content is end-to-end encrypted, but WhatsApp still processes your phone number and metadata. If you would prefer not to use it, call or email us instead.

6. Transfers outside the UK and EEA

Treatment takes place in Türkiye, so where you go ahead your information is transferred there. Türkiye is not covered by a UK or EU adequacy decision. We rely on your explicit consent to the transfer (Art. 49(1)(a) UK GDPR) — which you give when you ask us to put your case to a clinic — and we ask receiving clinics to apply confidentiality obligations equivalent to those we are bound by. You can withdraw that consent before your case is passed on.

7. How long we keep it

What	Kept for
Enquiries that do not proceed to treatment	12 months from the last contact, then deleted
Health information you sent with an enquiry that did not proceed	Deleted as soon as you tell us you are not going ahead, or after 12 months, whichever is first
Coordination records for completed treatment	6 years, to cover the limitation period for claims
Invoices and payment records	6 years, as required for tax purposes
Web server logs	30 days

8. Your rights

You can ask us to:

give you a copy of the data we hold about you (right of access);
correct anything that is wrong or incomplete (rectification);
delete it (erasure) — we will do so unless we are required to keep records for legal or accounting reasons;
restrict how we use it, or object to our use of it where we rely on legitimate interests;
send it to you or to someone else in a portable format;
withdraw your consent to our use of your health information — this does not affect anything done before you withdrew it.

If you are not happy with our response, you can complain to the Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF — ico.org.uk/make-a-complaint, telephone 0303 123 1113. If you are in the EEA, you may complain to your national supervisory authority instead. We would rather you came to us first so we can put it right.

9. Cookies and tracking

This website sets no advertising or analytics cookies and does not load third-party trackers. There is nothing here to consent to. See our cookie notice for the detail.

10. Security

The site is served over HTTPS. Enquiry records are held on access-controlled systems and are not published or made available on the open web. Only people who need your information in order to coordinate your treatment can see it.

11. Children

Our services are for adults. We do not knowingly collect information from anyone under 18. If a minor is to be treated, we deal only with a parent or legal guardian.

12. Changes to this notice

If we change how we handle your data we will update this page and change the date below. Material changes affecting people who have already contacted us will be notified directly.

Last updated: 15 August 2026