Privacy and Security Policy
Last updated: 19 October 2026
This policy explains how ScalpIQ ("ScalpIQ") collects, uses and protects your information on https://scalpiq.app and in ScalpIQ services. The statutory notice on personal data processing is in the Personal Data Notice.
1. Information we collect
- Quote and contact form: full name, clinic name, email, phone, country and the plan you are interested in.
- Purchases: company name, address, tax details, email and phone for invoicing. Card details are processed by the payment institution and never reach ScalpIQ.
- Account and usage: security logs such as username, role, login times, IP address and device information.
- Personal presentation links: when a presentation is opened, IP address, device and browser details, language, time zone and the sections viewed are recorded for security.
- Site visits: page view and interaction data collected via cookies and similar technologies (see Section 4).
- Patient data: patient photos, medical history and health information uploaded by clinics. The clinic is the data controller for this data; ScalpIQ processes it only on the clinic's instructions.
2. How we use information
- to respond to quote requests and contact you;
- to provide, invoice and support the service you purchase;
- to keep accounts secure and prevent unauthorised access and misuse;
- to understand how the site and service are used and improve them;
- to meet our legal obligations.
We do not use patient data for advertising, marketing or training AI models, and we never sell any data.
3. Who we share it with
Information is shared only as needed to provide the service, with:
- hosting and infrastructure providers (servers and databases);
- email delivery services (e.g. Resend);
- payment institutions and banks (for payment processing only);
- analytics and advertising tools (Meta Pixel, Microsoft Clarity);
- public authorities where required by law.
Some of these providers have servers outside Turkey. Transfers abroad are made in accordance with Article 9 of Law No. 6698.
4. Cookies
Besides cookies required for the site to work, we use Meta Pixel and Microsoft Clarity for visit statistics and ad measurement. Your language preference is stored in your browser. You can delete or block cookies in your browser settings; some features may then stop working.
5. Security measures
- Encrypted transport: all traffic to the site and apps is encrypted with TLS (HTTPS).
- Encrypted storage: patient data and photos are stored encrypted.
- Role-based access: each user sees only the data their role requires, and access is logged.
- Location removal: GPS and location data is removed automatically from uploaded photos.
- Versioned reports: changes to reports are stored as versions and can be traced.
- Secure payment: payments are taken with 3D Secure on PCI-DSS compliant payment infrastructure. Card number, expiry date and security code never reach or are stored on ScalpIQ servers.
- Backups: data is backed up regularly.
No system is 100% secure. If we detect a data breach, we notify the Personal Data Protection Board and affected people within the period required by law.
6. Retention
We keep information for as long as the purpose requires and for statutory retention periods. Invoices and accounting records are kept for 10 years under Turkish tax and commercial law, security logs for 2 years and quote requests for 2 years from the last contact. Patient data is deleted at the end of the 30-day export period after the agreement ends.
7. Your rights
See the Personal Data Notice for your rights and how to apply. Requests about patient data should first be addressed to the relevant clinic.
8. Changes
We may update this policy. The current version is always published on this page.