Skip to content

Este Pera CRM

Contents
  1. Controller and contact
  2. Our roles
  3. Data we process
  4. Purposes and legal bases
  5. Google user data
  6. Meta data
  7. Use of artificial intelligence
  8. Transfers and recipients
  9. Retention
  10. Backups
  11. Your rights
  12. Cookies

Privacy policy

Last updated: 23 October 2026

This policy explains how personal data is processed in Este Pera CRM, operated by Defem Sağlık Turizm ve Ticaret A.Ş. ("Company", "we"). Este Pera CRM is sales and patient communication software for hair transplant and aesthetic clinics.

Controller and contact

  • Legal name: Defem Sağlık Turizm ve Ticaret A.Ş.
  • Address: 19 Mayıs Mah., 19 Mayıs Cd. Şişli Plaza No:7 A-Blok K.6, 34363 Şişli/İstanbul

Our roles

  • For data about clinics' patients and prospective patients, the clinic is the controller; we act as a processor on the clinic's behalf and instructions.
  • For clinic staff account data and the operation of the platform, Defem Sağlık Turizm ve Ticaret A.Ş. is the controller.

Data we process

  • Identity and contact: name, phone, email, language, country.
  • Conversations: WhatsApp, Instagram, Messenger, web chat and email messages, voice message transcripts.
  • Sales and operations records: quotes, appointments, travel (flights, transfers, accommodation).
  • Health data (special category): photos, intake answers and doctor assessments collected by the clinic; processed only with explicit consent and on the clinic's behalf.
  • Technical data: session, device, IP address, security logs.
  • Responding to enquiries and pre-contract steps (contract).
  • Planning treatment and travel (performance of contract).
  • Health data: explicit consent only.
  • Security, audit logging and legal obligations (legal obligation, legitimate interest).

Google user data

Este Pera CRM's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google connections (Google Ads, Google Analytics 4, Google Business Profile, Google Calendar) are used only for actions a clinic user explicitly starts in the panel. Data is not sold, not used for credit decisions or to train AI models, and is read by humans only for security, legal obligations or with the user's permission.

Meta data

Data from Facebook, Instagram and WhatsApp connections is processed in line with the Meta Platform Terms solely for the respective clinic's patient communication and ad reporting. It is never sold, shared with data brokers or shared between clinics. Users can remove the Meta connection in the panel or in their Meta settings at any time; see Data deletion.

Use of artificial intelligence

AI (Anthropic Claude) is used for first replies, classification, translation and summaries. When you talk to AI this is disclosed in the first message (EU AI Act Art. 50). AI does not diagnose; photo assessments are never sent to patients without a doctor's approval. Data sent to the model is pseudonymised and not used for model training.

Transfers and recipients

Data is hosted in the European Union (Amsterdam). Our service providers: hosting (Railway), content delivery and security (Cloudflare), AI (Anthropic), messaging (Meta), email (Resend), speech-to-text (Deepgram), error monitoring (Sentry). Transfers outside the EU rely on Standard Contractual Clauses.

The master key that protects the encryption keys is kept in Google Cloud KMS (the Netherlands), separately from the application servers; KMS does not see personal data.

Retention

  • Prospective patient data: 3 years after last contact (configurable by the clinic).
  • Medical records: as set by the clinic (default 20 years).
  • Raw webhook logs: 7 days; application logs: 90 days.
  • When you request erasure or the clinic permanently deletes a record, personal data (name, contact details, message contents, files) is irreversibly deleted; only anonymous statistics (country, language, stage, amount, date) remain. Health records still under a legal retention period are kept separated from your identity until the period ends, then deleted automatically.

Backups

The database is protected by the hosting provider's snapshots (Railway, EU) and a daily backup; daily backups are kept in access-restricted storage for 30 days and then deleted automatically. Backups are used only for disaster recovery. Deleted data is removed from the live system immediately and disappears from backups as they rotate, within 30 days at most.

Your rights

Under GDPR Art. 15–22 and Turkish KVKK Art. 11 you may access, rectify, erase, restrict, port and object to the processing of your data, and withdraw consent at any time. Send requests via the data request form or the contacts above; we respond within 30 days. You may also lodge a complaint with your supervisory authority.

Cookies

We only use cookies strictly necessary for sessions and security. Details: Cookie policy.

Last updated: 23 October 2026