Privacy Policy

1. General provisions and definitions

1.1. This privacy policy (the "Policy") governs the processing of personal information on the website www.drsalvadorkaplan.com (the "Site"), in enquiries received through it and in the clinic's contact channels.

1.2. The database controller is Dr. Salvador Kaplan Clinics Ltd. (ד״ר סלבדור קפלן קליניקס בע״מ), company no. 517410007, of HaNofar Street 2, Beit Mansur 1, 3rd Floor, Clinic 304, Ra'anana, Israel (the "Company").

1.3. The clinic's medical director is Dr. Salvador Kaplan, a physician holding a valid Israeli licence, who is responsible for the medical records and for medical confidentiality.

1.4. "User": any person who browses the Site or makes contact through it. "Enquirer": a User who left contact details to receive information or arrange an appointment and has not yet received medical treatment. "Patient": a person who has actually received medical treatment.

1.5. "Personal information" and "information of special sensitivity": as defined in the Protection of Privacy Law. Information about a person's medical condition is information of special sensitivity.

1.6. The Policy has been drawn up in accordance with the Protection of Privacy Law, 5741-1981, including Amendment No. 13; the Protection of Privacy (Data Security) Regulations, 5777-2017; the Protection of Privacy (Transfer of Data to Databases Abroad) Regulations, 5761-2001; the Patient's Rights Law, 5756-1996; and section 30A of the Communications (Telecommunications and Broadcasting) Law, 5742-1982.

1.7. The Policy is published in Hebrew, Spanish and English. In the event of any inconsistency between the versions, the Hebrew version prevails.

2. Nature and operation of the Site

2.1. The Site is an information website of a hair medicine clinic. It lets Users leave details to be contacted, open a WhatsApp conversation or call the clinic.

2.2. Details submitted through the "Leave my details" form are stored in a secure database operated by a cloud infrastructure provider, and are forwarded to the clinic's client management system and to internal notification channels, solely in order to contact the Enquirer.

2.3. The WhatsApp and telephone buttons on the Site open a conversation only on the User's initiative and send nothing automatically.

2.4. The Site has no user registration, requests no passwords and processes no payments.

2.5. If online appointment requests are enabled on the Site, requests will be made through the clinic's scheduling system and will not constitute a confirmed appointment until confirmed by the clinic.

3. Information collected

3.1. Details the User enters in the form: first name and telephone number.

3.2. Technical data attached to the enquiry: date and time, interface language, the page from which it was sent and its title, device type (mobile or desktop), browser language, referring website, advertising campaign parameters (UTM) and whether the enquiry arrived within office hours.

3.3. Content of communications: WhatsApp conversations, telephone calls and emails that the User chooses to hold with the clinic.

3.4. Patient information: identification and contact details, ID number, medical history, examination findings, clinical photographs, treatment details, consents and billing details, collected at the clinic to provide treatment and document it as required by law.

3.5. Connection data: IP address and browser identifier, received by the providers listed in clause 8 through the ordinary operation of the network.

3.6. Cookies and browser storage: as set out in clause 10.

3.7. The form does not request medical information. We recommend not including detailed medical information, documents or photographs in it, or in messages sent before the first appointment.

4. Source of information and purposes

4.1. Information is obtained directly from the person it concerns. No contact lists are purchased and no information is enriched from external sources.

4.2. Information is used solely to:

4.2.1. respond to enquiries, arrange appointments and send service messages concerning the appointment or treatment;

4.2.2. provide medical treatment, keep the medical record and carry out medical follow-up;

4.2.3. issue invoices, collect payments and comply with legal obligations, including tax and health regulations;

4.2.4. monitor the quality and safety of the service;

4.2.5. operate and secure the Site and prevent misuse;

4.2.6. measure the effectiveness of advertising campaigns on an aggregate basis, only with prior consent, as set out in clause 9;

4.2.7. protect the rights of the Company, the medical director and the clinic's staff, including conducting legal proceedings, handling complaints and defending against claims.

4.3. Information will not be used for a purpose other than that for which it was provided without prior notice and, where the law so requires, without consent.

4.4. No automated decision-making takes place and no profiles are created on the basis of medical information.

5. Voluntary provision and consequences of not providing information

5.1. There is no legal obligation to provide contact details on the Site; doing so depends on the User's free will and consent.

5.2. If details are not provided, it will not be possible to contact the User through this channel. The User may always call or message the clinic directly.

5.3. In the context of medical treatment, certain details are required to provide safe treatment and to meet medical documentation duties. Failure to provide them may prevent treatment.

6. Enquirer and Patient: distinction

6.1. A person who makes contact through the Site is, at that stage, someone interested in information about the services. Their details are used to respond and to arrange an appointment.

6.2. A physician-patient relationship is formed when medical treatment is actually provided. From that point, the confidentiality and medical documentation duties laid down by law apply in addition to this Policy.

6.3. A Patient's medical information is not used for commercial, advertising or segmentation purposes.

7. Medical information

7.1. There is no need to describe a medical condition in order to receive information or arrange an appointment.

7.2. Medical information is kept under medical confidentiality, access to it is limited to those involved in the treatment and its administration, and it is not disclosed to third parties except with the Patient's consent or where the law requires or permits it.

7.3. Medical information is never transmitted to advertising or measurement platforms.

8. Service providers and recipients

8.1. The Company does not sell, rent or disclose personal information to third parties for their own commercial purposes.

8.2. Information may be processed on the Company's behalf and under its instructions by the following providers:

8.2.1. Supabase, through the Lovable platform: hosting of the Site and the enquiries database;

8.2.2. EasyBizy: the clinic's client management, scheduling, messaging and invoicing system;

8.2.3. Google: font loading, map display (only when the User chooses to show it) and email and document services used for internal notifications of new enquiries;

8.2.4. Meta: WhatsApp, when the User chooses it, and Meta Pixel, only with consent, as set out in clause 9;

8.2.5. Enable: the Site's accessibility plug-in;

8.2.6. payment processors, when a payment is made at the clinic.

8.3. The providers are bound to keep the information confidential and secure and may not use it for their own purposes.

8.4. Information may also be disclosed to the Company's accountant, legal advisers and insurers, to competent authorities where the law so requires and, in legal proceedings, to the extent necessary to protect the rights of the Company, the medical director and the clinic's staff, subject to the law and to medical confidentiality.

8.5. If the clinic's activity is transferred, merged or reorganised, the information will pass to the successor, subject to medical confidentiality and to this Policy.

9. Measurement and advertising tools

9.1. The Site includes Meta Pixel (a Meta measurement tool). The tool is not loaded and makes no connection to Meta's servers before the User expressly accepts it in the privacy notice.

9.2. After consent, the tool receives general page-view data, technical identifiers (a Meta cookie), IP address, browser type and page address.

9.3. The tool is not loaded on the treatment information pages or on the medical guide, and never receives names, telephone numbers, form content, message content or medical information.

9.4. Purpose: measuring the effectiveness of advertising campaigns and showing ads to audiences, on an aggregate basis.

9.5. Consent may be withdrawn at any time through the "Privacy preferences" link at the bottom of every page. Withdrawal does not affect the lawfulness of earlier processing.

9.6. The Site does not use Google Analytics, Google Tag Manager, Google Ads tags, Meta Conversions API or session recording.

9.7. Before any other measurement or advertising tool is added, this Policy will be updated and consent will be requested again.

10. Cookies and browser storage

10.1. sk_lang (local storage): stores the chosen interface language. Necessary for the Site to function.

10.2. sk_meta_consent (local storage): stores the User's choice in the privacy notice. Necessary to respect that choice.

10.3. Meta cookies: stored only after consent, as set out in clause 9.

10.4. Google Maps cookies: stored only when the User chooses to display the map on the Site.

10.5. Enable accessibility plug-in: may store in the browser the accessibility settings chosen by the User.

10.6. Necessary storage does not require consent. All stored data can be deleted in the browser settings; doing so will cause the privacy notice to be shown again.

11. Transfers outside Israel

11.1. Some of the providers listed in clause 8, including Google, Meta and Supabase, process information on servers located outside Israel, including in the European Union and the United States.

11.2. Transfers are made in accordance with the Protection of Privacy (Transfer of Data to Databases Abroad) Regulations, 5761-2001, to countries whose laws ensure an adequate level of protection or subject to the provider's contractual undertakings.

11.3. Anyone who prefers not to use WhatsApp may contact the clinic by telephone or email.

12. Retention and medical confidentiality

12.1. Details of Enquirers who did not become Patients are kept for up to 24 months from the last contact and then deleted or anonymised, unless they must be kept for legal proceedings or a legal claim.

12.2. Medical records are kept for the periods set by the Public Health (Record Keeping) Regulations, 5737-1976, and by Ministry of Health directives.

12.3. Accounting records are kept for the periods set by tax law.

12.4. Records of consents, requests and privacy enquiries are kept for as long as needed to show how they were handled.

12.5. All medical information is protected by medical confidentiality under the Patient's Rights Law, 5756-1996.

13. Information security

13.1. The Company applies security measures in accordance with the Protection of Privacy (Data Security) Regulations, 5777-2017, and the security level applicable to the database, including: encrypted connections, permission-based access to the database, access keys held server-side only, minimisation of the fields collected and staff confidentiality undertakings.

13.2. Access to information is limited to those who need it to perform their duties.

13.3. No transmission over the Internet or through a messaging service can be regarded as absolutely secure.

14. User rights

14.1. Under the law, every person has the right to:

14.1.1. know who controls the database, for which purposes the information is used and to whom it is disclosed;

14.1.2. access the information concerning them;

14.1.3. request the correction or deletion of information that is incorrect, incomplete, unclear or out of date;

14.1.4. request removal from a database used for direct marketing;

14.1.5. withdraw consent given, without affecting the lawfulness of earlier processing;

14.1.6. as a Patient, receive information from their medical record, including a copy, under the Patient's Rights Law;

14.1.7. lodge a complaint with the Israeli Privacy Protection Authority.

14.2. These rights are subject to retention duties imposed by law, including the duty to keep medical records.

15. Exercising rights

15.1. Requests must be submitted in writing to privacy@drsalvadorkaplan.com or by post to the clinic's address, stating the request and the details needed to locate the information and verify the requester's identity.

15.2. Requests will be answered within 30 days, or within the period set by law, after the requester's identity has been verified.

15.3. The request and the response are kept for as long as needed to show how it was handled and are not used for any other purpose.

16. Service messages and direct marketing

16.1. The clinic sends service messages only, such as appointment confirmations, reminders, rescheduling and pre- and post-treatment instructions, by WhatsApp, email or telephone. These messages are not advertising.

16.2. Advertising will be sent only with express, separate and documented consent, in accordance with section 30A of the Communications (Telecommunications and Broadcasting) Law, 5742-1982. Every such message will include a simple way to opt out.

16.3. Leaving details in the form does not constitute consent to receive advertising.

17. Social media and photographs

17.1. Activity on the clinic's social media profiles is governed by the terms and privacy policies of those platforms.

17.2. No information enabling a Patient to be identified will be published, nor any photographs, "before and after" photographs or clinical details, without the Patient's prior, specific and separate written consent. That consent may be withdrawn at any time for future publications.

18. Minors

18.1. The Site is not directed at persons under 18, and the Company does not knowingly collect information from minors through the Site.

18.2. Any enquiry concerning a minor must be made by a parent or legal guardian; treatment of a minor, if provided, will be provided only with their consent and in accordance with the law.

19. Security incidents

19.1. In the event of a security incident that may affect personal information, its scope will be assessed, containment and corrective measures will be taken, and the Privacy Protection Authority and affected individuals will be notified where the law so requires.

20. Links to external websites

20.1. The Site may link to third-party pages. The Company has no control over their content or data handling, and this Policy does not apply to them.

21. Amendments

21.1. The Policy will be updated when the operation of the Site, the providers or the applicable law change.

21.2. The version in force is the one published on this page, together with its last-updated date. A material change to the measurement tools will require consent to be requested again.

22. Governing law and contact

22.1. This Policy is governed by the laws of the State of Israel.

22.2. Enquiries about this Policy: Dr. Salvador Kaplan Clinics Ltd., HaNofar Street 2, Beit Mansur 1, 3rd Floor, Clinic 304, Ra'anana, Israel; email: privacy@drsalvadorkaplan.com.