I run a beauty and skincare center in Kadıköy with two specialist staff members. We handle an average of 130 appointments a month. For the past four months I've been using a foreign-based free appointment system I found online. We log clients' first and last names, phone numbers, the type of session they booked, and sometimes special notes like "sensitive skin allergic to retinol" into this dashboard. The system sends email notifications but SMS isn't included in the free tier.
Over the last two months, the number of no-shows has noticeably increased leaving about 15 sessions completely empty every month. On top of that, storing this customer data on an overseas server and logging health-related details like allergies has started making me nervous regarding KVKK compliance.
Does using a free booking system at this stage pose legal or operational risks to my business? At what volume or revenue level should I switch to a paid, domestic professional setup?