Website Privacy Notice under Personal Data Protection Law No. 6698 (KVKK)

As the Platform, we wish to inform you about Personal Data Protection Law No. 6698 (KVKK), which regulates protection of fundamental rights and freedoms of individuals, especially privacy of private life, in the processing of personal data, as well as the obligations and procedures applicable to natural and legal persons processing personal data, and about the European Union General Data Protection Regulation (GDPR).

Under KVKK No. 6698, all information that identifies or makes you identifiable is processed by the Platform as Data Controller within the scope below as “Personal Data”. “Processing of Personal Data” means every operation performed on data, including collection, recording, storage, preservation, amendment, reorganisation, disclosure, transfer, acquisition, making available, classification or prevention of use. With full awareness of that responsibility and in the capacity of Data Controller, we process, record, transfer, share and retain your personal data as explained below and within the limits required by official legislation.

Due to the fundamental nature of the service offered by our Platform, a significant part of the personal data processed is health data, which is special-category personal data under KVKK Article 6 and GDPR Article 9. Such data is processed subject to the highest level of protection and explicit-consent requirement.

The Platform reserves the right to update this Privacy Notice in line with changes in applicable legislation. You can always access the current version on our website.

Purposes for Which the Platform Collects, Processes and Uses Your Personal Data

Under KVKK No. 6698, your personal data shared with our Platform are processed by us by being collected, recorded, stored, amended and reorganised, wholly or partly automatically or non-automatically provided that they form part of a data-recording system.

The Platform processes personal data within its activities in accordance with applicable legislation for the purposes below.

Accordingly:

Identity Information: (name and surname, date of birth, age, gender, username)

Contact Information: (email address, telephone number, city/region information, IP address, device identifier)

Health Information: (symptom and complaint information, past and current disease information, medicines used and dosage information, allergy information, chronic-condition status, surgery and treatment information)

Customer Transaction Information: (complaint information, request information, appointment records, in-platform message records, support requests)

Financial Information: (payment amount, invoice records — depending on the payment infrastructure, credit/bank-card information is processed by the payment provider)

Transaction Security Information: (password hash, IP-address information, session records, log records, device and browser information)

Cookie and Usage Data: (cookie records, pages visited, content clicked, session duration, in-platform behavioural data)

AI-Derived Data: (algorithmic health-needs profile, suggested speciality areas, AI Engine decision-rationale summary)

Your personal data that you share with our Platform directly or indirectly, such as complaints or requests submitted via the website and records of operations performed in their evaluation and management process, are processed and protected only to the extent of Platform activities in accordance with Personal Data Protection Law No. 6698, the GDPR and applicable legislation.

Personal data belonging to our users are processed under Articles 4, 5 and 6 of KVKK for the following purposes, including delivering services, managing and conducting user relationships, and meeting user requests:

• Enabling our relevant teams to carry out work necessary for you to benefit from the AI-assisted doctor recommendation service offered by the Platform;
• Conducting membership, profile and account-management activities on our website and mobile applications;
• Analysing your symptom, complaint and preference information through the AI engine to generate personalised doctor, specialist and clinic recommendations;
• Conducting automated profiling and personalised-recommendation activities under GDPR Article 22 (with separate explicit consent);
• Conducting appointment-request, doctor-matching and referral activities;
• Evaluating complaints, requests and suggestions regarding our services and responding to support requests;
• Providing recommendations to users and informing users about our services;
• Communicating with users about the terms, current status and updates of our subscription agreements and providing necessary information;
• Carrying out invoicing and payment transactions and fulfilling accounting obligations;
• Sending SMS/email for notification and verification purposes (only within the scope of explicit consent);
• Processing session, usage and preference data under the Cookie Policy and collecting IP address and similar technical information for platform security and personalisation;
• Conducting electronic surveys through the website to measure user satisfaction;
• Updating the AI model and carrying out algorithmic-bias audits (only with anonymised data and separate explicit consent);
• Ensuring the security of the Platform and user accounts; preventing unauthorised access, cyberattacks and data breaches;
• Processing logs and traffic data under Law No. 5651;
• Conducting user account opening, closure and access-authorisation operations;
• Administering the website and mobile application;
• Managing social-media accounts belonging to the Platform;
• Conducting service-sales processes;
• Fulfilling obligations related to agreements;
• Fulfilling legal obligations and responding to information and document requests from courts and authorised public bodies;
• Providing information to authorised public bodies on matters concerning public health when requested and required by law;
• Carrying out electronic-notification operations for users;
• Conducting processes for users of foreign nationality.

Sharing Your Personal Data

Personal data belonging to users and processed by the Platform are not shared with third parties; however, to the extent required by legislation and provision of the service, users’ personal data may be shared in accordance with KVKK’s fundamental principles and within the personal-data processing conditions and purposes set out in KVKK Articles 8 and 9:

›› with authorised public institutions and judicial authorities (the Personal Data Protection Board, Ministry of Health, Information and Communication Technologies Authority, tax offices, etc.) on the legal basis of fulfilling our legal obligations;

›› with related banks, payment-service providers and supplier companies that are business partners on the legal basis of performance of a contract;

›› with subcontractors, third parties from whom we receive or to whom we provide services, cloud-infrastructure providers and technical-service suppliers on the legal basis of legitimate interest;

›› with the doctor or clinic for which you request an appointment, based on your explicit consent (only information related to the relevant appointment is transmitted);

›› with hospitals and healthcare institutions for emergency medical interventions and to fulfil occupational-health and safety obligations;

›› and with official bodies as required by applicable legislation and our legal obligations.

Necessary technical and legal measures are taken to prevent rights violations when sharing data with third parties. For international transfers, safeguards are provided under KVKK Article 9 and GDPR Article 46 through Standard Contractual Clauses (SCCs) and a Data Processing Agreement (DPA).

Retention Periods for Your Personal Data

In accordance with KVKK, we will retain your personal data for the duration of service provision and subsequently for the periods below in accordance with applicable legislation, in order to fulfil obligations arising from the nature of our services and our legal obligations:

• Health data (symptoms, disease information, medication, allergies, etc.): 20 (twenty) years under Article 16 of the Patient Rights Regulation;
• Identity and account information: 10 (ten) years from account deletion under Article 82 of the Turkish Commercial Code;
• Session, access and security log records: 2 (two) years under Law No. 5651;
• Payment and invoice records: 10 (ten) years under the Tax Procedure Law and Turkish Commercial Code;
• Explicit-consent records: 3 (three) years from the date consent was given;
• AI decision and recommendation logs: 90 (ninety) days (EU AI Act Article 12);
• Cookie and usage data: at the end of the session or up to 2 (two) years depending on cookie type;
• Commercial electronic-message consent records: 3 (three) years from the date consent is withdrawn.

In addition, in the event of a potential dispute, your personal data may be retained on a limited basis and for limitation periods set by applicable law in order to make the necessary defence within that dispute.

Cases Where Explicit Consent Is Not Required for Processing Personal Data under KVKK

Personal data may also be processed without Explicit Consent where at least one of the following circumstances exists.

›› Where expressly provided by law;

›› Where it is mandatory to protect the life or bodily integrity of a person who is unable to express consent due to actual impossibility or whose consent is not legally valid;

›› Where processing personal data belonging to parties to a contract is necessary, provided that it is directly related to the establishment or performance of that contract;

›› Where it is mandatory for our Platform to fulfil its legal obligation;

›› Where the data subject has made the data public;

›› Where processing is mandatory for the establishment, exercise or protection of a right;

›› Where processing is mandatory for the legitimate interests of our Platform, provided that the fundamental rights and freedoms of the data subject are not harmed.

›› In addition, personal data concerning your health and sex life may be processed without Explicit Consent by persons under an obligation of confidentiality or authorised institutions and organisations for the protection of public health, preventive medicine, performance of medical diagnosis, treatment and care services, and planning and management of health services and their financing.

Information on the AI System and Automated Decision-Making

Our Platform includes automated decision-making and profiling under GDPR Article 22 and KVKK Article 11/1-g. The AI engine processes your symptom, complaint and preference information to generate personalised doctor and specialist recommendations. Separate explicit consent is obtained for this processing.

›› The AI Engine generates recommendations solely for information and guidance; it does not provide medical diagnosis, diagnosis, prescriptions or treatment plans.

›› The final decision always belongs to the user; no automated output is binding.

›› You may object to any automated recommendation decision and request human review by applying to [email protected].

›› The AI model is regularly subject to independent ethical audit to reduce risks of algorithmic bias.

Methods and Legal Bases for Collecting Your Personal Data

Our Platform may collect, process and transfer personal data from users, suppliers and personnel through any written, oral and electronic environment, from third parties and legal authorities, with explicit consent in light of the principles set out in KVKK Article 4(2), or without obtaining explicit consent where the situations provided in Articles 5(2) and 6(3) exist.

Legal bases for the purposes of processing personal data include our obligations under legislation to which the Platform is subject — particularly Personal Data Protection Law No. 6698, Turkish Code of Obligations No. 6098, Electronic Commerce Law No. 6563, Law No. 5651 on Regulation of Publications on the Internet and Combating Crimes Committed by Means of Such Publications, Law No. 1219 on the Practice of Medicine and Medical Arts, the Patient Rights Regulation, Tax Procedure Law No. 213, the GDPR and the EU AI Act (Regulation 2024/1689) — including using data in all products and services; recording identity, address and other necessary information to identify the transaction owner; preparing all records and documents forming the basis of the transaction; complying with data-retention, reporting and information obligations required by legislation and official authorities; providing requested products and services; and performing the agreement you have entered into.

Your Rights under the Personal Data Protection Law

By applying to our Platform, you may, in accordance with the Personal Data Protection Law, exercise the following rights concerning your personal data:

›› Learn whether they are processed and, if processed, request information about that processing;

›› Learn the purpose of processing and whether they are used in accordance with that purpose;

›› Know the third parties to whom they are transferred domestically or abroad;

›› Request correction where they have been processed incompletely or inaccurately and request notification of that correction to third parties to whom personal data have been transferred;

›› Request deletion or destruction of personal data, even where processed in accordance with the law, if the reasons requiring processing cease to exist, and request notification of that operation to third parties to whom personal data have been transferred;

›› Object to an outcome adverse to the person arising from analysis exclusively through automated systems (AI recommendation engine, profiling algorithms, website cookies, etc.) and request human review (GDPR Article 22);

›› Request your processed data in a structured, commonly used and machine-readable format (GDPR Article 20 — data portability);

›› Request compensation for damage where data are processed unlawfully.

If requests made for these purposes require an additional cost, you may be required to pay the fee in the tariff determined by the Personal Data Protection Board. Your requests will be finalised as soon as possible and no later than 30 (thirty) days, depending on their nature.

Rights concerning personal data may be exercised only in relation to the data of the individual concerned.

Under Article 13(1) of KVKK, you may submit requests to exercise the rights above in writing or by other methods determined by the Personal Data Protection Board. The channels and procedures through which you may submit written applications to our Platform under KVKK Article 11 are set out below.

Account Research Area, Question Safety and Gallery Consent Records

Doctors, comparisons and private notes that you save to your account are processed only for the account holder and are not published through the public Data API. Text entered in the Q&A area may be classified by a versioned server-side safety rule to separate emergency or post-operative deterioration signals from the normal publication queue; question text is not copied into analytics or application logs.

For before-and-after gallery records, uploader, source type, capture dates, file hashes, editing declaration, explicit-consent version/reference and moderation history are processed. When consent is withdrawn, public visibility is disabled; the retention/deletion decision for the minimum audit trail and visual file is handled separately.

To exercise the rights above, you may submit through our website a request including information necessary to identify you and an explanation of the right under KVKK Article 11 that you wish to exercise.