Data Processing Agreement

In this Agreement:

• Personal Data: any information relating to an identified or identifiable natural person,
• Special Category Data: the personal data listed in Article 6(1) of the KVKK and Article 9 of the GDPR, health data first among them,
• Processing: any operation performed on personal data, including collection, recording, storage, alteration, transfer, export and deletion,
• Controller: the natural or legal person that determines the purposes and means of Processing; in this Agreement, the Clinic in respect of Clinic Data,
• Processor: the person that processes personal data on the Controller’s behalf under the authority it has given; in this Agreement, Clinigim in respect of Clinic Data,
• Sub-processor: a third party engaged by Clinigim for the Processing under this Agreement that can access the personal data,
• Data Subject: the natural person whose personal data is processed (in particular Patients; the parents, legal guardians, relatives and emergency contacts recorded in a Patient record; people who use the booking page; the Clinic’s owner, clinicians and other staff),
• Data Breach: a breach of security occurring in systems within the responsibility of Clinigim or its Sub-processors that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or unauthorised access to, Clinic Data; failed access attempts, scans and similar events without consequence that do not affect the security of Clinic Data are not Data Breaches,
• Board: the Turkish Personal Data Protection Board; Authority: the Turkish Personal Data Protection Authority; Supervisory Authority: the data protection authority the Clinic is subject to,
• Transfer Regulation: the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad published in the Official Gazette of 10 July 2024, No. 32598,
• Data Protection Law: the Personal Data Protection Law No. 6698 (“KVKK”), the regulations, communiqués and Board decisions issued under it; for the Clinic as a health service provider, additionally the Turkish Regulation on Personal Health Data; where the Clinic is established in the European Economic Area, Regulation (EU) 2016/679 (“GDPR”); where it is established in the United Kingdom, the UK GDPR and the Data Protection Act 2018,
• Annexes: Annex 1 (Processing details), Annex 2 (Technical and organisational measures), Annex 3 (Sub-processors) and Annex 4 (GDPR Annex for EEA and UK Clinics), which form an inseparable part of this Agreement.

3.1. The Clinic is the Controller of Clinic Data; the Clinic decides which data is processed, for what purpose, on which legal basis and for how long. The deletion schedule in section 12 is the application of those decisions as documented in this Agreement. Determining and monitoring the retention periods arising from health legislation and other law, and exporting the data under section 12 before those periods end, are the Clinic’s responsibility.

3.2. Clinigim is the Processor; it processes Clinic Data only on the Clinic’s documented instructions and to deliver the Service. Clinigim does not use Clinic Data for its own purposes, does not sell it, rent it or process it for advertising or profiling, and does not anonymise Patient Data. Securing the Service and Clinic Data, preventing abuse, meeting the legal obligations Clinigim is subject to, and processing, as a controller in its own right (section 1.2), the clinic-level usage counts described in section 8.4 of the Terms of Service that contain no Patient Data (such as the number of records, appointments and transactions and whether a feature is used) for support, billing and the development of the Service do not breach this paragraph.

3.3. Meeting the legal condition for processing and transferring abroad the Special Category Data within Clinic Data (Article 6(3) KVKK; Article 9 GDPR where the GDPR applies to the Clinic), taking the measures that fall to the Clinic among the adequate measures determined by the Board under Article 6(4) KVKK, informing Data Subjects under Article 10 KVKK, including that their data may be transferred to recipient groups outside Türkiye in the course of delivering the Service (section 11 and the Sub-processors page), and proving all of this, are the Clinic’s responsibility.

3.4. As Controller, the Clinic is also responsible for the following, which are not obligations Clinigim must perform: (a) collecting Clinic Data in accordance with the principles of Article 4 KVKK and ensuring, for every processing operation, that a processing condition under Article 5 or Article 6(3) KVKK (Articles 6 and 9 GDPR where the GDPR applies to the Clinic) exists; where explicit consent is relied on, ensuring that it relates to a specific matter, is informed and freely given, keeping proof of it and honouring its withdrawal; (b) keeping Clinic Data accurate and, where necessary, up to date, and ensuring that the instructions it gives Clinigim comply with Data Protection Law (Clinigim is not obliged to verify the lawfulness of instructions; section 4.2 remains unaffected); (c) informing and, where required, obtaining consent through the legal representative for Patients who are minors or lack capacity; (d) assessing in the light of the Board’s decisions whether it must register in the Data Controllers’ Registry, registering and keeping the registration current where it must, and establishing the documents and processes Data Protection Law requires of a controller, including a personal data retention and destruction policy; (e) answering Data Subject requests within the statutory period and making the notifications owed to the Board, the Supervisory Authority and Data Subjects; (f) managing Accounts, Users and permissions in line with section 5 of the Terms of Service and section 6.3 of this Agreement; (g) enabling message and notification channels only for Patients who have agreed to be informed through them and keeping a record of that agreement (section 9 of the Terms of Service); (h) meeting the record-keeping, archiving, retention and Ministry reporting duties arising from health legislation (section 3.5).

3.5. The Service is a software service the Clinic uses in its own practice. The Service is not registered in the Turkish Ministry of Health’s Registration System (Kayıt Tescil Sistemi, KTS) and is not offered as a Ministry-approved health information management system; the record-keeping, archiving, central health data system transmission and similar duties health legislation places on health service providers remain with the Clinic. Clinigim does not perform those duties on the Clinic’s behalf, and storage and backups within the Service do not replace the Clinic’s statutory archiving duty. Assessing whether the Service may be used under the health legislation the Clinic is subject to is the Clinic’s responsibility.

4.1. The Clinic’s documented instructions consist of this Agreement, the Terms of Service, the in-app settings of the Service and any additional instructions the Clinic gives in writing. Additional instructions must be reasonable, consistent with the nature of the Service and compliant with Data Protection Law; their execution is limited to what the Service technically supports. Where carrying out an instruction, or giving assistance under sections 8 and 10, requires effort beyond the ordinary functions of the Service, Clinigim may notify the Clinic of a reasonable and proportionate fee before doing so; no fee is charged for Clinigim’s own obligations under Data Protection Law or for work caused by Clinigim’s own breach.

4.2. If Clinigim considers an instruction to infringe Data Protection Law, it informs the Clinic without delay and may suspend the processing concerned until the instruction is clarified.

4.3. Clinigim does not disclose personal data to third parties unless the Clinic’s instruction, the law Clinigim itself is subject to, a court order or a binding request of a competent authority requires it. Transfers to the Sub-processors under Annex 3 are not disclosures to third parties within the meaning of this section. For Clinics established in the European Economic Area or the United Kingdom, Annex 4 applies.

4.4. When Clinigim receives a public authority request concerning Clinic Data, it notifies the Clinic without delay unless the law prohibits this and, as far as possible, refers the authority directly to the Clinic. Where disclosure is legally compulsory, Clinigim discloses only the data that is required, to the extent required; it informs the Clinic before the disclosure where the law does not prohibit it and this is practically possible, and otherwise afterwards. Clinigim may challenge a request it considers unlawful, but is not obliged to.

5.1. Clinigim binds the staff and contractors who access personal data by a written confidentiality obligation; under Article 12(4) KVKK that obligation continues indefinitely after their engagement ends.

5.2. Access is limited to the smallest number of people and the least privilege the work requires; permissions are reviewed regularly and removed immediately on a change of role or at the end of an engagement. In the ordinary course Clinigim’s administration interface shows only clinic-level aggregate counts; Patient Data is reached through it only for the purposes in section 5.3 (restoring a deleted record at the Clinic’s request, reviewing a message-policy violation, taking an encrypted safety copy before a permanent deletion) and only with authorised administrator accounts protected by two-step verification. Access to the production infrastructure is made only for operations, support and security, is limited to authorised persons, and server access is logged.

5.3. Clinigim personnel access Patient Data only (a) to resolve the Clinic’s support request or bug report, (b) to secure the Service and its continuity or to investigate a security incident, or (c) to the extent the law or a competent authority’s request requires. By submitting a support request the Clinic authorises that access for the support operation concerned. The Clinic refrains from adding Patient Data to support correspondence; data it does add is processed under the support mailbox category in Annex 3.

6.1. Clinigim implements and maintains the technical and organisational measures required by Article 12 of the KVKK and Article 32 of the GDPR to ensure a level of security appropriate to the risk, to prevent unlawful processing of and access to personal data and to safeguard it. The minimum measures are listed in Annex 2; the current description is on the Security page.

6.2. Clinigim updates the measures as technology and risks evolve and makes no change that materially lowers the overall level of protection.

6.3. The Clinic is obliged to keep Account details, passwords, two-step verification methods and recovery codes confidential, to give its Users only the roles and permissions their duties require, to remove the access of departing staff immediately, to secure the devices and networks it uses to reach the Service, to use the security settings the Service offers (including requiring two-step verification for staff) in line with its own risk assessment, and to notify Clinigim without delay when it becomes aware of suspicious access. Unauthorised access that occurs through the Clinic’s Account or Users does not give rise to Clinigim’s liability unless it results from Clinigim’s breach of one of the measures in this Agreement. This section governs the internal relationship between the Parties; the rights and powers of Data Subjects and of the Board under Data Protection Law remain unaffected.

7.1. The Clinic gives Clinigim general authorisation to engage Sub-processors in the categories listed in Annex 3 to deliver the Service. The current list of Sub-processors (provider, country, purpose and transfer safeguard) is published on the Sub-processors page. That list and the transfers abroad described in section 11 are the Clinic’s documented instruction and authorisation within the meaning of the Transfer Regulation.

7.2. Clinigim informs the Clinic by e-mail at least 30 days before engaging a new Sub-processor or replacing an existing one; the notice states the Sub-processor’s name, country, purpose of processing, the data categories it will process and the transfer safeguard. Within that period the Clinic may object in writing on reasonable data protection grounds, stating its reasons; a change not objected to in time is deemed accepted. In the event of an objection the Parties seek a solution within 30 days, during which, to the extent this can technically be separated per Clinic, the objecting Clinic’s Clinic Data is not transferred to the new Sub-processor. If no solution is found, or the change cannot be separated per Clinic, the Clinic may switch off the feature affected by the change or end its membership without penalty. On termination, the part of the fee paid that relates to the period after the termination date is calculated pro rata by day and refunded to the payment method used; no partial refund is made where only a feature is switched off. Where a Sub-processor ends its service unexpectedly or must be replaced immediately for security or legal reasons, Clinigim gives notice without delay after the change, and the Clinic may still exercise its rights to object and to terminate. This exception does not apply to Clinics established in the European Economic Area or the United Kingdom. The transfer of Clinic Data to a new Sub-processor outside Türkiye is conditional on the safeguard in section 11.3 being completed.

7.3. Clinigim concludes with every Sub-processor a written contract containing data protection obligations substantially equivalent to those in this Agreement, or ensures that such a contract is formed through the provider’s standard data processing terms, and for Sub-processors outside Türkiye is additionally obliged to provide the safeguard in section 11.3. Subject to the limits in section 13, Clinigim is liable to the Clinic for the Sub-processor’s failure to meet those obligations as for its own acts. On the Clinic’s request Clinigim provides a copy of the data protection provisions of the Sub-processor contract (trade secrets removed).

8.1. The viewing, correction, export and deletion functions of the Service enable the Clinic to answer Data Subject requests. The Clinic decides on verifying the requester’s identity and on accepting or refusing a request with reasons (including deletion requests concerning records that must be kept by law); Clinigim does not make that assessment.

8.2. If a Data Subject applies directly to Clinigim, Clinigim forwards the request to the Clinic’s e-mail address recorded in the Account within five business days of receiving it and, at the Clinic’s request, gives reasonable assistance so the Clinic can answer within the statutory period. The statutory period is, under Article 13 KVKK, as soon as possible and at most 30 days depending on the nature of the request; under Article 12(3) GDPR it is one month, extendable by up to two further months where the complexity or number of requests requires. Clinigim does not answer the substance of a request without the Clinic’s instruction; it may tell the requester only that the request has been forwarded to the Clinic.

8.3. Clinigim gives the Clinic reasonable assistance, with the information available to it and taking the nature of the processing into account, in the Clinic’s data protection impact assessments and prior consultations with the Supervisory Authority under Articles 35–36 GDPR and in its risk assessments under Article 12 KVKK; this assistance does not include preparing an assessment on the Clinic’s behalf.

8.4. Where a correction or deletion instruction the Clinic gives following a Data Subject request also concerns data held by Sub-processors, Clinigim passes the instruction to the Sub-processor concerned or effects the deletion through its own systems. Records that cannot technically be deleted in the Sub-processor’s own systems or that the Sub-processor keeps as the law requires remain unaffected. Deleting a record in the application removes the live record; the copy of the record in the change history is kept for as long as the Account exists, closed to the Clinic’s users, solely for security, audit and undoing an accidental deletion, and is deleted under section 12 when the Clinic is deleted; deleted patient files are kept recoverable for the same purpose for 30 days and count toward storage during that time.

9.1. Clinigim informs the Clinic without undue delay and in any event within 48 hours from the moment it has reasonably certain knowledge that a Data Breach affecting Clinic Data has occurred. The initial investigation needed to determine whether an event is a Data Breach is carried out without delay; a notification a Sub-processor makes to Clinigim determines the moment Clinigim becomes aware. The notification is not an admission of fault or liability by Clinigim.

9.2. The notification describes the nature of the breach, the categories of data and the approximate number of Data Subjects affected, the likely consequences, the measures taken and recommended, and a contact person. Where the information cannot be given all at once, it is given in phases.

9.3. Notifying the Board, the Supervisory Authority and Data Subjects is the Clinic’s duty as Controller; Clinigim provides the information, documents and assistance needed and documents the Data Breach concerning Clinic Data, its effects and the measures taken. Clinigim makes, in its own name, the notifications it owes for the data of which it is the controller; for Clinic Data, save where the law compels it, it does not notify the Board or a Supervisory Authority of a breach without the Clinic’s instruction.

9.4. Notwithstanding section 23.1 of the Terms of Service, the notification is sent to the clinic e-mail address recorded in the Account and to the clinic owner’s e-mail address and is deemed made when sent; keeping those addresses current is the Clinic’s responsibility.

10.1. Clinigim makes available to the Clinic the information needed to demonstrate compliance with this Agreement: the Security page, Annex 2 and written explanations provided on request. Clinigim keeps a record of the processing activities it carries out on the Clinic’s behalf (Article 30(2) GDPR).

10.2. The Clinic, or an independent auditor it mandates that is not a competitor of Clinigim, may audit on at least 30 days’ Written Notice, once per calendar year, during business hours, under a confidentiality obligation, in a way that does not affect the Service, other Clinics’ data or Clinigim’s security, and limited to the processing activities under this Agreement; the scope, method (document review, remote or on site) and duration of the audit are agreed in good faith in advance. This limit does not apply after a Data Breach, at the request of a Supervisory Authority or where there are concrete indications of a breach of this Agreement. The auditor’s fee and the reasonable, documented costs of the working time Clinigim sets aside for the audit are borne by the Clinic; if the audit finds a material breach by Clinigim, the Clinic does not bear those costs.

10.3. Clinigim cooperates with the Clinic and the authority concerned in investigations and information requests of the Board or a Supervisory Authority concerning Clinic Data; at the Clinic’s request it provides the information and documents it holds within a reasonable time, having regard to the Clinic’s statutory response periods. A decision of the Board or a competent authority to stop a processing operation or a transfer abroad is a decision of a competent authority within the meaning of section 20 of the Terms of Service; Clinigim stops the processing concerned to the extent the decision requires, and that stop is not a breach of contract.

11.1. The application server and the database are hosted in a data centre in Türkiye. Patient files, logos and photos are kept in a separate, private storage area in data centres within the European Union; the Sub-processor providing that area is a US-based company (see the Sub-processors page). The second copy of the encrypted database backups is kept, encrypted so that it can be opened only with Clinigim’s key, in the same Sub-processor’s storage service. Transactional e-mails are sent through a Sub-processor established in the European Union. For Clinics established in Türkiye, keeping the data in that storage area and the backup copy in a data centre outside Türkiye, and sending e-mails through that Sub-processor, is, even within the European Union, a transfer abroad within the meaning of Article 9 of the KVKK and is subject to section 11.3.

11.2. For the message and notification channels the Clinic switches on (WhatsApp reminders, mobile push notifications), Sub-processors established outside Türkiye and the European Union, in particular in the United States, are used. Those transfers happen only when the Clinic enables the feature and only within the scope described in Annex 3 and on the Sub-processors page; by enabling the feature the Clinic gives the transfer instruction. The message and notification templates are set by Clinigim and contain no field for diagnosis, treatment details or clinical notes: WhatsApp templates carry the Patient’s name, the appointment time and the Clinic’s name; mobile push notifications carry summary information such as appointment or payment details and the identifier numbers used to open the record in the application, and ordinarily contain no Patient name. Because a Patient’s name together with appointment details shows that the Patient receives health services from the Clinic, it may qualify as Special Category Data; enabling these channels is the Clinic’s responsibility under sections 3.3 and 3.4, and the Clinic is responsible for the content it enters into template fields. The domain and network protection provider is also US-based; it sees only the site’s static files and request metadata, requests to the application server do not pass through its network, and patient files are delivered only through the object storage service in section 11.1. When a User of the Clinic connects Google Calendar with their own account, the date and time of appointments, the Clinic’s name and a link to the application are written to the User’s calendar; if the “Show patient name in calendar” option, which is off by default, is enabled, the Patient’s name is written as well. The organisation providing that service is not a Sub-processor and processes the data under its own terms. Because establishing the connection may result in a transfer abroad, informing Data Subjects, meeting the processing condition and, where required, providing the safeguard under Article 9 of the KVKK are the responsibility of the Clinic that establishes it; the same applies to other third-party services the Clinic connects, such as accounting.

11.3. For Clinics established in Türkiye, sending Clinic Data to a Sub-processor established outside Türkiye, or hosting it on infrastructure outside Türkiye, is a transfer abroad within the meaning of Article 9 of the KVKK. Clinigim makes those transfers on the Clinic’s instruction under sections 7.1 and 11, provided that the Clinic has met one of the processing conditions in Articles 5 and 6 of the KVKK, and only once one of the following routes is in place: (a) an adequacy decision of the Board for the country, sector or international organisation concerned, published in the Official Gazette (as at 20 October 2026 no such decision exists; if one is issued, this route applies for the country concerned); (b) where there is no adequacy decision, provided that the Data Subject can exercise their rights and has access to effective legal remedies in the destination country, the standard contract published by the Board (processor to processor; the relevant module where the Sub-processor acts as a controller) signed without modification between Clinigim and the Sub-processor and notified to the Authority within five business days of the completion of signatures. Onward transfers of data transferred abroad are made under the same safeguards in accordance with Article 9(8) of the KVKK. The route applied for each Sub-processor and the completion status of the safeguard are stated on the Sub-processors page. Under Article 9(10) of the KVKK, the provisions of other legislation on transfers abroad remain reserved.

11.4. For Clinics established in the European Economic Area or the United Kingdom, the transfer of Clinic Data to Türkiye, remote access to Clinic Data from Türkiye and Clinigim’s onward transfers to Sub-processors are governed by Annex 4. Clinics established in Switzerland are not covered by Annex 4; unless a separate written annex adapted to Swiss law is agreed, this Agreement provides no appropriate safeguard for transfers from Switzerland.

11.5. The data flow between the Clinic and Clinigim takes place within Türkiye; the Clinic is not a party to the standard contract in section 11.3 and signs or notifies nothing itself. For its transfers to Sub-processors outside Türkiye, Clinigim signs the standard contract as data exporter; the notification to the Authority, which under Article 9(5) of the KVKK may be made by the controller or the processor, is made by Clinigim by agreement between the Parties and under Article 7(3) of the Transfer Regulation without needing a separate instruction from the Clinic; changes to the parties, content or termination of the contract are notified in the same way. This arrangement does not remove the Clinic’s obligations as Controller under the KVKK.

11.6. As Patient Data is Special Category Data, the adequate measures determined by the Board under Article 6(4) KVKK apply to its transfer abroad; meeting the processing condition on which the transfer relies is the Clinic’s responsibility. The measures listed in Annex 2 form the basis of the measures the standard contract provides for Special Category Data. The provisions of sectoral legislation on the storage of health data remain reserved; where the health legislation the Clinic is subject to requires health data to be stored domestically, assessing that requirement and using the Service in line with it is the Clinic’s responsibility.

11.7. If Clinigim finds that the safeguard in section 11.3 cannot be provided for a Sub-processor or has become invalid, or if the Board or a competent authority stops a transfer, Clinigim stops the transfer concerned, replaces the Sub-processor or temporarily suspends the feature concerned, and informs the Clinic without delay. A suspension caused by a change in the law or a decision of a competent authority is not defective performance of the Service; if the suspension exceeds thirty days, the Clinic may end its membership for the feature affected without penalty, and the fee for the unused paid period is refunded on the terms of section 7.2.

12.1. While its Account is active and while it is in Limited Mode, the Clinic can export its data from within the application at any time through the clinic owner’s account: the patient list (including notes and consent details), appointments, transactions and payment records, expenses, services, debtors, end-of-day reports and the audit log as structured files, and patient files one by one in their original form. A copy of Clinic Data not contained in those data sets (for example treatment plans and health questionnaire answers) is provided on the Clinic’s written request within a reasonable time and in a commonly used format. The Service does not replace the Clinic’s archiving and retention duties under health legislation; exporting and keeping those records in time is the Clinic’s responsibility.

12.2. When the paid subscription ends, the Account stays in Limited Mode for 90 days from the subscription end date (if someone signs in during that time, the period restarts from the last sign-in under section 12.4); the Clinic can export its data during that time. At the end of that period Clinic Data is permanently deleted under the schedule in section 12.4, in execution of the deletion instruction the Clinic gives by this section; Clinigim is not liable for the Clinic not having exported its data. The Clinic can instruct deletion earlier, through its authorised User, by deleting the clinic in the application.

12.3. Clinigim may keep data whose retention the law it is subject to or a decision of a competent authority makes compulsory, for the period that obligation requires, only for that purpose and with restricted access; it deletes it when the period ends and, on request, tells the Clinic which data is kept and on what basis. Data in backups is not processed unless a backup is restored and is closed to Users; if a backup is restored, data that should already have been deleted is deleted again without delay after the restore. Where Clinigim permanently deletes a clinic at the request of a competent authority or because of abuse, the encrypted safety copy taken before the deletion is outside the backup retention period; it can be opened only with Clinigim’s key and is used only for restoration or a competent authority’s request.

12.4. For inactive accounts, the following schedule is the automatic execution of the Clinic’s deletion instruction in this section in respect of Clinic Data. The invoice, payment and consent records of which Clinigim is the controller in its own right are not Clinic Data and are kept only for the statutory periods stated below:

• If the free trial ends without any payment and nobody signs in again: 90 days after the trial ended.
• If an Account that has never paid has signed in at least once after the trial ended (free use in Limited Mode): once 13 months have passed since the last sign-in; exporting the records the Clinic must keep by law before that date is the Clinic’s responsibility.
• When a paid subscription period ends (on cancellation, at the end of the paid period): 90 days after the end of the period or the last sign-in after it, whichever is later; during that time the Account keeps working in Limited Mode and the data can be exported.
• Accounts with an active, paid-up subscription are never deleted for inactivity.
• A notice is sent to the clinic e-mail address recorded in the Account about 30 days and 7 days before every deletion; keeping that address current is the Clinic’s responsibility, and a notice that is not delivered or not read does not postpone the deletion. Signing in during that time restarts the deletion schedule from the last sign-in.
• When a clinic is deleted, its live data, logo and photos are deleted as soon as the deletion instruction is processed. Change history, the audit log and patient files are kept for 30 days solely for restoring an accidental deletion, closed to the Clinic’s users, then permanently deleted.
• Permanently deleted data is also removed from backups within at most 14 days after the deletion.
• Clinigim’s own invoices and subscription payment records are kept for at least 5 years from the start of the year following the year they relate to under the Turkish Tax Procedure Law, and for 10 years from the end of the calendar year concerned under Article 82 of the Turkish Commercial Code, and are deleted at the end of that period; they contain no patient data.
• Commercial-message consent records are kept for 3 years from the date the consent ended, and opt-out and other message records for 3 years from the date they were recorded, then deleted.
• Which patient records the Clinic must keep by law, and for how long, is determined by the health legislation the Clinic is subject to; exporting those records in time and archiving them in the medium the law requires is the Clinic’s duty as data controller. Clinigim does not provide a statutory archiving service.
• On the Clinic’s written request, Clinigim confirms in writing within a reasonable time that deletion has been completed, stating its date and scope; a record of the deletion is kept without personal data.

13.1. Each Party is liable, in proportion to its fault, for damage caused by breaching its own obligations under Data Protection Law and this Agreement. Subject to the limits in sections 13.2 and 13.3, Clinigim is liable to the Clinic for its Sub-processors’ breaches of this Agreement as for its own acts.

13.2. To the extent the law allows, Clinigim’s total liability under this Agreement, including for claims arising from more than one event, is limited to twice the fees (net of refunds) the Clinic paid to Clinigim in the 12 months before the first event giving rise to liability. If the Clinic paid Clinigim no fees in that period (including free use and the trial), the limit is the lowest yearly Plan price published on the Plans page on the date of the event giving rise to liability. This limit and the limit in section 18.1 of the Terms of Service are not added together; Clinigim’s total liability arising from the same event cannot exceed the higher of the two limits.

13.3. The limit in section 13.2 does not apply to damage caused by the intent or gross negligence of Clinigim or its organs, to liability the law does not allow to be limited, or to liability under Clause 12 of the Standard Contractual Clauses in Annex 4. Liability arising from the fault of Clinigim’s auxiliary persons and Sub-processors is subject to the limit. The limit applies only between the Parties; the rights of Data Subjects and Supervisory Authorities under Data Protection Law are not affected by it.

13.4. Clinigim is not liable for damage arising from acting on the Clinic’s documented instructions or from the Clinic’s failure to meet its obligations under sections 3 and 6.3. Where joint liability towards a Data Subject, the Authority or a third party arises, liability between the Parties is apportioned according to fault; a Party that pays more than its share may seek recourse against the other. Each Party gives the other Written Notice without delay of any claim, investigation or proceeding concerning it, gives notice of the proceedings where required and cooperates reasonably in the defence. Recourse claims under this section are subject to the limit in section 13.2.

13.5. An administrative fine imposed on a Party under Data Protection Law is, as a rule, borne by that Party. A Party may claim the loss it suffers from an administrative fine imposed on it, to the extent the law allows, only for the part it proves was caused by the other Party’s culpable breach of this Agreement and within the limit in section 13.2; intent and gross negligence remain reserved.

13.6. Claims arising from this Agreement and from the use of the Service are directed only at Clinigim. The Clinic does not bring claims under this Agreement personally against Clinigim’s shareholders, directors, employees or contractors for acts in the performance of their duties, except in cases of their intent or gross negligence; this provision is for the benefit of those persons and may be invoked by them. This section does not affect criminal liability, the rights of Data Subjects or mandatory law.

14.1. This Agreement is concluded when the Clinic confirms this text electronically through the Account during registration or, for an existing Clinic, on re-acceptance; no handwritten signature is required. The person giving the confirmation declares that they are authorised to conclude this Agreement on behalf of the Clinic and of the branches, clinicians and staff covered by the Account. The date and time of the confirmation, the confirming User, the version of the confirmed text and (where the client reports it) its digest are recorded by Clinigim, serve as evidence under section 25.4 of the Terms of Service and are provided to the Clinic on request. Contracts for which the law separately requires a signature (for example the Board’s standard contract) are outside this section.

14.2. This Agreement remains in force for as long as Clinigim processes personal data on the Clinic’s behalf. The ending of the Terms of Service ends this Agreement; however, sections 3 to 13, section 16 and the Annexes continue to apply until Clinic Data has been completely deleted from Clinigim’s systems (including the recovery period and backups) under section 12.

14.3. This Agreement applies at every stage of the Account, including the Free Trial and Limited Mode. If the Clinic chooses to enter real Patient Data into the Service, its obligations under section 3 apply in full during the trial as well.

14.4. If Clinigim reasonably finds that the Clinic is in breach of its obligations under section 3 or 6.3 or of Annex A of the Terms of Service, it may suspend the feature concerned or the Account under section 14 of the Terms of Service; during the suspension Clinic Data is preserved and remains subject to the schedule in section 12.

15.1. Clinigim announces material changes to this Agreement by e-mail and in-app notice at least 30 days before they take effect and asks the clinic owner to confirm the new text electronically. If the Clinic does not confirm the new text, it may end its membership without penalty until the effective date, and a refund is made on the terms of section 7.2. If the new text is not confirmed within 30 days after the effective date, the subscription, payment, clinic and team management operations of the clinic owner’s account are restricted until it is confirmed; patient and appointment operations, viewing and exporting data, cancelling the subscription and deleting the clinic are not affected by that restriction.

15.2. Adaptations required by a mandatory provision of law or a decision of the Board or a Supervisory Authority apply only to the extent that requirement demands and from its effective date; Clinigim notifies the Clinic of the adaptation and its reasons without delay, and the adaptation does not increase the Clinic’s obligations beyond the requirement. Changes in the Clinic’s favour take effect on publication; Sub-processor updates in Annex 3 follow the procedure in section 7.

16.1. The governing law and jurisdiction provisions of section 24 of the Terms of Service apply to this Agreement. The mandatory rules of the Data Protection Law the Clinic is subject to remain unaffected. For Clinics established in the European Economic Area, the Standard Contractual Clauses in Annex 4 are subject to the law and courts stated in Annex 4; for Clinics established in the United Kingdom, they are subject to the law and courts of England and Wales under the UK Addendum.

16.2. If the Terms of Service and this Agreement conflict on a matter of personal data processing, this Agreement prevails. For Clinics established in the European Economic Area, the Standard Contractual Clauses prevail over the other provisions of this Agreement and of the Terms of Service. For Clinics established in the United Kingdom, the mandatory clauses of the UK Addendum prevail over the Standard Contractual Clauses, and both prevail over the other provisions of this Agreement; a provision of the Standard Contractual Clauses that gives the Data Subject more protection remains unaffected.

16.3. If the body of this Agreement and its Annexes conflict, the body prevails, subject to the rule in section 16.2; if Annex 3 and the Sub-processors page conflict, the current list on the page prevails. The invalidity of one provision does not affect the others; an invalid provision is deemed replaced by the valid provision closest to its purpose.

The subject matter, duration, nature, purpose and scope of the processing under this Agreement are as follows:

• Subject matter: provision of clinic management software as a service.
• Duration: for as long as the Clinic’s Account exists and until the deletion schedule in section 12 has completed.
• Nature: recording, storage, organisation, display, retrieval, transmission (only messages, notifications and exports initiated by the Clinic), backup, deletion.
• Purpose: patient records and files, appointments and online booking, treatment and payment records, cash desk and reports, reminder messages, team and permission management, mobile access.
• Categories of Data Subjects: the Clinic’s Patients (minors may be included); the parents, legal guardians, relatives and emergency contacts recorded in a Patient record; people who use the booking page; the Clinic’s owner, clinicians and other staff.
• Categories of Patient Data: identity and contact details; health information such as appointments, treatments, clinical notes, treatment plans and dental charts; health questionnaire answers; payment, debt and instalment records; documents and images uploaded for the Patient; consent and communication preference records; message delivery records.
• Categories of Clinic staff data (the team records the Clinic keeps in the Service): name, user name, e-mail, phone, title and photo, roles and permissions, appointment and transaction assignments. For the Users’ account, sign-in and security records Clinigim is the controller under section 1.2.
• Special Category Data: health data relating to Patients (including information on appointments, examinations, diagnoses, treatments and treatment plans). Meeting the processing condition is the Clinic’s responsibility (Article 6(3) KVKK; where the GDPR applies to the Clinic, Article 9(2)(h) and Article 9(3) with the relevant member state law; for the United Kingdom, Article 9(2)(h) UK GDPR and sections 10 and 11 of the Data Protection Act 2018). Of the adequate measures determined by the Board’s decision No. 2018/10 of 31 January 2018 under Article 6(4) KVKK, those listed in Annex 2 are implemented by Clinigim; the other measures of that decision not assigned to Clinigim in this Agreement (staff training, the Clinic’s device and network security, enabling two-step verification for staff, management of access permissions, printouts and data taken outside the Service) are taken by the Clinic under sections 3.3 and 6.3.
• Frequency of the transfer: continuous (for as long as the Service is used). Retention period: Clinic Data for as long as the Account exists and until the deletion schedule in section 12 has completed; recovery copies of a deleted Account 30 days; backups 14 days; the audit log for the period stated in Annex 2; message delivery records 3 years from sending. Additional safeguards for Special Category Data: purpose-limited processing, least privilege and role-limited access, patient file access logging, encrypted storage of free-text clinical notes, transfers to Sub-processors limited to Annex 3.
• Parties: data exporter the Clinic (its name, address and contact person are the registration details in the Account; role: controller); data importer Clinigim (role: processor; data protection contact: [email protected]; its trade name, address and registration details are published in the Company Information section of the About page on clinigim.com, are also given to the Clinic in the invoice details and are provided in writing on request). The Clinic’s electronic confirmation of this Agreement under section 14.1, with the date, time, confirming User and version recorded, stands in for the signature and date in Annex I.A of the Standard Contractual Clauses and in the UK Addendum. Competent Supervisory Authority: the authority responsible for supervising the Clinic’s GDPR compliance at its place of establishment; for the United Kingdom, the Information Commissioner.

Clinigim implements at least the following measures, appropriate to the nature of the Service and the risk of the data processed, and updates them under section 6.2:

• Transport security: connections from Users and Clinic devices to the Service are encrypted with TLS; unencrypted connections are refused. Supported transport encryption is used in communication with Sub-processors.
• Storage security: free-text clinical notes are stored in the database under strong encryption with tamper detection; database backups are encrypted and the decryption key is kept in an environment separate from the backups; patient files are kept in a separate private store and are delivered only through the application to a user whose session, clinic and permission are re-checked on every request; no storage address is handed to the user.
• Access control: deny-by-default, role- and permission-based authorisation; re-checked on every request; tenant isolation enforced on the server; least privilege for administrative access.
• Authentication: strong password rules; two-step verification with an authenticator app and recovery codes (the clinic owner can make two-step verification mandatory for staff); limits on failed sign-in attempts; sign-out from all devices; sessions ended on password change.
• Traceability: change history of create, update and delete operations on the main records and logs of patient file views and downloads are kept; the audit log is kept for 24 months from the date of the entry and the Clinic can view and export it in the application; patient file access logs and the change history of the main records are kept for as long as the Account exists; where the Clinic has been deleted, all of these records are deleted at the end of the 30 days recovery period in section 12. For the longer record-keeping duties the Clinic has under health legislation, exporting and keeping the logs is the Clinic’s responsibility.
• Continuity: an encrypted full backup of the database every night; a copy of the backups is kept in a separate store and both copies are kept for 14 days; restore steps are written down and a restore has been tested. Backups are kept for service continuity and disaster recovery; restoring individual records is not guaranteed, and backups do not replace the Clinic’s statutory archiving duty.
• Secure development: changes are tracked in source control; before release they pass automated build, test and dependency security checks; dependencies are monitored for known vulnerabilities and updated regularly; access to the production environment is limited and logged.
• Incident management: a detection, response and notification process for security incidents; a responsible disclosure programme (Security page).
• Personnel: confidentiality undertaking; separation of duties where possible; access limited to the role, reviewed regularly and removed when the role ends; briefing on personal data protection and information security.
• Sub-processor management: written contracts, choice of safeguard and publication on the Sub-processors page.

Clinigim engages Sub-processors in the following categories. The provider’s name, country, the data it processes and the transfer safeguard for each category are published on the Sub-processors page, which is the current version of this Annex.

• Application server and database hosting — in a data centre in Türkiye.
• Object storage for patient files, clinic logos and staff photos, and the second copy of the encrypted database backups — outside Türkiye, in data centres within the European Union, private; US-based provider.
• Domain, static site hosting and network protection — US-based provider, global network; only the site’s static files and request metadata (requests to the application server do not pass through this network; patient files are delivered only through the object storage service above).
• Transactional e-mail (verification codes, notifications) — outside Türkiye, within the European Union.
• WhatsApp reminder messages — when the Clinic enables them; the messaging infrastructure provider is established in the United States and the company operating the WhatsApp platform outside Türkiye; the message contains the Patient’s name, the appointment time and the Clinic’s name (section 11.2).
• Mobile push notifications — when a User installs the mobile application; the notification infrastructure and device platform providers are established in the United States; the notification carries summary information such as appointment or payment details and the identifier numbers used to open the record in the application, and ordinarily contains no Patient name.
• Support mailbox hosting — Türkiye.

This Annex applies to Clinics established in the European Economic Area or the United Kingdom and incorporates into this Agreement the provisions required by Article 28(3) of the GDPR and of the UK GDPR. Clinics established in Switzerland are outside the scope of this Annex.

• Instructions (Art. 28(3)(a)): Clinigim processes personal data only on the Clinic’s documented instructions, including instructions on transfers to a third country. Clinigim does not process outside those instructions except where Union or member state law (for Clinics established in the United Kingdom, UK law) requires it; where such a requirement arises, it informs the Clinic before processing unless that law prohibits it on important grounds of public interest. For disclosure or access obligations arising from Turkish law, Clauses 14 and 15 of the Standard Contractual Clauses apply; sections 4.3 and 4.4 cannot be read contrary to those Clauses.
• Confidentiality (Art. 28(3)(b)), security (Art. 28(3)(c), Art. 32 and Annex 2), Sub-processor conditions (Art. 28(3)(d), 28(2) and 28(4); general authorisation and the notice procedure in section 7; the emergency-change exception in section 7.2 does not apply under this Annex), assistance with Data Subject rights (Art. 28(3)(e); section 8 and the viewing, correction, export and deletion functions of the Service count as the assistance measures in Annex II of the Standard Contractual Clauses), assistance under Arts. 32–36 including breach notification (Art. 28(3)(f)), deletion or return (Art. 28(3)(g)) and demonstrating compliance and audits (Art. 28(3)(h)) are provided by the corresponding sections of this Agreement.
• Deletion or return: when the Service ends, Clinigim deletes Clinic Data or returns it by export at the Clinic’s choice and deletes existing copies under the schedule in section 12; when deletion is complete it confirms this to the Clinic in writing. The recovery and backup retention periods in section 12 are part of the Clinic’s deletion instruction as documented in this Agreement, and during those periods the data is kept only for secure storage. Where Union or member state law (for Clinics established in the United Kingdom, UK law) requires storage, copies are kept only for that period and purpose.
• Audits: for Clinics under this Annex, audits are conducted under Clause 8.9 of the Standard Contractual Clauses; Clinigim allows and contributes to audits by the Clinic or an independent auditor it mandates at reasonable intervals or where there are indications of non-compliance, where appropriate with reasonable prior notice. The limits in section 10.2 are not applied in that context in a way contrary to the Standard Contractual Clauses; the Parties agree that audit costs will not be disproportionate.
• Transfer mechanism: Clinigim is established in Türkiye; Clinic Data is hosted in a data centre in Türkiye and processed from Türkiye; that is a transfer under Chapter V of the GDPR. The Module Two (controller to processor) text of the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 is incorporated as an inseparable part of this Agreement in the English text of the Decision (http://data.europa.eu/eli/dec_impl/2021/914/oj), without any modification, only with the choices stated in this Annex and with Annexes I to III completed; a Turkish translation is for information only and the English text prevails in a conflict. The Clinic is the data exporter and Clinigim the data importer. Clinigim’s transfers to Sub-processors outside the European Union are carried out under Clauses 8.8 and 9 of the Standard Contractual Clauses through the written contract with the Sub-processor and the appropriate safeguards in that contract.
• Choices in the Standard Contractual Clauses: Clause 7 (docking) does not apply; in Clause 9(a), Option 2 (general written authorisation, notice period 30 days); the optional independent dispute resolution body in Clause 11 does not apply; under Clause 11(a) the contact point for Data Subject complaints is [email protected]; for Clause 13 the competent supervisory authority is the authority responsible for supervising GDPR compliance at the place of establishment the Clinic states in the Account; for Clause 17 the governing law is the law of the Federal Republic of Germany and for Clause 18 the courts of Germany. Annexes 1, 2 and 3 stand in for Annexes I, II and III of the Standard Contractual Clauses; Annex 3 and the current list on the Sub-processors page form the agreed list under Clause 9(a), Option 2.
• United Kingdom: for Clinics established in the United Kingdom, the “International Data Transfer Addendum to the EU Commission Standard Contractual Clauses” issued by the Information Commissioner under section 119A of the Data Protection Act 2018 (the UK Addendum; version B1.0 or the version in force) is added to the Standard Contractual Clauses. Table 1: the Parties and contact persons are as in Annex 1; the start date is the date the Clinic confirms this Agreement. Table 2: Module Two, with the choices above. Table 3: Annexes 1, 2 and 3. Table 4: both importer and exporter. Under the UK Addendum, Clause 13(a) and Annex I.C are not used and the competent authority is the Information Commissioner; the law and courts of England and Wales replace Clauses 17 and 18. The right to end the UK Addendum may be exercised only on the conditions in section 19 of the UK Addendum.
• Supplementary measures: Clinic Data is encrypted in transit with TLS; patient files and encrypted backups are kept in data centres within the European Union. Access to the servers and the database is made only for support, operations and security, limited to authorised persons and logged; free-text clinical notes are stored encrypted. For access or disclosure requests from public authorities, Clause 15 of the Standard Contractual Clauses applies: as far as legally possible, Clinigim notifies the Clinic and, where possible, the Data Subject without delay, reviews the lawfulness of the request, challenges it where there are reasonable grounds and discloses only the minimum information required.
• Data Breach notification is made without undue delay under Clause 8.6(c) of the Standard Contractual Clauses and does not exceed the 48 hours maximum in section 9.1; its content is as in section 9.2. The notification duty under Article 33 GDPR lies with the Clinic as Controller.
• Transfer impact assessment: the Parties document the transfer impact assessment under Clause 14 of the Standard Contractual Clauses. Clinigim prepares its assessment of the law and practice of Türkiye in writing, keeps it current, provides it to the Clinic and, on request, to the competent Supervisory Authority, and notifies the Clinic without delay of any change in law or practice that may affect the assessment. Section 18 of the Terms of Service and section 13 of this Agreement do not limit liability under Clause 12 of the Standard Contractual Clauses or the rights of Data Subjects.
• In a conflict between this Annex and the other provisions of the Agreement, section 16.2 applies.

Earlier versions of this document and what changed in each:

• 6 November 2026 — The application server and the database moved to a data centre in Türkiye; section 11.1, Annex 3 and Annex 4 updated accordingly. Patient files, encrypted backups and transactional e-mail remain outside Türkiye. No obligation changed.
• 23 October 2026 — Correction: Clinigim’s identifying details linked to the Company Information section. The changes to sections 1.4 (binding Turkish text) and 24 (courts of Yüksekova (Hakkari)) of the Terms of Service apply to this Agreement by reference under section 16.1. No obligation changes.
• 20 October 2026 — Comprehensive rewrite: sections on instructions, personnel confidentiality, Data Subject assistance and liability added; the Controller’s obligations (3.4–3.5), public authority requests (4.4), the Clinic’s security responsibilities (6.3), administrative fines and Clinigim personnel (13.5–13.6), electronic conclusion and post-termination provisions (14) written; Sub-processor notice extended to 30 days and the Sub-processors page opened; the international transfer section redrafted in line with Article 9 KVKK as amended by Law No. 7499 and the Transfer Regulation; Annex 1 Processing details, Annex 2 Technical and organisational measures, Annex 3 Sub-processors and Annex 4 GDPR Annex added. Existing Clinics have 30 days to re-accept.
• 4 October 2026 — Scope section (moved to Terms 1.4 in the next version).
• 26 September 2026 — First version.