Privacy Policy

2.1. This Policy covers three groups: people who visit the site (“Visitors”), the clinic owner, clinicians and staff who open or are invited to an account on behalf of a clinic (“Users”), and the people who book through a clinic’s online booking page or whose records a clinic keeps (“Patients”).

2.2. For Visitor and User data the controller is Clinigim. For Patient data the controller is the clinic that collects it and decides the purposes of processing; Clinigim processes that data only on the clinic’s instructions, as a processor. That relationship is governed by the Data Processing Agreement between us and the clinic. Questions and requests about your Patient data should go first to the clinic you receive care from; we assist the clinic.

Depending on the service you use, the following personal data is processed:

• Visitor data: IP address, browser and device information, request time and pages visited (server logs); the name, e-mail and clinic details you enter in contact or trial forms; only if you allow it, which page or link brought you to us (first page, referring address and campaign tags).
• Account data: name, user name, e-mail, phone, title and optional photo; clinic name, specialty, address and country; roles and permissions; sign-in records (time, IP address, device and browser); two-step verification and trusted-device records; open sessions; language and appearance preferences.
• Subscription and billing data: the chosen plan and period, payment status, billing details (name, address, tax details), the transaction result reported by the payment institution, the card brand and the last four digits of the card and, if you choose to save your card, the storage key issued by the payment institution. The card number, expiry date and security code are taken on the secure page of iyzico (iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş.), a payment institution licensed in Türkiye; they never reach Clinigim and are never stored on our servers.
• Support data: the messages you send by e-mail or from within the application, their attachments and the correspondence history.
• Usage and audit records: records of who did what and when in the application (the clinic’s own audit log), error and performance logs.
• Mobile application data: device model, operating system and application version, the device token for push notifications; when you choose a clinic logo or staff photo, only the image you choose. No access to location, contacts or microphone is requested.
• Patient data (on the clinic’s behalf): the identity and contact details, appointment, treatment and payment records, clinical notes, health questionnaire answers, uploaded files and consent and communication preference records the clinic enters or you submit through the booking page.

4.1. Personal data is collected electronically, by wholly or partly automated means, through the website, the web and mobile applications, the online booking page, e-mail and support channels — from the information you enter and from the records that arise automatically while the service runs.

Personal data is processed for the following purposes and on the legal bases in Article 5 of the KVKK (Article 6 of the GDPR):

• Opening the account, delivering the service, subscription and billing — performance of a contract.
• Authentication, two-step verification, session management, prevention of fraud and abuse, security of the service and of data — legitimate interest and the duty to secure data.
• Keeping invoice, accounting and tax records, answering lawful requests of competent authorities — legal obligation.
• Answering support requests, sending the service notices that are necessary (security, payment, changes to the agreement) — performance of a contract and legitimate interest.
• Producing aggregated usage statistics that contain no patient data and identify no one, to improve the service — legitimate interest.
• Necessity for the establishment, exercise or protection of a right (Art. 5(2)(e) KVKK): support correspondence, audit and consent records kept for disputes and proof.
• Marketing measurement (which channel brought you to us) — only with your permission in the cookie card; product announcements and campaign messages — only with your explicit consent (Commercial Electronic Messages notice).
• Google Calendar synchronisation — only when you connect it, with your explicit consent.

6.1. Health data is special category personal data. The controller that collects Patient data, decides the purposes of processing and bears the duties under Article 6 of the KVKK, the Turkish Regulation on Personal Health Data and, where applicable, Article 9 of the GDPR is the clinic. Informing Patients and obtaining their explicit consent where required is the clinic’s responsibility.

6.2. Clinigim processes this data only on the clinic’s instructions and to deliver the service; it does not use it for its own purposes, sell it or process it for advertising. Access is permission-based, clinics are technically separated from one another, and free-text clinical notes are stored encrypted.

6.3. Information you submit through the online booking page is passed to the clinic you book with and enters the clinic’s records; the clinic is the controller of that information. The booking page shows the clinic that publishes it and links to the Booking Page Privacy Notice prepared on the clinic’s behalf; if the clinic also has its own privacy notice, that notice prevails.

7.1. The site and the application use only the cookies essential for the service to work, interface preferences stored on your device and, if you allow it, a marketing measurement record. No advertising cookies and no third-party tracking are used; fonts are served from our own servers.

7.2. The name, purpose and duration of each cookie, and how to manage your choices, are explained in the Cookie Policy. You can change your choice at any time from the “Cookie preferences” link in the footer of every page.

8.1. Product announcements and campaign messages are sent only with the explicit consent you give under Turkish Law No. 6563 on the Regulation of Electronic Commerce; for addresses in Türkiye, Clinigim is required by law to record consents in the national Message Management System (İYS) before sending commercial electronic messages. Every message carries an opt-out link; you can withdraw your consent at any time. Details are in the Commercial Electronic Messages notice.

8.2. Notices about the operation of the service (verification codes, security alerts, payment and invoice information, changes to the agreement, deletion schedule warnings) are not commercial messages, contain no promotion and are sent regardless of consent.

9.1. Google Calendar sync is optional and is activated only when a user connects it from their own account.

9.2. When connected, the user’s Google e-mail address and access tokens, stored encrypted, are obtained; a separate calendar named “Clinigim Randevular” is created in the user’s Google account and appointments are written to it.

9.3. By default calendar events contain no patient information. If the user enables “Show patient name in calendar” in settings, later events also show the patient’s name.

9.4. When the connection is removed, the “Clinigim Randevular” calendar is deleted and the access granted is revoked.

9.5. Information obtained from Google is not sold, not used for advertising and not shared with third parties; it is viewed only when a security review requires it, where the law requires it, or with the user’s explicit consent.

9.6. Clinigim’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

10.1. The mobile application uses the same account and the same data as the web application. If you turn push notifications on, your device’s notification token passes through the device platform’s and the notification infrastructure provider’s systems so that notifications can be delivered; notification texts may contain appointment summaries according to the clinic’s settings. You can turn notifications off in your device settings at any time.

10.2. Photo library access is used only when you choose a clinic logo or staff photo, and only for the image you choose.

11.1. Personal data may be shared, only as needed to deliver the service and with the necessary safeguards, with the following categories of recipients:

• Hosting, data storage, domain and network protection providers (processors; sub-processors under the Data Processing Agreement),
• E-mail, WhatsApp and mobile notification delivery providers (processors; messaging channels only when the clinic enables them),
• The provider that hosts the support mailbox (processor),
• The payment institution iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş. (iyzico, Türkiye; licensed under Law No. 6493; an independent controller): only the information needed to initiate the payment — the clinic name, e-mail, the clinic’s phone number and address, tax or national identity number, IP address, the chosen plan and amount; details are in section 4 of the Privacy Notice and in iyzico’s privacy policy (www.iyzico.com/en/privacy-policy),
• Google (only when Google Calendar is connected; an independent controller for personal Google accounts, the clinic’s processor for Google Workspace accounts),
• Competent public authorities and courts (only where legally required, after assessing the lawfulness of the request).
• The name, country, data processed and transfer safeguard of every processor are published on the Sub-processors page.

12.1. Our application server and database are in a data centre in Türkiye. Patient files and the encrypted backup copy of the database are kept in a private store in data centres within the European Union; transactional e-mails are sent through a provider established in Türkiye. Providers established outside the European Union may be used for message and push notification delivery; the patient-file storage and network protection provider is US-based (storage in data centres within the European Union, network protection with the site’s static files and request metadata only).

12.2. Every transfer from Türkiye abroad (including to providers within the European Union) is subject to Article 9 of the KVKK; for these transfers, an adequacy decision of the Turkish Personal Data Protection Board or the standard contract published by the Board, signed with the provider concerned and notified to the Personal Data Protection Authority within five business days of the completion of signatures, is required; as at 20 October 2026 the Board has not issued an adequacy decision for any country, and the status of the safeguard for each provider is published on the Sub-processors page. Transfers from the European Economic Area or the United Kingdom are subject to the safeguards of Chapter V of the GDPR (Standard Contractual Clauses).

12.3. The safeguard used for each provider is stated on the Sub-processors page.

13.1. Personal data is kept for as long as the purpose requires and for the periods the law prescribes, then deleted, destroyed or anonymised. The main periods:

• Account and clinic data: for as long as the account exists; for inactive and closed accounts under the schedule in section 16 of the Terms of Service (90 days after an unpaid trial; 13 months from the last sign-in on free use; 90 days from the end of the subscription period or the last sign-in after it; warnings about 30 and 7 days before every deletion; a 30-day restore window after deletion).
• Sign-in and session records and the clinic’s audit log: 24 months; permanently deleted 30 days after the clinic is deleted.
• Contract acceptance records (version and digest of the accepted text, date and time of acceptance, the date the record was created, the accepting user’s full name and e-mail address, the clinic’s name and tax number, IP address and browser details): for as long as the Account exists; after the clinic is deleted they are kept as proof in disputes and under Article 82 of the Turkish Commercial Code, and are deleted 10 years after the end of the year in which the clinic was deleted. They contain no patient data. The full text of the accepted Terms of Service and Data Processing Agreement is kept as well; it contains no personal data and is kept indefinitely.
• Server access (traffic) logs (IP address and port, date and time of the request, the address requested, the type of operation and its result, browser details): 13 months under Article 5 of Turkish Law No. 5651, then deleted. One-time link codes, user names and query values (such as search terms) in the address are removed before the record is written; request and response headers (cookies included) are not recorded.
• Support correspondence: 3 years from the last exchange.
• KVKK request records: 3 years from the closing of the request (proof).
• Invoices and subscription payment records: at least 5 years from the start of the year following the year they relate to under the Turkish Tax Procedure Law, and 10 years from the end of the calendar year concerned under Article 82 of the Turkish Commercial Code.
• Commercial electronic message consent records: 3 years from the date the consent ended; opt-out and other message records: 3 years from the date of the record.
• Marketing measurement record: until you withdraw your permission or the account is deleted.
• Backups: permanently deleted data is also removed from backups within at most 14 days after the deletion.

14.1. Clinigim takes the technical and organisational measures required by Article 12 of the KVKK and Article 32 of the GDPR to keep personal data secure: encrypted connections, encrypted storage in the database of selected fields, free-text clinical notes in particular, permission-based access, isolation between clinics, two-step verification, activity logs and regular encrypted backups. Details are on the Security page and in Annex 2 of the Data Processing Agreement.

15.1. Clinigim is a service for businesses and health professionals; people under 18 cannot open an account. For the data of minor patients that may appear in a clinic’s records, the controller is the clinic concerned.

16.1. Under Article 11 of the KVKK everyone may, by applying to the controller:

• learn whether their personal data is processed and, if so, request information about it,
• learn the purpose of processing and whether the data is used in line with it,
• know the third parties in Türkiye or abroad to whom the data is transferred,
• request correction of incomplete or inaccurate data,
• request deletion or destruction under the conditions of Article 7 of the KVKK,
• request that corrections, deletions and destructions be notified to the third parties the data was transferred to,
• object to a result against them produced exclusively by automated analysis,
• claim compensation for damage suffered through unlawful processing.
• If you are in the European Economic Area or the United Kingdom you also have the rights of access, rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw consent for processing based on consent.

17.1. You can send requests about your rights, with information that verifies your identity, in writing to [email protected], to our KEP address if it is published in the Company Information section, or to our registered address; if you have an account, sending the request from your registered e-mail address is enough to verify your identity. Requests are answered within 30 days at the latest and as a rule free of charge; where an operation carries a separate cost, the tariff set by the Turkish Personal Data Protection Board may apply.

17.2. Requests about Patient data should be addressed to the clinic, which is the controller; requests that reach us are forwarded to the clinic without delay and we assist the clinic in answering them.

17.3. If your request is refused, you find the answer insufficient or no answer is given in time, you may complain to the Turkish Personal Data Protection Board within 30 days of learning the answer and in any case within 60 days of your application; if you are in the European Economic Area or the United Kingdom, to the data protection authority of your own country.

18.1. Material changes to this Policy are announced by e-mail and in-app notice at least 30 days before they take effect. Every version is published in the Version history section with its date and what changed.

19.1. For any question about this Policy or your personal data: [email protected].

Earlier versions of this document and what changed in each:

• 7 November 2026 — Retention period of KVKK request records added (section 13).
• 7 November 2026 — The payment institution named; the data sent for and returned from payments described (sections 3 and 11).
• 6 November 2026 — The application server and the database moved to a data centre in Türkiye and transactional e-mail moved to a provider established in Türkiye (section 12); patient files and the encrypted backup copy remain outside Türkiye.
• 24 October 2026 — Contract acceptance records are now kept after the clinic is deleted too, for 10 years from the end of the deletion year (section 13); the record also holds the clinic’s name, its tax number, the accepting user’s full name and e-mail address and the date the record was created; the full text of the accepted agreements is kept. What the server access (traffic) logs hold and their exact retention period (13 months) stated.
• 23 October 2026 — The controller’s identifying details linked to the Company Information section; the booking page, commercial messages, contract acceptance records, encryption and request channels aligned with how the product actually works.
• 20 October 2026 — Comprehensive rewrite: data categories detailed by service group; the purpose and legal basis mapping extended; mobile application, commercial messages and a retention table added; cookies moved to a separate Cookie Policy, the short notice to the Privacy Notice and the providers to the Sub-processors page; international transfers written to the current safeguards of Article 9 KVKK.
• 16 October 2026 — Payment and cookie sections updated.
• 26 September 2026 — First version.