Privacy Notice on the Processing of Personal Data

2.1. The following personal data is collected electronically, by wholly or partly automated means, through the website, the web and mobile applications, e-mail and support channels, from the information you enter and from the records that arise automatically while the service runs:

• Identity and contact: name, surname, title, e-mail, phone, clinic name and address.
• Account and transaction security: user name, password hash, two-step verification records, sign-in time, IP address, device and browser information, session records.
• Subscription and finance: plan, period, payment status, billing details; the transaction result reported by the payment institution, the card brand and the last four digits of the card and, if you chose to save your card, the storage key issued by the payment institution. The card number, expiry date and security code are entered on the payment institution’s own page; they never reach Clinigim.
• Usage and audit: records of actions taken in the application, error and performance logs.
• Marketing measurement: only if you allow it in the cookie card, which page or link brought you to us.
• Support: the messages you send us and their attachments.

3.1. Your personal data is processed on the following legal bases in Article 5 of the KVKK and for the purposes beside each:

• Being directly related to the conclusion or performance of a contract (Art. 5(2)(c)): opening the account, delivering the service, collecting the subscription fee through the payment institution and, if you chose it, renewal with the saved card, billing, support.
• Compliance with a legal obligation (Art. 5(2)(ç)): invoice, accounting and tax records; answering requests of competent authorities; data security duties.
• Legitimate interest (Art. 5(2)(f)): securing the account and the system, preventing abuse, statistics that identify no one to improve the service, necessary service notices.
• Explicit consent (Art. 5(1)) and, for commercial electronic messages, consent under Law No. 6563: marketing measurement, commercial electronic messages and the Google Calendar connection; you may withdraw your consent at any time.
• Necessity for the establishment, exercise or protection of a right (Art. 5(2)(e)): support correspondence, audit and consent records kept for disputes and proof.

4.1. Limited to the purposes above and in accordance with Article 8 of the KVKK, your personal data may be transferred to the processors (sub-processors) that provide hosting, storage, e-mail and notification infrastructure, to the payment institution named in 4.2 for subscription payments, and, where legally required, to competent public authorities. The current list of processors is published on the Sub-processors page.

4.2. Payment institution: Subscription payments are collected through iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş. (“iyzico”, Istanbul, Türkiye), a payment and electronic money institution licensed under Turkish Law No. 6493 on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions. When you start a payment, Clinigim sends iyzico the information needed to initiate the transaction: the clinic name, your e-mail address, the clinic’s phone number and address, the clinic’s tax or national identity number (where recorded), your IP address and the chosen plan and amount. You enter your card details directly on iyzico’s secure payment page; only the transaction result, the card brand and the last four digits of the card and, if you chose to save your card, the storage key are returned to Clinigim. The legal basis for this transfer is the performance of the subscription contract (Art. 5(2)(c)).

4.3. iyzico processes the personal data relating to the payment service as a controller in its own name, including for its obligations under Law No. 6493 and Law No. 5549 on the Prevention of Laundering Proceeds of Crime; iyzico’s privacy policy applies to that processing: www.iyzico.com/en/privacy-policy. iyzico’s infrastructure is in Türkiye; for the payment, Clinigim sends your data only to iyzico, which is established in Türkiye.

5.1. Our servers and database are in Türkiye; providers established abroad are used for backup, file storage, messaging, notification and network protection infrastructure. These transfers from Türkiye are subject to Article 9 of the KVKK; for them, an adequacy decision of the Personal Data Protection Board or the standard contract published by the Board, signed with the provider concerned and notified to the Personal Data Protection Authority, is required; as at 20 October 2026 the Board has not issued an adequacy decision for any country, and the status of the safeguard for each provider is published on the Sub-processors page.

6.1. Your personal data is kept for as long as the purpose requires and for the periods the law prescribes, then deleted, destroyed or anonymised. The periods are listed by record type in section 13 of the Privacy Policy.

7.1. To exercise your rights under Article 11 of the KVKK (to learn whether your data is processed, to request information, to learn the purpose, to know the third parties it is transferred to, to request correction, deletion or destruction, to request that those operations be notified to recipients, to object to automated analysis and to claim compensation), send your application in accordance with the Communiqué on the Procedures and Principles of Application to the Controller to [email protected]. You can also make your application with the form on the KVKK Request page.

7.2. Applications are answered within 30 days at the latest and as a rule free of charge. If your application is refused, you find the answer insufficient or no answer is given in time, you may complain to the Personal Data Protection Board within 30 days of learning the answer and in any case within 60 days of your application.

8.1. For the patient data a clinic keeps or that you submit through an online booking page, the controller is the clinic concerned; Clinigim processes that data only on the clinic’s instructions, as a processor. For information and applications about that data, apply to the clinic; Clinigim assists the clinic.

Earlier versions of this document and what changed in each:

• 7 November 2026 — KVKK Request page (form) added (section 7).
• 7 November 2026 — The payment institution named; the data sent for and returned from payments, the legal basis and a reference to iyzico’s privacy policy added (sections 2, 3 and 4).
• 6 November 2026 — Servers, database and transactional e-mail delivery moved to Türkiye (section 5).
• 23 October 2026 — The controller’s identifying details linked to the Company Information section.
• 20 October 2026 — First version (previously part of the Privacy Policy).