Privacy Notice on Personal Data Processing

1. Identity of the Data Controller

2. Categories of Personal Data Processed

• a) Identity Data: Name, email
• b) Health Data (Special Category):
  • b1) User's own health data: Medications, allergies, chronic conditions, symptoms, age, gender, blood type, vaccine records, smoking/alcohol use, surgical history, pregnancy/breastfeeding status, lab values, supplements
  • b2) Family Health History (v2.2 — new explicit category): Health history of your first- and second-degree relatives (mother, father, sibling, grandparent, aunt, uncle, cousin) — condition name, age at diagnosis, age at death (if applicable), free-text notes.
    Purpose: Hereditary risk assessment (breast/colon/prostate cancer, early cardiovascular events, diabetes, Alzheimer's, etc.), early screening recommendations, personalized AI context.
    Legal basis: KVKK Art.6 EXPLICIT CONSENT (within the scope of AI Processing consent). Since this constitutes third-party health data, only what you disclose is stored, at the metadata level; detailed medications/profiles are not kept for third parties.
• c) Medical Image/Document Data: Blood test reports (PDF), radiology images, medication photos, prescribing information images
• d) Contact Data: Phone number (optional)
• e) Transaction Data: AI chat history, interaction check results, SBAR reports, consent records
• f) Technical Data: IP address, browser info (security purposes)
• g) Financial Data (only for Premium subscription users):
  What data: Payment amount, payment status, subscription start/end dates, invoice/receipt information, card mask (last 4 digits only).
  What is not processed: Your full card number, CVV, passwords. This information is never stored on DoctoPal servers; it is securely held by our PCI-DSS certified payment infrastructure provider, Iyzico.
  Data subject scope: Financial data is processed only for the user who performs the subscription payment (Individual Premium subscriber or Family Premium owner). Family members (invited users) are not parties to the payment; no financial data is processed for them.

3. Processing Purposes and Legal Basis

Special category health data (KVKK Art.6) is processed ONLY based on your EXPLICIT CONSENT. No processing based on legitimate interest or contractual necessity.

1. AI-powered personalized health information
2. Drug-herb and drug-drug interaction checking
3. Medical image/document analysis (blood tests, radiology reports)
4. Prescribing information and medication photo reading/analysis
5. SBAR format pre-visit doctor report generation
6. Medication tracking, vaccine calendar, daily health logging
7. Service improvement and security
8. Semantic search (related content suggestions)
9. Provision of Premium subscription services, payment collection, and invoice issuance (Legal basis: Establishment and performance of contract — KVKK Art.5/2-c; Legal obligation under the Tax Procedure Law — KVKK Art.5/2-ç)

4. Data Collection Method

Data is collected directly through forms on the web interface by the user and automatically during user interaction with the application. DoctoPal does not collect any health data from external sources unless explicitly shared by the user.

5. Third-Party Data Recipients

• Supabase Inc. (Ireland / EU)
  Purpose: Data storage, user management, database
  Data transferred: All user data
  Legal basis: Your explicit consent (KVKK Art.9/1)
• Anthropic PBC (USA)
  Purpose: AI (Claude) text analysis + multimodal image analysis
  Data transferred: Anonymized health data + visual files (blood tests, radiology, medication photos)
  Legal basis: Your explicit consent (KVKK Art.9/1)
• Google LLC (USA)
  Purpose: Gemini text-embedding-004 semantic search infrastructure
  Data transferred: Anonymized text queries (no identity data, only keyword/term-based search text)
  Legal basis: Your explicit consent (KVKK Art.9/1)
• Iyzico Ödeme Hizmetleri A.Ş. (Türkiye-based, PCI-DSS certified)
  Purpose of transfer: Collection of Premium subscription payments, subscription management, refund processing
  Data transferred: Full name, email, card information (not returned to DoctoPal), subscription status, payment history
  Legal basis: Performance of contract (KVKK Art.5/2-c)
  Cross-border transfer: NONE. Iyzico is established in Türkiye; all payment data is processed within Türkiye.

Anonymization: Direct identity information (name, email, national ID, phone, address, user ID) is automatically removed by our system from data transferred abroad. This process is carried out in accordance with the KVKK Generative AI Guide (November 2025) and is logged.

6. Retention Periods

After account deletion request: All personal data is permanently deleted within 30 days. Audit logs are retained for 5 years as legally required, but identity information is anonymized.

7. Your Rights (KVKK Art.11)

Under KVKK Law No.6698 Art.11, you have the following rights:

1. Learn whether your personal data is being processed
2. If processed, request information about the processing
3. Learn the purpose of processing and whether data is used accordingly
4. Know the third parties to whom your data is transferred domestically or internationally
5. Request correction if personal data is processed incompletely or inaccurately
6. Request deletion or destruction of personal data under conditions set forth in KVKK Art.7
7. Request that corrections, deletions, or destructions under items 5 and 6 be notified to third parties to whom your data was transferred
8. Object to outcomes arising from exclusively automated analysis of processed data (Art.11/1-g)
9. Claim compensation for damages due to unlawful processing of personal data

8. Application Procedure

9. User Age Restriction

DoctoPal is designed for users aged 18 and over. By using the service, the user declares and undertakes that they are over 18 years of age. If an account is opened by a user under 18, the account will be closed and data deleted upon detection.

10. Security Measures (KVKK Art.12)

• Supabase Row-Level Security (RLS) for data isolation
• TLS/HTTPS encrypted communication
• Encryption at rest (Supabase infrastructure)
• Automatic identity anonymization before AI API calls
• Prompt injection protection
• Rate limiting
• Audit logging (KVKK Art.12)
• 72-hour breach notification plan
• 9-layer security architecture

11. Change History