Privacy Policy

This section applies to clinic administrators, staff, and operational users who access the Hipocra platform. Dasas Dijital Yaz. San. Tic. Ltd. Şti. ("Hipocra") acts as the data controller for personal data of platform users.

1. Data Controller

2. Data We Collect

• Identity: Name, surname
• Contact: Email address, phone number
• Account: Role, clinic affiliation, permissions, login credentials (hashed)
• Usage: Session logs, feature interactions, audit trail, IP address
• Communications: Support correspondence and in-platform notifications

3. Legal Basis for Processing

• KVKK 5/2-cContract performance — provision of the platform services subscribed to
• KVKK 5/2-aLegal obligation — compliance with applicable Turkish law
• KVKK 5/2-fLegitimate interest — platform security, fraud prevention, service improvement

4. Processing Purposes

• Authentication and role-based access control
• Platform service delivery and technical support
• Operational notifications relevant to your account
• Security monitoring, audit logging, and fraud prevention
• Platform analytics and continuous improvement
• Legal and regulatory compliance

5. Data Sharing and Recipients

We do not sell your data. Recipients are limited to:

• Supabase Inc. — Database hosting, authentication, file storage; Germany, Frankfurt (AWS eu-central-1) (Data Processing Agreement in place)
• DigitalOcean LLC — Application hosting and WhatsApp gateway server; Germany, Frankfurt (fra1) (Data Processing Agreement in place)
• OpenAI, L.L.C. — AI assistant, text generation, consultation summaries; USA (Data Processing Agreement in place)
• Meta Platforms, Inc. (WhatsApp) — WhatsApp messaging with patients; USA / Ireland (Data Processing Agreement in place)
• 650 Industries, Inc. (Expo) — Mobile push notifications; USA (Data Processing Agreement in place)
• Amplitude, Inc. — Product usage analytics; USA (Data Processing Agreement in place)
• DeepL SE — Text translation; Germany (Data Processing Agreement in place)
• Google LLC (FCM), Apple Inc. (APNs), Mozilla (browser push) — Delivery of mobile and browser push notifications; USA (Data Processing Agreement in place)
• Zapier, Inc. — Lead status feedback to Facebook lead ads; USA (Data Processing Agreement in place)
• İyzi Ödeme ve Elektronik Para Hizmetleri A.Ş. (iyzico) — Subscription payments (Turkey); Turkey (Data Processing Agreement in place)
• Paddle.com Market Ltd — Subscription payments (outside Turkey); United Kingdom (Data Processing Agreement in place)
• Slack Technologies, LLC — Internal alerts to the Hipocra team; USA (Data Processing Agreement in place)
• Legal authorities — when required by Turkish law or court order

6. International Transfers

Our database and application servers are in Frankfurt, Germany. Some service providers listed above are in the United States or the United Kingdom. Transfers outside Turkey are conducted under appropriate safeguards per KVKK Articles 8–9 and applicable KVK Board decisions.

7. Retention

• Active accounts: for the duration of the subscription
• Post-termination: up to 3 years for legal and dispute-resolution purposes
• Audit logs: up to 5 years per applicable record-keeping obligations
• Anonymised analytics: indefinitely

8. Your Rights (KVKK Art. 11)

• Learn whether your personal data is being processed
• Request information about how it is processed
• Learn the purpose and whether data is used accordingly
• Know the third parties to whom your data is transferred
• Request correction of inaccurate or incomplete data
• Request deletion or destruction where grounds exist
• Request notification of corrections or deletions to third parties
• Object to automated decisions to your detriment
• Claim compensation for damages from unlawful processing

Submit requests to [email protected]. Requests are processed within 30 days. See our KVKK Aydınlatma Metni for the full Turkish-language disclosure.