Privacy Policy

This section applies to clinic administrators, staff, and operational users who access the Hipocra platform. Hipocra Health Technologies acts as the data controller for personal data of platform users.

1. Data Controller

2. Data We Collect

• Identity: Name, surname
• Contact: Email address, phone number
• Account: Role, clinic affiliation, permissions, login credentials (hashed)
• Usage: Session logs, feature interactions, audit trail, IP address
• Communications: Support correspondence and in-platform notifications

3. Legal Basis for Processing

• KVKK 5/2-cContract performance — provision of the platform services subscribed to
• KVKK 5/2-aLegal obligation — compliance with applicable Turkish law
• KVKK 5/2-fLegitimate interest — platform security, fraud prevention, service improvement

4. Processing Purposes

• Authentication and role-based access control
• Platform service delivery and technical support
• Operational notifications relevant to your account
• Security monitoring, audit logging, and fraud prevention
• Platform analytics and continuous improvement
• Legal and regulatory compliance

5. Data Sharing and Recipients

We do not sell your data. Recipients are limited to:

• Supabase Inc. — database hosting and authentication (Data Processing Agreement in place)
• Vercel Inc. — platform hosting and CDN (Data Processing Agreement in place)
• Legal authorities — when required by Turkish law or court order

6. International Transfers

Our infrastructure providers operate in the United States. Transfers are conducted under appropriate safeguards per KVKK Articles 8–9 and applicable KVK Board decisions.

7. Retention

• Active accounts: for the duration of the subscription
• Post-termination: up to 3 years for legal and dispute-resolution purposes
• Audit logs: up to 5 years per applicable record-keeping obligations
• Anonymised analytics: indefinitely

8. Your Rights (KVKK Art. 11)

• Learn whether your personal data is being processed
• Request information about how it is processed
• Learn the purpose and whether data is used accordingly
• Know the third parties to whom your data is transferred
• Request correction of inaccurate or incomplete data
• Request deletion or destruction where grounds exist
• Request notification of corrections or deletions to third parties
• Object to automated decisions to your detriment
• Claim compensation for damages from unlawful processing

Submit requests to [email protected]. Requests are processed within 30 days. See our KVKK Aydınlatma Metni for the full Turkish-language disclosure.