Data processing agreement

1. Parties and roles

The Clinic is the controller of data about its patients, prospective patients, people who message the clinic and their companions. The Clinic decides the purpose and legal basis of collection.

The Company is the processor: it processes this data only on behalf of and on the instructions of the Clinic, to provide the service. The Company does not use this data for its own purposes, sell it, or use it for advertising or profiling.

2. Subject matter and scope

• Data subjects: patients and prospective patients, companions, people who message the clinic or fill in forms, clinic staff.
• Data categories: identity and contact details, appointments, quotes, sales and payments, message threads and attachments, consent forms, travel and accommodation details.
• Special category data: health data to the extent the Clinic enters it (examination and treatment notes, photos, medical documents).
• Processing operations: storage, display, editing, sending messages over the channels the Clinic chooses, reporting, backup, deletion and anonymization.
• Duration: for the term of the subscription and the return and deletion period in section 10.

3. Clinic obligations

• Inform patients and other data subjects (KVKK Art. 10), obtain and record any required explicit consent.
• Process health data in line with KVKK Art. 6 and Board decisions; enter only the data needed for treatment and service.
• Fulfil controller obligations such as VERBİS registration.
• Grant staff the least access needed, never share accounts, and close the access of departing staff.
• Comply with the Message Management System (İYS) and commercial electronic message rules for marketing messages.

4. Company obligations

• Process data only on the Clinic's documented instructions; settings and actions the Clinic takes in the product count as instructions. Inform the Clinic if an instruction appears to infringe the law.
• Bind staff and contractors with access to data to confidentiality. Company staff reach a clinic's data only through time-limited support access opened by the Clinic, which is logged.
• Implement and maintain the technical and organizational measures in section 5.
• Assist the Clinic in answering data subject requests: data export, correction, deletion and anonymization are available to the Clinic in the product. Requests received by the Company directly are forwarded to the Clinic without delay.
• Notify the Clinic of requests from public authorities unless legally prohibited.

5. Security measures

• Servers, database and file storage are located in Türkiye.
• Encryption in transit (TLS); health data fields, patient files and photos, access tokens and third-party keys are stored encrypted with AES-256.
• Each clinic's data is separated by database row-level security; role- and permission-based access, two-factor authentication, IP and device restriction options.
• Every change and every patient record view is written to the audit log; patient names, phone numbers and emails are masked in logs.
• Regular backups; data past its retention period is automatically destroyed or anonymized.

6. Sub-processors

The Clinic gives general authorization for the Company to use the sub-processors below to provide the service. Connection-based services are used only when the Clinic enables the related connection or feature. The Company binds sub-processors with obligations equivalent to this agreement. The Clinic is informed in the app before a new sub-processor is added; if the Clinic objects on reasonable grounds, it may terminate its subscription with a refund.

• Hosting (servers, database, file storage, backups): data center provider in Türkiye.
• Meta Platforms (WhatsApp Business Platform, Instagram, Messenger, lead forms): when the Clinic connects, via the Clinic's own business account.
• Google (Calendar, Gmail, Business Profile, Google Ads): when the Clinic or a staff member connects.
• TikTok (ads and lead forms): when the Clinic connects.
• Anthropic (AI features; USA): only when the Clinic enables the feature and approves the international transfer; phone numbers, emails and ID numbers are masked before sending.
• Deepgram (voice notes and call transcripts; USA): only when the Clinic enables the related feature.
• SMS provider (Netgsm), email delivery service and e-invoice integrator: for notifications and documents sent by the Clinic.
• Payment institution (iyzico): for subscription payments. Card data is not stored by the Company.

7. International transfers

The primary copy of patient data is stored in Türkiye. Transfers to the sub-processors listed above as located abroad happen only when the Clinic enables the related connection or feature, and in line with KVKK Art. 9 (the standard contract announced by the Board, an adequacy decision or the data subject's explicit consent). AI features are off by default and send no data without the Clinic's approval.

8. Personal data breach notification

When the Company becomes aware of a security breach affecting Clinic data, it notifies the Clinic without undue delay and at the latest within 48 hours, describing the nature of the breach, the affected data and data subject groups, and the measures taken and proposed. It provides the information and support the Clinic needs to notify the Personal Data Protection Board within 72 hours and to inform data subjects.

9. Audits

On the Clinic's written request, the Company provides information and documents demonstrating compliance within a reasonable time. The Clinic or an independent auditor it appoints may carry out an audit with reasonable prior notice, under confidentiality, at most once a year and at the Clinic's cost. Requests of the Board are not subject to this limit.

10. Termination, return and deletion

When the subscription ends, a copy of the Clinic's data is delivered on request within 30 days. A closed clinic account is suspended immediately and its personal data is irreversibly destroyed or anonymized after 30 days. Sales and invoice records that must be retained by law are kept without personal data. Copies in backups are deleted automatically within the backup cycle.

11. Liability

Each party is liable for damage arising from breach of its own obligations. Claims arising from the Clinic's failure to inform data subjects, obtain consent or have a legal basis are the Clinic's responsibility. To the extent permitted by law, the Company's liability is subject to the cap in the terms of service (subscription fees paid in the 12 months before the damage); cases of intent and gross negligence are reserved.

12. Entry into force and changes

This agreement enters into force when an authorized Clinic representative accepts it in the app; the date, time, accepting person, IP address and agreement version are recorded. When the agreement changes, the new version is presented for acceptance in the app. Turkish law applies; the courts and enforcement offices of [İl] have jurisdiction.

Processor: [Şirket unvanı], [Şirket adresi], [MERSİS ya da vergi numarası]. Data protection contact: kvkk@sinaroute.local.