Privacy Policy

Last updated: 12 October 2026 This English text is provided for convenience. In case of any discrepancy, the Turkish version prevails. Medroco Medikal Robotik Anonim Şirketi ("Medroco"), as data controller under Turkish Personal Data Protection Law No. 6698 ("KVKK"), provides this notice about the personal data we process through medroco.com, membership.medroco.com, the Medroco One web panels, our mobile and desktop apps and our devices (the "Platform"). 1. DATA CONTROLLER Medroco Medikal Robotik Anonim Şirketi Central Registration System (MERSİS) no: 0614145362600001 Address: Orta Mahalle, Kavaklar Caddesi No:15, Ofisada Plaza, Adapazarı / Sakarya, Türkiye Phone: +90 546 207 97 50 Email: [email protected] 2. PERSONAL DATA WE PROCESS - Identity and contact data: name, surname, username, email address, phone number, delivery and billing address. - Customer transaction data: order, subscription, invoice, delivery, return and support request records. - Financial data: billing details (tax office and tax number for corporate invoices), payment amount and payment result. Your card details are collected and stored only by iyzico, a licensed payment institution; Medroco never sees or stores your card number. - Account and transaction security data: an irreversible hash of your password, two-factor authentication records, sign-in attempts, IP address, device and browser information, app version. - Measurement and usage data: movement, force, balance and performance measurements from exercise, test and game sessions with Medroco devices and apps, and session history. - Special categories of personal data: when measurement data is processed for physiotherapy, rehabilitation or health tracking, it may qualify as health data. Such data is processed only with your explicit consent and in line with Article 6 of the KVKK. 3. PURPOSES - Creating your account, verifying your identity and providing secure access to the Platform, - Handling orders and subscriptions, taking payments, invoicing, delivery and returns, - Recording and reporting your measurements and sharing them with the experts or institutions you authorise, - Answering your support requests and communicating with you, - Information security and preventing misuse and fraud, - Meeting our obligations under tax, commercial and consumer law and responding to requests from competent authorities, - Improving our products and services (using anonymised data where possible). 4. LEGAL GROUNDS We process your personal data on the grounds set out in Article 5(2) of the KVKK: where it is expressly provided for by law, necessary to conclude or perform a contract, necessary to comply with a legal obligation, necessary to establish, exercise or defend a right, or necessary for our legitimate interests provided that it does not harm your fundamental rights and freedoms. Measurement data that qualifies as health data, and promotional electronic messages, are processed only on the basis of your explicit consent, which you may withdraw at any time. 5. HOW WE COLLECT DATA We collect personal data electronically, by automated or partly automated means, through the forms, apps, devices, payment and support processes on the Platform. 6. TRANSFERS For the purposes above only, personal data may be transferred to: - iyzico, a licensed payment institution, for payments, - courier companies, for delivery of physical products, - Apple and Google, for purchases made through their app stores, - providers of server hosting, content delivery and email services we use, - experts and institutions you authorise or that manage your account, within the scope of that authorisation, - competent public authorities and courts upon request, - our legal advisers and auditors. The servers of our hosting, content delivery and email providers may be located outside Türkiye; such transfers are made with the appropriate safeguards required by Article 9 of the KVKK or, where necessary, with your explicit consent. 7. RETENTION We keep personal data for as long as the purpose requires and for the retention periods set by law. For example, invoices and accounting records are kept for 10 years under tax and commercial law, and sign-in attempt records for 180 days. At the end of the period the data is deleted, destroyed or anonymised. If you ask us to close your account, data we are not legally required to keep is deleted. 8. COOKIES Our websites use cookies and similar browser storage only for essential functions such as keeping you signed in, remembering your language and security. We do not use advertising or third-party tracking cookies. You can delete cookies in your browser settings; blocking essential cookies may stop features such as signing in from working. 9. SECURITY Communication with the Platform is encrypted (SSL/TLS). Passwords are stored irreversibly, access to data is restricted by authorisation and logged, and card data stays within iyzico's PCI DSS compliant infrastructure. 10. YOUR RIGHTS Under Article 11 of the KVKK you have the right to learn whether your personal data is processed; to request information about it; to learn the purpose of processing and whether it is used accordingly; to know the third parties in Türkiye or abroad to whom it is transferred; to request correction of incomplete or inaccurate data; to request deletion or destruction under Article 7 of the KVKK; to request that corrections, deletions and destructions be notified to third parties to whom the data was transferred; to object to a result against you arising solely from automated analysis; and to claim compensation for damage caused by unlawful processing. 11. HOW TO APPLY Send your request to [email protected] from the email address registered in our system, or in writing to our address above. Requests are resolved free of charge within 30 days at the latest; if the request involves an additional cost, a fee may be charged according to the tariff set by the Personal Data Protection Board. 12. CHILDREN Personal data of persons under 18 is processed with the consent of their parent or guardian, or through accounts managed by an expert or institution they have authorised. 13. CHANGES We may update this notice when needed. The current version is always published at medroco.com/en/privacy.