Privacy Policy and Privacy Notice

Last updated: 4 November 2026 This English text is provided for convenience. In case of any discrepancy, the Turkish version prevails. Medroco Medikal Robotik Anonim Şirketi ("Medroco"), as data controller under Turkish Personal Data Protection Law No. 6698 ("KVKK"), provides this notice about the personal data we process through medroco.com, membership.medroco.com, the Medroco One web panels, our mobile and desktop apps and our devices (the "Platform"). This notice is for your information; it is not presented for your approval. 1. DATA CONTROLLER Medroco Medikal Robotik Anonim Şirketi Central Registration System (MERSİS) no: 0614145362600001 Address: Orta Mahalle, Kavaklar Caddesi No:15, Ofisada Plaza, Adapazarı / Sakarya, Türkiye Phone: +90 546 207 97 50 Email: [email protected] 2. DATA WE PROCESS, PURPOSES AND LEGAL GROUNDS Each line gives the activity, the data processed, the purpose and the legal ground under the KVKK. - Account creation and sign-in: name, surname, username, email address, an irreversible hash of your password, language, time zone; to create your account and let you sign in; conclusion and performance of a contract (Art. 5(2)(c)). - Profile: date of birth, phone number, profile photo; to run your account; performance of a contract (Art. 5(2)(c)). - Expert and organisation accounts: specialisation, education, CV, trade name, tax and contact details; to present the profile and run the account; performance of a contract (Art. 5(2)(c)). - Orders, subscriptions, payments, delivery, returns and withdrawals: identity, contact, address, invoice and transaction records; to handle the sale and invoicing; performance of a contract (Art. 5(2)(c)) and tax and consumer law (Art. 5(2)(ç)). Your card details are collected and stored only by iyzico, a licensed payment institution; Medroco never sees your card number. For purchases made in an app store, your payment details stay with Apple or Google. - Contract, consent and notice records: text version, date, IP address, channel; to prove acceptances and that notice was given; establishing a right (Art. 5(2)(e)) and legal obligation (Art. 5(2)(ç)). - Measurements and health profile (special category data): measurements, reports, health profile, expert feedback, messages with experts and expert recommendations; for recording, reporting and sharing with the experts you authorise; explicit consent only (Art. 6(3)(a)). Consent is obtained through the Explicit Consent Text on the Processing of Health Data, presented separately from this notice. If you do not consent, your account is still created, but you cannot take measurements, play games or enter health profile information. For managed accounts, section 3 applies. - Device data: serial number, software version; to operate and update the device and for warranty; performance of a contract (Art. 5(2)(c)). - Notifications: your device's notification identifier; to send app notifications; performance of a contract (Art. 5(2)(c)). - Security: IP address and the related country, sign-in attempts, device and browser information, app version, two-factor authentication records; information security and preventing misuse; legitimate interest (Art. 5(2)(f)) and legal obligation (Art. 5(2)(ç)). - Support: name, contact details, request content and attachments; to answer your request; performance of a contract (Art. 5(2)(c)). - Contact and hardware integration forms: name, email, phone, company, message; to answer your request; legitimate interest (Art. 5(2)(f)). - Stock notifications: email; to send the one-time notification you asked for; legitimate interest (Art. 5(2)(f)). - Service and warranty: name, contact details, serial number, purchase date and proof of purchase; to handle the service request; performance of a contract (Art. 5(2)(c)) and consumer law (Art. 5(2)(ç)). - Complaint review: the content of the reported message; to investigate misuse; legitimate interest (Art. 5(2)(f)). - KVKK requests: identity, contact details, request content; to answer the request; legal obligation (Art. 5(2)(ç)). - Disputes: the records needed; to protect a right; establishing, exercising or defending a right (Art. 5(2)(e)). We improve our products and services using anonymised data only; health data is not used for this purpose. We do not send promotional electronic messages. You may withdraw your explicit consent at any time. 3. MANAGED ACCOUNTS For accounts that an expert or organisation creates for a client, patient or staff expert and manages from its own panel (managed accounts): - The expert or organisation managing the account is the data controller for the account's measurement and health data. Medroco processes this data on the manager's behalf and on its instructions, as a data processor. - Informing the account holder and obtaining any explicit consent required is the manager's obligation. The manager declares this when creating the account, and the declaration is recorded. - Medroco is the data controller for creating the account, its security, providing access through the manager's subscription, and statutory retention. - The account holder can exercise their rights by contacting the manager or Medroco; a request sent to Medroco is also forwarded to the manager without delay. 4. HOW WE COLLECT DATA We collect personal data electronically, by automated or partly automated means, through the forms, apps, devices, payment and support processes on the Platform. 5. TRANSFERS For the purposes above only, personal data may be transferred to: - iyzico, a licensed payment institution, for payments (Türkiye), - courier companies, for delivery of physical products (Türkiye), - Apple and Google, for purchases made through their app stores; such purchases are also subject to the store's own terms, - experts and organisations you authorise or that manage your account, within the scope of that authorisation, - the infrastructure providers listed in section 6, as data processors and only to provide their services, - competent public authorities and courts upon request, - our legal advisers and auditors. 6. TRANSFERS ABROAD The servers of the following service providers are located outside Türkiye, so your personal data is transferred abroad: - DigitalOcean, LLC (USA): server and database hosting; data is stored in Germany (Frankfurt). All personal data on the Platform, including health data. - Amazon Web Services: file and backup storage (Italy, Milan) and email delivery (Germany, Frankfurt). Files you upload, measurement files, database backups and the emails we send you. - Cloudflare, Inc. (USA): domain, security and content delivery network; all traffic to and from the Platform passes, encrypted, through Cloudflare's global network. The bot check on the forms on our website is also performed by Cloudflare. - Google LLC and its affiliates (USA): Firebase Cloud Messaging for mobile notifications (device notification identifier and notification text; notification texts contain no names or health information) and company email (emails you send to [email protected] and our other addresses). - Anthropic, PBC (USA): an AI assistant used by the Medroco team for support and administration tasks; identity, contact, subscription and order data, and the content of reported messages, may be processed during these tasks. 7. RETENTION Data whose period has ended is deleted, destroyed or anonymised in the periodic destruction run we carry out every day. - When you delete your account, your identity and profile data, health data, correspondence, support requests, saved addresses, stock notification requests, session and notification records and files are permanently deleted immediately. Accounts deleted by an expert, organisation or Medroco can be restored within 30 days and are then permanently deleted. - When you withdraw your health data consent, your health data is deleted that same night. - Order, invoice, return, withdrawal and payment records and your contract acceptances are kept for 10 years from the end of the year in which the document was issued. - Health data consent, managed account declaration and notice display records are kept while the account exists and, after the account is deleted (for forms without an account, after the record is made), for 10 years from the end of the year of the record. - Sign-in and IP records are kept for 1 year. - Contact, hardware integration and service requests are kept for 2 years from the last update. - Stock notification requests are kept until the notification is sent, for at most 1 year. - Records of deletions (who and when) are kept for 3 years. - Backups are kept for at most 2 years; deleted data drops out of the backups automatically within that period. 8. COOKIES Cookies used on our websites: - medroco_one_session: keeps you signed in; 2 hours; essential. - XSRF-TOKEN: form security; 2 hours; essential. - NEXT_LOCALE: language preference; 1 year if you choose the language yourself, otherwise for the session; functional. - medroco_currency: currency preference; 1 year; functional. We do not use advertising or tracking cookies. You can delete cookies in your browser settings; blocking essential cookies may stop features such as signing in from working. 9. SECURITY Communication with the Platform is encrypted (SSL/TLS). Passwords are stored irreversibly, access to data is restricted by authorisation and logged. Backups are stored encrypted. Card data stays within iyzico's PCI DSS compliant infrastructure. 10. YOUR RIGHTS You have the rights set out in Article 11 of the KVKK. 11. HOW TO APPLY Send your request to [email protected] from the email address registered in our system, or in writing to our address above. Requests are resolved free of charge within 30 days at the latest; if the request involves an additional cost, a fee may be charged according to the tariff set by the Personal Data Protection Board. You can also manage your account and your health data consent yourself in Account Settings in the app. 12. CHILDREN Persons under 18 cannot open an account themselves. An expert or organisation opens their account as a managed account, on the declaration of their parent or guardian (section 3). Where health data relies on explicit consent, that consent is given by the parent or guardian; obtaining it is the obligation of the expert or organisation that opens the account. 13. CHANGES We may update this notice when needed. The current version is always published at medroco.com/en/privacy.