Data Protection & GDPR Disclosure

1. Data Controller

Pursuant to the Turkish Personal Data Protection Law No. 6698 ("KVKK"), your personal data is processed by our company, whose details are provided below, acting as the data controller.

2. Personal Data Processed

The following categories of personal data are processed within the scope of the Asistan 7/24 platform:

2.1. Identity Data

• First name and last name

2.2. Contact Data

• Phone number
• Email address

2.3. Transaction Security Data

• IP address
• Login credentials
• Log records

2.4. Patient Communication Data

• WhatsApp message contents
• Instagram message contents
• Phone call records

2.5. Appointment Data

• Appointment date, time, and type
• Google Calendar integration data

3. Purposes of Personal Data Processing

Your personal data collected is processed for the following purposes:

• Providing platform services and fulfilling CRM functions
• Creating and tracking appointments, and ensuring Google Calendar synchronization
• Managing WhatsApp, Instagram, and phone communications in a unified inbox
• Sending automated notifications and appointment reminders
• Providing reporting and analytics services
• Evaluating and improving service quality
• Fulfilling legal obligations
• Conducting information security processes

4. Methods and Legal Grounds for Collecting Personal Data

Your personal data is collected through the following methods:

• Platform registration and usage processes
• WhatsApp Business API integration
• Instagram Messaging API integration
• Google Calendar API integration
• Phone integration
• Website contact and demo request forms

Your personal data is processed based on the following legal grounds set forth in Articles 5 and 6 of the KVKK:

• Explicit Consent: The existence of the data subject's explicit consent (KVKK Article 5/1)
• Performance of a Contract: Where processing is necessary for the performance of a contract to which the data subject is a party, provided that it is directly related to the establishment or performance of the contract (KVKK Article 5/2-c)
• Legal Obligation: Where processing is mandatory for the data controller to fulfill its legal obligations (KVKK Article 5/2-d)
• Legitimate Interest: Where processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject (KVKK Article 5/2-f)

5. Transfer of Personal Data

5.1. Domestic Transfer

Your personal data may be transferred domestically to the following parties in line with the purposes stated above:

• Hosting and infrastructure service providers
• Authorized public institutions and organizations in cases of legal obligation

5.2. International Transfer

Due to platform integration requirements, your personal data may be transferred to the following international parties within the scope of KVKK Article 9, with adequate protection measures in place:

• Meta Platforms, Inc.: For the purpose of providing WhatsApp Business API and Instagram Messaging API services
• Google LLC: For the purpose of Google Calendar API integration and appointment synchronization

For international data transfers, the security measures and appropriate safeguards required by the KVKK are ensured.

6. Rights of the Data Subject

Pursuant to KVKK Article 11, as a personal data subject, you have the following rights:

• To learn whether your personal data has been processed
• To request information regarding the processing if your personal data has been processed
• To learn the purpose of processing your personal data and whether they are used in accordance with their purpose
• To know the third parties to whom your personal data has been transferred, domestically or internationally
• To request the correction of your personal data if it has been processed incompletely or inaccurately
• To request the deletion or destruction of your personal data within the framework of the conditions set forth in KVKK Article 7
• To request that correction, deletion, and destruction operations be notified to the third parties to whom your personal data has been transferred
• To object to any result that arises against you through the analysis of your processed data exclusively by automated systems
• To claim compensation for damages incurred due to unlawful processing of your personal data

7. Application Method

You may submit your application through the following methods to exercise the rights stated above:

• Written Application: You may submit your wet-signed petition along with identity verification documents in person to the address "Hürriyet Mah. Başmaslak 1. Sk. No: 3 BB Çorlu/Tekirdağ" or send it via notary public.
• Application via Email: You may submit your application through your registered email address or your registered electronic mail (KEP) address to [email protected].

Applications must include your first name, last name, Turkish ID number (passport number for foreign nationals), notification address, email address (if applicable), phone number, and the subject of your request.

Your applications will be concluded free of charge within the shortest time possible and within 30 (thirty) days at the latest, depending on the nature of the request. However, if the process requires an additional cost, the fee determined by the Personal Data Protection Board may be charged.

Last Updated: March 2026