Privacy Notice under the Turkish Personal Data Protection Law (KVKK)
Dieses Dokument liegt auf Türkisch und Englisch vor; maßgeblich ist der türkische Text.
Last updated: 29 October 2026
This notice explains, under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data (KVKK), how personal data processed through the Vitonella app and vitonella.com is handled. The Turkish version prevails.
1. Data controller
Vitonella, Erzurum Mah. Eceabat Sok. No:10/6 Çankaya/Ankara, Türkiye. Contact: enesdeveci@vitonella.com.
2. Personal data we process
- Identity and contact: name, surname, email address, phone number if given.
- Account: a hash of your password (never the password itself), language and notification preferences, subscription status.
- Health data (special category data): your medicines and how you take them, conditions, allergies, lab values, nutrition and exercise information, measurements (blood pressure, glucose, weight), skin assessment answers and results, conversations with the AI assistant.
- Photos: meal, medicine cabinet, lab document and skin photos are read by AI. Skin photos are not stored after reading.
- Pharmacy and family links: the pharmacy you connect to, relatives you add, the information you choose to share with them, and messages.
- Security: IP address, device and app version, session and access logs, notification token.
- Payments: plan purchased, amount, order number. Your card details never reach Vitonella; they are processed by PayTR, Apple or Google.
- Website: Google Analytics cookies and page views, only if you consent.
3. Purposes and legal grounds
| Purpose | Data | Legal ground |
|---|---|---|
| Creating your account, sign-in and providing the service | Identity, contact, account | Performance of a contract (Art. 5/2-c) |
| Personal plan, reminders, drug-interaction warnings, AI analysis | Health data, photos | Your explicit consent (Art. 6/3) |
| Sharing with the pharmacy and relatives you choose | Health and contact data within the scope you choose | Your explicit consent (Art. 6/3); you set the scope |
| Payment, invoicing and accounting | Payment, identity, contact | Contract and legal obligation (Art. 5/2-c, ç) |
| Information security, abuse prevention, access logs | Security data | Legal obligation (Law No. 5651) and legitimate interest (Art. 5/2-ç, f) |
| Campaign and announcement emails/notifications | Contact | Your explicit consent (Art. 5/1) and consent under Law No. 6563 |
| Website measurement | Cookies and page data | Your explicit consent (cookie banner) |
| Handling legal claims and disputes | Relevant records | Establishing, exercising or protecting a right (Art. 5/2-e) |
4. Recipients
In Türkiye: PayTR (web payments); the pharmacy and relatives you choose to connect (only within the scope you choose); public authorities where required by law.
Abroad (KVKK Art. 9):
- netcup GmbH (Austria): the app’s servers and database; all data, including account and health data, is hosted here.
- Google (USA and EU): Gemini AI analysis (chat, plans, photo and lab reading, which includes health data); Firebase Cloud Messaging (notifications); Google sign-in if you choose it; Google Analytics on the website only with your consent.
- Apple (USA): App Store payments, Sign in with Apple if you choose it, iPhone notifications.
- RevenueCat (USA): validating app store subscriptions (user ID and purchase information).
- Resend (USA): sending email (your address and the email content; summary emails may include your plan adherence).
5. Basis for transfers abroad
These transfers rely, under KVKK Art. 9, on the standard contracts published by the Turkish Personal Data Protection Board and on your explicit consent to the processing of your health data abroad. You can withdraw your consent at any time; AI-based features then stop working.
6. How we collect data
Electronically: from what you enter in the app and on the website, from Apple Health / Health Connect if you allow it, from photos you take, from pharmacy and family links, and from our servers’ automatic logs.
7. Retention
We keep your data while your account is open. When you delete your account, your data is deleted or anonymised, except records we must keep by law (payment and invoice records for the period required by Turkish tax and commercial law; access logs for the period required by Law No. 5651; consent records as evidence).
8. Your rights (KVKK Art. 11)
- Learn whether your data is processed and request information about it,
- Learn the purpose of processing and whether data is used accordingly,
- Know the third parties in Türkiye or abroad to whom data is transferred,
- Request correction of incomplete or inaccurate data,
- Request deletion or destruction under the conditions of Art. 7,
- Request that corrections and deletions be notified to third parties who received the data,
- Object to a result against you arising solely from automated analysis,
- Claim compensation for damage caused by unlawful processing.
9. How to apply
Send your request in writing to Erzurum Mah. Eceabat Sok. No:10/6 Çankaya/Ankara, Türkiye, by registered electronic mail (KEP), secure electronic or mobile signature, or from the email address registered to your Vitonella account to enesdeveci@vitonella.com. We answer within 30 days free of charge; if the request involves an additional cost, the fee set by the Board may apply. You may also complain to the Turkish Personal Data Protection Board.