Privacy Policy

1. Introduction

Vitonella is a digital health platform that provides users with personalized recommendations based on their medication use, nutrition, and exercise data. We place the highest importance on the privacy and security of your personal data. This privacy policy explains what data we collect, how we use it, and how we protect it in accordance with globally applicable regulations such as the EU General Data Protection Regulation (GDPR), the Turkish Personal Data Protection Law (KVKK), and the U.S. Health Insurance Portability and Accountability Act (HIPAA). Both GDPR and HIPAA are among the strictest privacy and security frameworks worldwide, sharing the common goal of protecting sensitive information. The principles outlined in this policy apply to all our users and describe our practices for the data you share by using our platform.

2. Data We Collect

When you use Vitonella, we collect personal data in various categories to provide you with better service:

All collected data is obtained with your consent and within the framework of the Information Notice presented to you, to serve the specified purposes. This policy will be updated, and necessary information will be provided if different data types are collected for new features that may be introduced in the future.

• Identity and Contact Data: Information that can identify you, such as your name, surname, email address, and phone number.
• Profile and Account Data: Registration information like your account username, password, as well as your preferences, settings, and other information you share in your profile.
• Health and Lifestyle Data: The core health data of the platform. For example, the medications you use, your medical history or diagnoses, allergies, dietary information (daily calorie intake, meal contents, etc.), exercise and activities (step count, exercise duration, heart rate measurements), and similar lifestyle data. This data is considered special category personal data (health information) under GDPR and KVKK and is handled with sensitivity.
• Device and Technical Data: Technical data collected when you use our app or website; for example, your IP address, device type, operating system and browser information, and navigation data collected via cookies. Additionally, log records and error reports related to your use of the Vitonella app are included.
• Sensor and Integration Data: Data from devices or services you integrate with our app. For instance, data such as step count, heart rate, sleep patterns from your smartphone's health app or wearable devices (smartwatch, fitness tracker, etc.) can be transferred to our platform if you choose to use these integrations.
• Data from Third-Party Sources: With your permission, additional health data or related data from third-party services. For example, if you connect to another health app and transfer your data from that app to Vitonella, this data will also be collected by our platform.

3. Method of Data Collection

We collect your data through various methods, enabling our platform to offer you an integrated and user-friendly experience:

Our data collection methods are transparent. Our application informs you at the time of data collection as much as possible and requests your permissions when necessary. For example, the app will ask for your consent before using your location data. By doing so, we aim to ensure that you are aware of what data you are sharing and that you remain in control.

• Direct User Input: You provide much of the data directly. For example, identity and contact information entered during registration, and health information shared while filling out your profile (your medications, diet plan, exercise routines, etc.). Any information you enter about yourself through forms, surveys, or journaling features within the app is collected under your control.
• Sensor and Device Integrations: Vitonella can integrate with your smartphone's sensors or external wearable devices. For instance, a connection can be established with your device's health app to retrieve data from sensors like a step counter, heart rate monitor, or sleep tracker. Such integrations are carried out only with your permission; health and activity data from your device is automatically collected if you grant the relevant permissions.
• Third-Party APIs: In some cases, we may pull data from other applications or third-party services at your request. For example, if you want to transfer your diet information from another health platform to your Vitonella account, your data can be retrieved through the respective platform's API (application programming interface) integration. This process is done with your explicit consent and in accordance with the privacy policies of the said third party.
• Automatically Collected Technical Data: While using Vitonella, some data is collected automatically to ensure the performance and security of the application. For instance, your navigation preferences may be stored via cookies placed on your browser when you visit our website; data such as error logs, IP address, and device information generated during your app usage are also collected in the background. Such data is generally statistical information that does not directly reveal your identity but is still handled in accordance with the terms of this policy.

4. Purpose of Data Processing

We use the collected data to perform and improve the service we offer you. Vitonella is committed to processing your data for specific, explicit, and legitimate purposes. Our main processing purposes include: AI-Powered Personalized Recommendations, Service Provision and Improvement, Communication and Support, Fulfillment of Legal Obligations, and Additional Purposes with User Consent. Vitonella adheres to the principle of purpose-limitation, processing data that is relevant, limited, and proportionate.

5. Legal Basis

We act in accordance with the legal bases specified in local and international data protection legislation when processing your data. The legal ground for our processing activities may vary depending on the type of data and the purpose of processing: Explicit Consent, Performance of a Contract, Legitimate Interest, Legal Obligation, and permissions under HIPAA. We record the legal basis for processing each type of data and present it to you transparently.

6. Data Retention Period and Security

Your personal data is stored in our systems for the period stipulated by the relevant legislation or for as long as necessary for the purpose for which it was processed. To ensure data security, your data is encrypted during transmission and storage, access control mechanisms are implemented, and our systems are regularly tested. We also comply with the requirements of the HIPAA Security Rule.

7. Sharing Data with Third Parties

Your personal data may only be shared with service providers (data processors), business partners with your consent, and official authorities as required by legal obligations. Vitonella never sells user data and does not allow third parties to use your data for their own marketing purposes without your consent. In all cases of sharing, the principle of data minimization is applied.

8. International Data Transfer

As a global service, your data may be transferred across borders. In such transfers, we use legal protection mechanisms such as Standard Contractual Clauses (SCCs) to ensure the security of your data in accordance with regulations like GDPR and KVKK. The protection measures specified in this policy apply equally when your data is stored in another country.

9. User Rights

Under GDPR and KVKK, you have rights such as Access, Rectification, Erasure (Right to be Forgotten), Objection, Data Portability, Withdrawal of Consent, and the right to lodge a Complaint with competent authorities. You can contact us to exercise these rights. Your requests will be answered free of charge within the legal timeframes.

10. Policy Updates and Contact

This Privacy Policy may be updated due to changes in legal regulations or our services. Significant changes will be notified to you. For questions about our privacy practices, you can contact us at enesdeveci@vitonella.com or through the in-app support section. Data Controller: Vitonella, Erzurum, Eceabat St. No:10/6 Ankara/Turkey.