Privacy Policy

1. Introduction

Vitonella is a digital health platform that provides users with personalized recommendations based on their medication use, nutrition, and exercise data. We place the highest importance on the privacy and security of your personal data. This privacy policy explains what data we collect, how we use it, and how we protect it in accordance with globally applicable regulations such as the EU General Data Protection Regulation (GDPR), the Turkish Personal Data Protection Law (KVKK), and the U.S. Health Insurance Portability and Accountability Act (HIPAA). Both GDPR and HIPAA are among the strictest privacy and security frameworks worldwide, sharing the common goal of protecting sensitive information. The principles outlined in this policy apply to all our users and describe our practices for the data you share by using our platform.

2. Data We Collect

When you use Vitonella, we collect personal data in various categories to provide you with better service:

All collected data is obtained with your consent and within the framework of the Information Notice presented to you, to serve the specified purposes. This policy will be updated, and necessary information will be provided if different data types are collected for new features that may be introduced in the future.

• Identity and Contact Data: Information that can identify you, such as your name, surname, email address, and phone number.
• Profile and Account Data: Registration information like your account username, password, as well as your preferences, settings, and other information you share in your profile.
• Health and Lifestyle Data: The core health data of the platform. For example, the medications you use, your medical history or diagnoses, allergies, dietary information (daily calorie intake, meal contents, etc.), exercise and activities (step count, exercise duration, heart rate measurements), and similar lifestyle data. This data is considered special category personal data (health information) under GDPR and KVKK and is handled with sensitivity.
• Device and Technical Data: Technical data collected when you use our app or website; for example, your IP address, device type, operating system and browser information, and navigation data collected via cookies. Additionally, log records and error reports related to your use of the Vitonella app are included.
• Sensor and Integration Data: Data from devices or services you integrate with our app. For instance, data such as step count, heart rate, sleep patterns from your smartphone's health app or wearable devices (smartwatch, fitness tracker, etc.) can be transferred to our platform if you choose to use these integrations.
• Data from Third-Party Sources: With your permission, additional health data or related data from third-party services. For example, if you connect to another health app and transfer your data from that app to Vitonella, this data will also be collected by our platform.

3. Method of Data Collection

We collect your data through various methods, enabling our platform to offer you an integrated and user-friendly experience:

Our data collection methods are transparent. Our application informs you at the time of data collection as much as possible and requests your permissions when necessary. For example, the app will ask for your consent before using your location data. By doing so, we aim to ensure that you are aware of what data you are sharing and that you remain in control.

• Direct User Input: You provide much of the data directly. For example, identity and contact information entered during registration, and health information shared while filling out your profile (your medications, diet plan, exercise routines, etc.). Any information you enter about yourself through forms, surveys, or journaling features within the app is collected under your control.
• Sensor and Device Integrations: Vitonella can integrate with your smartphone's sensors or external wearable devices. For instance, a connection can be established with your device's health app to retrieve data from sensors like a step counter, heart rate monitor, or sleep tracker. Such integrations are carried out only with your permission; health and activity data from your device is automatically collected if you grant the relevant permissions.
• Third-Party APIs: In some cases, we may pull data from other applications or third-party services at your request. For example, if you want to transfer your diet information from another health platform to your Vitonella account, your data can be retrieved through the respective platform's API (application programming interface) integration. This process is done with your explicit consent and in accordance with the privacy policies of the said third party.
• Automatically Collected Technical Data: While using Vitonella, some data is collected automatically to ensure the performance and security of the application. For instance, your navigation preferences may be stored via cookies placed on your browser when you visit our website; data such as error logs, IP address, and device information generated during your app usage are also collected in the background. Such data is generally statistical information that does not directly reveal your identity but is still handled in accordance with the terms of this policy.

4. Purpose of Data Processing

We use the collected data to perform and improve the service we offer you. Vitonella is committed to processing your data for specific, explicit, and legitimate purposes. Our main processing purposes include: AI-Powered Personalized Recommendations, Service Provision and Improvement, Communication and Support, Fulfillment of Legal Obligations, and Additional Purposes with User Consent. Vitonella adheres to the principle of purpose-limitation, processing data that is relevant, limited, and proportionate.

5. Legal Basis

We process your personal data in line with Turkish Law No. 6698 (KVKK) and, for users in the European Union, the GDPR. The legal grounds are performance of a contract for your account and the service, legal obligation for payments and records, legitimate interest for security, and your explicit consent for health data, transfers abroad and commercial messages. The table in the KVKK Privacy Notice lists which data is processed for which purpose and on which ground.

6. Data Retention Period and Security

We keep your personal data for as long as needed for the purpose and as required by law; the periods are listed in the KVKK Privacy Notice. Data is encrypted in transit, access is permission-based and access is logged.

7. Sharing Data with Third Parties

Your personal data may only be shared with service providers (data processors), business partners with your consent, and official authorities as required by legal obligations. Vitonella never sells user data and does not allow third parties to use your data for their own marketing purposes without your consent. In all cases of sharing, the principle of data minimization is applied.

8. International Data Transfer

Your data is transferred abroad: the app’s servers are in Austria (netcup GmbH), Google (USA) is used for AI analysis, and the relevant providers are used for notifications, app store payments and email. Transfers are made under Art. 9 of the KVKK; the full list of recipients and the legal basis are in the KVKK Privacy Notice.

9. User Rights

Under GDPR and KVKK, you have rights such as Access, Rectification, Erasure (Right to be Forgotten), Objection, Data Portability, Withdrawal of Consent, and the right to lodge a Complaint with competent authorities. You can contact us to exercise these rights. Your requests will be answered free of charge within the legal timeframes.

10. Policy Updates and Contact

This Privacy Policy may be updated because of changes in law or in our services; we will notify you of significant changes. Data controller: Vitonella, Erzurum Mah. Eceabat Sok. No:10/6 Çankaya/Ankara, Türkiye. Questions and KVKK requests: enesdeveci@vitonella.com.