1. Data location
The database, authentication, application and medical image/document files are hosted on our own servers located in Türkiye are kept on our servers. Encrypted backups are also held in Türkiye, with a different provider, in immutable (WORM) form. Voice-dictation audio is sent, encrypted, to a speech-recognition service hosted abroad for transcription; the recording is not kept. For details of cross-border transfers, including AI features, support conversations and transactional e-mail, see the KVKK Privacy Notice.
2. Encryption
- In transit: all traffic is encrypted with TLS (HTTPS).
- At rest: data and backups are encrypted at the infrastructure layer with AES-256 encryption.
- Passwords are hashed irreversibly; they are never stored as plain text.
3. Role-based access
After e-mail + password authentication, access is limited by role-based permissions (doctor / assistant / receptionist). The rules are enforced at the database level with row-level security (RLS), so unauthorized access is blocked even if the application has a bug.
4. Tenant isolation
In our multi-tenant architecture every clinic can reach only its own data (one clinic’s data is fully isolated from every other clinic at the database level).
5. Audit log
Changes to clinic records (create, update, delete), exports and patient file accesses are written to an immutable audit log (who viewed or changed which patient/record, and when, is traceable; entries are append-only and can never be deleted or altered).
6. Backup and retention
- On managed infrastructure, data is backed up automatically and encrypted.
- Clinic administrators can export patient data from the panel in a portable format (JSON) or delete it permanently.
- If the account is closed, data is deleted or anonymized in line with applicable legislation and retention periods.