Privacy Policy

2. Nature of the Application

Important Notice: Oralenta is a wellness application that helps families track their oral and dental health habits. The Application is not software as a medical device (SaMD).

The AI-assisted assessments offered within the Application are for information only; they do not constitute a medical diagnosis or treatment and do not replace an examination by a dentist. Always consult a healthcare professional for decisions about your health.

3. Personal Data Processed

The following categories of personal data are processed through the Application:

• Identity Data (General): First name, last name, date of birth, family relationship and gender (gender in child profiles only)
• Contact Data (General): Email address, phone number
• Account Security Data (General): Password (in encrypted form), Google account verification details (optional), session information
• Health Data (Special Category, Art. 6): Intraoral photos (five angles), AI assessment summaries, dental chart data, brushing habits and statistics, appointment and treatment details
• Data of Family Members (including Special Category): Identity and health data of the individuals in family profiles
• Transaction Security Data (General): Device information, app version, push notification token, IP address and device information at the time explicit consent is recorded

The Application does not use any analytics or advertising software development kit (SDK). Your personal data and images are not processed for advertising or profiling purposes and are not sold or rented to third parties for marketing purposes.

4. Data Relating to Children

The Application allows the identity and health data of children to be processed through family profiles created by a parent or legal guardian. Data in child profiles is entered and managed only by the parent/guardian who created the account and under their responsibility.

Processing of a child's health data is based on the explicit consent the parent/guardian gives separately for the relevant profile. The parent/guardian may view, correct and delete the child's profile and data at any time through the Application. Our Company carries out no profiling, advertising or marketing activity directed at children.

5. Purposes of Processing

Your personal data is processed for the following purposes:

• Managing membership processes and identity verification,
• Providing the AI-assisted preliminary oral and dental health assessment (not a medical diagnosis),
• Creating and updating the dental chart,
• Tracking the oral care routine and providing brushing guidance,
• Creating and managing family profiles,
• Appointment planning and sending reminder notifications,
• Fulfilling the data subject's requests to access, download and delete their own data (Article 11 of the Law),
• Additionally, where explicit consent exists, developing the AI model with anonymised images,
• Additionally, where explicit consent exists, sending informational messages,
• Improving the technical performance and security of the Application,
• Fulfilling legal obligations.

6. Legal Grounds and Explicit Consent

Your personal data is processed on the following legal grounds:

• Membership, identity verification and core application functions: KVKK Art. 5/2-c — Establishment or performance of a contract
• Access to own data and request processes: KVKK Art. 5/2-e — Establishment, exercise or protection of a right
• Technical security and performance improvement: KVKK Art. 5/2-f — Legitimate interest
• Processing of health data: KVKK Art. 6/2 — Explicit consent
• AI model development (with anonymised data): KVKK Art. 5/1 — Explicit consent
• Informational messages: KVKK Art. 5/1 — Explicit consent
• Transfer of data abroad: KVKK Art. 9 — Explicit consent

Your health data is processed solely on the basis of your explicit consent. Explicit consent is obtained separately for each family member, per profile. Consent to model development and consent to informational messages are entirely optional and are given separately. Explicit consent is given freely and can never be made mandatory; if health data consent is not given, only the related features (dental assessment, AI assessment, dental chart) become unavailable, and access to the other functions of the Application continues. If consent to model development is not given, no function of the Application is restricted.

You may withdraw your explicit consents at any time from the "My Consents" section of the Application. Withdrawal does not affect the lawfulness of processing carried out before the date of withdrawal.

7. Device Permissions

To perform its functions, the Application may request the following permissions on your device. Permissions are used only while the related function is in use and only for its purpose.

• Camera: Taking intraoral photos
• Notifications: Appointment reminders and informational messages (separate explicit consent is obtained for informational messages)
• Internet access: Secure data communication with the Application infrastructure

You may manage or revoke device permissions at any time from your device settings. If camera permission is not granted, features that require photos cannot be used.

8. Method of Collection

Your personal data is collected, by fully or partly automated means, through information you enter directly, photos taken with the device camera, information obtained automatically from your Google account if you choose to sign in with Google, data generated while you use the Application (brushing statistics, assessment history), and technical data collected automatically from your device.

9. Third-Party Services Used and Transfers Abroad

The Application's database and file storage infrastructure (account data, intraoral photos and health records; in encrypted, private storage) is hosted on the Company's own servers located in Türkiye; this data is not transferred abroad for hosting purposes.

The following third-party infrastructure services are also used for the Application to operate. Through these services, certain data may be transferred to servers located abroad. Transfers abroad are carried out on the basis of your explicit consent under Article 9 of the Law and over encrypted connections (TLS).

• Google Firebase Cloud Messaging — Push notification delivery: Device notification identifier (token); notification content carries no personal data
• Google Sign-In — Optional account sign-in: Google account verification details (only if this sign-in method is chosen)

The AI models used for photo assessment and the language model of the AI assistant run on the Company's own servers located in Türkiye; in this context, data is not transferred to an external AI service or abroad. Your identity information is not sent to the models; for photo assessment, only the image being assessed and the assessment identifier are processed. Where legally required, your data may be transferred to authorised public institutions and organisations.

10. Data Security

The main technical measures we apply for the security of your data:

• Intraoral photos are stored in encrypted, private storage and cannot be accessed through public links.
• Access to images is provided only through signed links valid for at most one hour, and every access is logged.
• Row-level security (RLS) is applied in the database; as a rule other users cannot access your personal health data; within the Company, only authorised personnel can access it within the scope of their duties.
• During the AI assessment your identity information is not processed together with the images; raw AI output is not shown, only an edited summary is presented.
• Personal data and images are not written to log systems.
• The privileged server key is held only on the server side; privileged operations and account deletion are recorded in the audit log.
• A password policy is enforced (at least eight characters, including upper and lower case letters and a digit).

11. Retention Period and Deletion of Data

Your personal data is retained for as long as the purposes of processing require and within the periods provided for in the relevant legislation. When you delete your account, all of your photos in storage are first deleted on the server side and the storage is verified to be empty; your account and all associated health data (assessment results, dental chart, appointments) are then permanently deleted in a cascading manner. If the deletion fails, the account is not removed, preventing orphaned data.

Explicit consent records are kept in versioned form to meet the burden of proof. In the consent evidence archive, the identity link is stored only as a one-way encrypted (HMAC-SHA256) form of the email address; no raw personal data is kept in the archive. The retention period for these records is ten (10) years (general limitation period under the Turkish Code of Obligations), and expired records are cleaned up automatically. The periodic destruction interval is at most six months.

12. Your Rights and Applications

Under Article 11 of the Law you have the following rights:

• To learn whether your personal data is processed,
• To request information if it has been processed,
• To learn the purpose of processing and whether the data is used in accordance with that purpose,
• To know the third parties, in Türkiye or abroad, to whom your personal data is transferred,
• To request correction if your personal data is incomplete or inaccurate,
• To request deletion or destruction of your personal data under the conditions set out in Article 7 of the Law,
• To request that correction, deletion and destruction be notified to the third parties to whom the data was transferred,
• To object to a result against you produced by analysis of the processed data exclusively through automated systems,
• To claim compensation for damages suffered due to unlawful processing of your personal data.

Some of these rights can be exercised directly within the Application: the "Download My Data", "Delete My Account" and "My Consents" functions in the Settings section are provided for this purpose. You may also submit your requests by email to info@ungmedical.com or by registered electronic mail (KEP) to ung@hs01.kep.tr. Requests are concluded free of charge as soon as possible depending on their nature, and in any case within thirty (30) days at the latest.

13. Changes to the Policy

This Privacy Policy may be amended in line with changes in legislation and updates to the functions of the Application. The current text is always available within the Application and at www.ungteknoloji.com. Significant changes are announced within the Application. The effective date is the date on which the text is published.