KVKK Privacy Notice

2. Personal Data Processed

a) Identity Data: First name, last name, date of birth, family relationship, gender (child profiles only).

b) Contact Data: Email address, phone number.

c) Account Security Data: Password (in encrypted form), Google account verification details, session information.

d) Health Data (Special Category — Article 6 of the Law): Intraoral photos (five angles), AI assessment summaries, dental chart data, brushing habits and statistics, appointment details.

e) Data of Family Members: Identity and health data of the individuals in family profiles.

f) Transaction Security Data: Device information, app version, push notification token, IP address and device information at the time a consent record is created.

3. Purposes of Processing

Membership processes and identity verification; AI-assisted preliminary oral health assessment (not a medical diagnosis); creating the dental chart; tracking the oral care routine and brushing guidance; managing family profiles; appointment planning and reminders; preparing your personal data file (Article 11 of the Law); developing the AI model (based on explicit consent, using anonymised data); informational messages (based on explicit consent); improving technical performance; fulfilling legal obligations.

4. Legal Grounds

Establishment or performance of a contract (Art. 5/2-c); establishment or protection of a right (Art. 5/2-e); legitimate interest (Art. 5/2-f); explicit consent (Art. 5/1, Art. 6/2). Health data is processed solely on the basis of your explicit consent. Explicit consent is given freely and can never be made mandatory; if it is not given, only the related features become unavailable.

5. Method of Collection

Data is collected through information you enter directly, photos taken with the device camera, information obtained automatically from your Google account, data generated while you use the Application, and technical data collected automatically from your device.

6. Transfer of Data

Data may be transferred to authorised public institutions where legally required. The Application's database and file storage infrastructure is hosted on the Company's own servers located in Türkiye. The Application infrastructure also uses Google Firebase Cloud Messaging and Google Sign-In (optional). In this context certain data is transferred to servers located abroad; such transfers are carried out on the basis of your explicit consent under Article 9 of the Law and over encrypted connections.

7. Retention Period

Data is retained for as long as the purposes of processing require. When an account is deleted, all data is permanently deleted in a cascading manner. In the consent evidence archive, only a one-way encrypted form of the email address is kept for the limitation periods set out in legislation.

8. Data Security

Photos are stored in encrypted, private storage and cannot be accessed through public links. During the AI assessment, identity information is not processed together with the images. Other users cannot access your personal health data; within the Company, only authorised personnel can access it within the scope of their duties. No analytics or advertising SDK is used, and personal data and images are never written to log systems.

9. Rights of the Data Subject

Under Article 11 of the Law you have the right to learn whether your personal data is processed, to request information, to learn the purpose of processing, to know the third parties to whom data is transferred, to request correction, to request deletion, to request that these actions be notified to third parties, to object to a result produced by automated analysis, and to claim compensation for damages.

You can submit your requests from within the Application (Download My Data, Delete My Account, My Consents) or by email to info@ungmedical.com.