Special Categories of Personal Data Policy

Article 2 — Scope

This policy covers the special category personal data processing activities carried out by the Company by fully or partly automated means, or by non-automated means provided that they form part of a data filing system. Oralenta is a wellness application and does not qualify as medical device software.

Article 3 — Definitions

The terms used in this policy have the meanings defined in Article 3 of Law No. 6698.

Article 4 — Special Category Personal Data Processed

The following data is processed: intraoral images (from five different angles, compressed on the device and uploaded to encrypted storage), AI assessment summaries (raw output is not shown to the user), dental chart data, oral health behaviour data (brushing statistics, toothbrush replacement information), appointment and treatment data, and the health data of family members.

Article 5 — Legal Basis and Explicit Consent

Special category personal data is processed on the basis of the explicit consent of the data subject under Article 6/2 of the Law. Consent is obtained in two separate scopes, each with its own consent mechanism:

— Explicit consent to health data processing: Presented separately for each family member, per profile. If the user does not give this consent, features that require health data (dental assessment, AI assessment, dental chart) cannot be used; access to the other functions of the application that do not require consent continues.

— Explicit consent to model development: Concerns the use of anonymised images in training the AI model and is entirely optional. If it is not given, no function of the application is restricted.

Both explicit consents are given freely and can never be made mandatory. Consent can be withdrawn at any time. A clickable link to the relevant explicit consent text must be placed next to each consent checkbox.

Consent records are versioned (v1.0), and the IP address and user-agent information at the time of the request are added automatically on the server side by a database trigger.

Article 6 — Information Notice

Before health data processing begins, the data subject must be informed through a separate health data privacy notice under Article 10 of the Law. The privacy notice must be accessible within the application as a clickable link next to each consent checkbox. Explicit consent obtained without prior information may be deemed invalid under Board decisions.

Article 7 — Environments Where Data Is Stored

Photos are stored in a private bucket, and access is provided through signed URLs valid for at most one hour. Database records are protected by row-level security (RLS). The database and file storage infrastructure is hosted on the Company's own servers located in Türkiye.

Article 8 — Transfer of Data Abroad

Data is transferred abroad through the Firebase Cloud Messaging and Google Sign-In services; since the database and file storage infrastructure is located in Türkiye, no transfer abroad takes place for hosting purposes. Transfers are carried out on the basis of explicit consent under Article 9/1 of the Law. Since the AI models (photo assessment and the language model of the AI assistant) run on the Company's own servers located in Türkiye, no data is transferred to an external AI service or abroad for AI processing.

Article 9 — Technical and Administrative Measures

9.1. Current Technical Measures

Photos are kept in encrypted, private storage. Row-level security (RLS) is active on all database tables and verified by 42 automated tests. Raw AI output is not exposed to the client. The privileged server key is held only on the backend. Push notifications contain no personal data. Personal data and images are not written to log systems. Privileged operations and account deletion are recorded in the audit log. A password policy is enforced (at least 8 characters, upper and lower case letters and a digit).

9.2. Additional Measures To Be Implemented

Access to special category personal data must be restricted to a limited number of staff. Security updates for the environments holding the data must be monitored continuously, security tests must be performed or commissioned regularly, and the results must be recorded. All staff processing special category personal data must receive KVKK awareness training. A written data breach response plan must be prepared and kept up to date.

Article 10 — Data Retention and Destruction

When an account is deleted, all photos in storage are first deleted on the server side and the storage is verified to be empty, after which the account is removed. If the clean-up fails, the account is not deleted, preventing orphaned data. In the consent evidence archive, the identity link is kept as an HMAC-SHA256 hash of the email address; no raw personal data is stored in the archive. The retention period is 10 years (general limitation period under the Turkish Code of Obligations), and expired records are cleaned up automatically. The periodic destruction interval is at most six months.

Article 11 — Data Breach Notification

If a breach concerning special category personal data is detected, the Board is notified as soon as possible and in any case within 72 hours under Article 12/5 of the Law. The data subjects concerned are also informed as soon as possible.

Article 12 — Entry into Force

This policy enters into force on the date it is approved by Company management and is updated as necessary.