KVKK Privacy Notice

1. Data Controller

This privacy notice has been prepared by Moserra Software in its capacity as data controller, pursuant to Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK) and Article 4 of the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform.

Klinipa is a brand operated within Moserra Software. You may reach the data controller at [email protected] or by telephone at +90 850 340 0880. Other information relating to the identity of the data controller is set out in the Service Provider Information section at the bottom of this page.

2. Scope of This Notice

This notice concerns only visitors to klinipa.com: clinic owners, physicians, hospital officials and other corporate counterparts who view the site, contact us via WhatsApp, Telegram, e-mail or telephone, or request an offer or demo.

This notice does not concern patient data. In respect of the personal data of the patients of a clinic using the Klinipa service, the data controller is the relevant clinic, and Moserra Software is merely the data processor acting on behalf of and in line with the instructions of the clinic; the essentials of this relationship are regulated in the agreement and its annexes concluded with the clinic.

3. Categories of Personal Data Processed

There is a lead form on the site. When you fill in this form, you submit to us your name, your telephone number, the service you are interested in and, if any, the note you add; this information is forwarded to our team as a notification via Telegram. Apart from this, the call buttons direct you to the WhatsApp, Telegram, e-mail or telephone channels. Your identity and contact data are processed only when you fill in the form of your own free will or reach us through these channels, and only to the extent that you choose to share.

• Identity data: the first and last name you provide during contact.
• Contact data: your telephone number, e-mail address, WhatsApp or Telegram user information.
• Professional and corporate data: the name of the clinic, hospital or institution you represent, your title, and your declarations regarding its field and size of activity.
• Request and correspondence content: the content of the messages you send us, your offer and demo requests, and the correspondence history relating to these requests.
• Transaction security and traffic data: IP address, date and time of visit, pages viewed, the source referring to the site, device, operating system and browser information, approximate location information (at country or city level) and cookie identifiers.

The advertising budget calculator on the site runs only in your browser; the values you enter are not transmitted to us and are not recorded. No special categories of personal data are collected via the site; we kindly ask you not to share data of this nature.

4. Purposes of Processing and Legal Grounds

Your personal data is processed for the purposes shown in the table below and on the basis of the KVKK Article 5 legal grounds specified opposite them.

5. Cookies and Measurement Tools

5.1. Mandatory and functional cookies

The site uses a cookie named NEXT_LOCALE to remember your language preference. This cookie is necessary for the site to operate, is not used for advertising or profiling purposes, and is not transferred to third parties.

5.2. Measurement and advertising cookies

The following tools may be used on the site. Each of these tools is run only if the relevant measurement ID is configured and you have given explicit consent; otherwise the relevant script is not loaded on the site at all.

• Google Analytics 4 and Google Tag Manager (Google Ireland Limited / Google LLC): measuring visit statistics and tag management.
• Meta Conversions API (Meta Platforms Ireland Limited): server-side measurement of the performance of Facebook and Instagram advertisements and remarketing. No pixel script is loaded into the browser; for matching, the _fbp and _fbc cookies are created only after explicit consent.
• Yandex Metrica (Yandex): measuring visit statistics.
• VK Pixel (VK): measuring advertising performance and remarketing.

Which tools run varies according to the language version you visit: Meta Pixel is used on the Turkish and English versions, and Yandex Metrica and VK Pixel on the Russian and Uzbek versions. The Google tools can be configured independently of the language version. For detailed information about cookies, you may review our Cookie Policy text and may at any time delete or block cookies via your browser settings.

6. Method of Collection of Personal Data

Your personal data is collected directly from you when you fill in the lead form on the site of your own free will or contact us through the WhatsApp, Telegram, e-mail or telephone channels; and your traffic and cookie data is collected automatically via your browser during your visit to the site. The data is processed by fully or partially automated means within the meaning of KVKK Article 3, and by non-automated means provided that it forms part of a data recording system. No solely automated decision-making or profiling activity that produces legal consequences concerning you or significantly affects you is carried out on the site.

7. Transfer of Personal Data

7.1. Domestic transfer (KVKK Art. 8)

Your personal data may, limited to the purposes listed above and in the presence of the legal grounds specified in Article 5, be transferred to our suppliers from whom we receive hosting, infrastructure and information technology services, to our financial advisor and lawyers, and, upon request, to competent public institutions and organisations and judicial authorities.

7.2. Transfer abroad (KVKK Art. 9)

Since the servers of the communication and measurement tools we use may be located outside Türkiye, transfer abroad takes place in the following cases:

• Communication channels: when you correspond with us via WhatsApp and Telegram, the message content and your contact information are carried over the servers of these platforms. Using these channels is entirely your choice; if you wish, you may prefer e-mail or telephone.
• Measurement and advertising providers: Google, Meta, Yandex and VK may process the data they collect on their servers abroad.
• Hosting and infrastructure providers: transfer may occur depending on the country in which the infrastructure on which the site is published is located.

Article 9 of Law No. 6698 was re-regulated by Law No. 7499 dated 12 March 2024. Within this framework, transfer abroad:

1. Is carried out in compliance with the conditions in Articles 5 and 6, in the event that an adequacy decision has been issued by the Personal Data Protection Board regarding the relevant country, sector or international organisation.
2. In the absence of an adequacy decision, is carried out by providing one of the appropriate safeguards, provided that one of the conditions in Article 5/2 or Article 6/3 is present and that the data subject has the possibility to exercise its rights and to resort to effective legal remedies in the country to which the transfer will be made: an agreement between public institutions and organisations abroad, binding corporate rules, a standard contract announced by the Board, or a written undertaking with the Board's permission. When a standard contract is used, notification is made to the Board within five business days from the date of signature.
3. In incidental cases where there is no adequacy decision and no appropriate safeguards, transfer may be made, pursuant to Article 9/6, only on the basis of your explicit consent given upon your being informed about the risks in the country to which the transfer will be made, or in the limited cases listed in the article such as the performance of a contract, an overriding public interest, the establishment of a right or the protection of vital interests.

In respect of non-mandatory cookies, transfer abroad is based on your explicit consent; if you do not give consent, the relevant tools are not run and no transfer takes place within this scope.

8. Retention Period and Destruction

• Data relating to contact and offer requests for which no contract is concluded is retained for a maximum of 2 years from the last contact.
• In the event that a contract is concluded, the data is retained for 10 years from the termination of the contractual relationship, taking the limitation periods into account.
• Documents within the scope of tax and commercial legislation are retained for the period stipulated by the relevant legislation (as a rule, 10 years).
• Data obtained from cookies is retained within the framework of the life of the relevant cookie and the retention policy of the measurement tool used; if you withdraw your consent, prospective data collection stops.

Upon the expiry of the periods or the disappearance of the grounds for processing, your personal data is deleted, destroyed or anonymised, ex officio or upon your request, pursuant to KVKK Article 7 and the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.

9. Rights of the Data Subject (KVKK Art. 11)

As the data subject whose personal data is processed, pursuant to Article 11 of the Law, you are entitled to:

1. Learn whether your personal data is processed,
2. Request information if your personal data has been processed,
3. Learn the purpose of the processing of your personal data and whether it is used in accordance with its purpose,
4. Know the third parties to whom your personal data is transferred at home or abroad,
5. Request the correction of your personal data in the event that it has been processed incompletely or incorrectly,
6. Request the deletion or destruction of your personal data within the framework of the conditions stipulated in Article 7 of the Law,
7. Request that the operations carried out pursuant to your correction, deletion and destruction requests be notified to the third parties to whom your personal data has been transferred,
8. Object to a result arising against you through the analysis of your processed data solely by automated systems,
9. Request the compensation of the damage in the event that you suffer damage due to the unlawful processing of your personal data.

These rights are yours.

10. Application Procedure (KVKK Art. 13)

You may communicate your requests relating to the rights above by one of the following means, pursuant to the Communiqué on the Procedures and Principles of Application to the Data Controller:

• By sending your wet-signed petition to the address of the data controller in person or via a notary,
• By sending an e-mail signed with your secure electronic signature or mobile signature to [email protected],
• By writing to [email protected] using the electronic mail address you previously notified to us and which is registered in our system.

The data controller does not yet have a registered electronic mail (KEP) address; when a KEP address is obtained and announced in this text, you will also be able to communicate your applications with a secure electronic signature via this channel.

Your application must contain your first name, last name and, if the application is written, your signature; your Turkish Republic identity number if you are a citizen of the Republic of Türkiye, otherwise your nationality and passport number; your place of residence or business address for service of notice; your electronic mail address for notification, if any, and your telephone number; and the subject of your request. Information and documents relating to the matter must be attached to the application.

Your request is concluded free of charge as soon as possible and in any event within 30 days at the latest, according to its nature. In the event that the transaction additionally requires a cost, the fee in the tariff determined by the Board may be charged. In the event that your application is rejected, you find the response given insufficient, or no response is given within the period; you may file a complaint with the Personal Data Protection Board within 30 days from the date on which you learn the response and in any event within 60 days from the application date. Before resorting to a complaint to the Board, application to the data controller is mandatory.

11. Visitors Located in the European Union (GDPR)

Since our site can also be visited from the European Union, the following points apply in respect of visitors falling within the scope of the EU General Data Protection Regulation (GDPR).

• Legal basis: meeting your contact request and pre-contractual negotiations fall within GDPR Article 6/1-b (contract or pre-contractual request), keeping records and ensuring security within Article 6/1-f (legitimate interest), and non-mandatory cookies and measurement and advertising tools within Article 6/1-a (consent).
• Your rights: you have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection to processing based on legitimate interest and to direct marketing (Art. 21), and withdrawal of your consent at any time (Art. 7/3). The withdrawal of consent does not affect the lawfulness of the processing carried out up to the moment of withdrawal.
• Transfer to a third country: your data may be transferred to Türkiye and to the other countries in which our service providers are located. These transfers are made on the basis of appropriate safeguards such as the standard contractual clauses under GDPR Article 46, or the derogations under Article 49 (performance of a contract, explicit consent).
• Complaint: your right to file a complaint with the data protection supervisory authority in the member state in which you are located is reserved.

You may also communicate your requests within the scope of GDPR to [email protected].

12. Updating of the Text

This privacy notice may be updated in line with changes in legislation and changes in the tools and processes used on the site. The current text is always published on this page and the effective date at the top of the page is taken as the basis.