Privacy Policy & KVKK Notice

Your personal data processed through the ReachMyDoctor platform ("Platform") is controlled under the Turkish Personal Data Protection Law No. 6698 ("KVKK") by: Data Controller: ReachMyDoctor Contact: support@reachmydoctor.com

The following categories of personal data are processed through the Platform: Identity & Contact: Name, surname, email address. Health Data: Messages, files (images, documents, etc.), and medical notes shared with your doctor — these constitute special category personal data and are processed based on your explicit consent. Authentication Data: Encrypted password, session tokens. Subscription & Payment Data: Subscription plan and payment status; sensitive card data is handled exclusively by Iyzico and is never stored on the Platform. Technical Data: IP address, browser type, session logs.

Your personal data is processed for the following purposes: • Providing secure patient-doctor messaging services • Subscription management and billing • Ensuring platform security and preventing fraud • Fulfilling legal obligations • Responding to support requests • Technical troubleshooting and service improvement

Your data is processed on the following legal grounds: • KVKK Art. 5(2)(c) — Necessary for the performance of a contract (service delivery) • KVKK Art. 5(2)(ç) — Compliance with a legal obligation • KVKK Art. 5(1) & 6(2) — Explicit consent for health data • KVKK Art. 5(2)(f) — Legitimate interest (platform security)

Personal data is retained for the period necessary for the processing purpose and legal obligations: Messages and files: While account is active + 30 days after account deletion Subscription/payment records: 10 years (Turkish Commercial Code) Session and technical logs: 1 year Support records: 3 years Upon expiry, data is irreversibly deleted or anonymised.

Your personal data may be shared with the following third parties for infrastructure and service purposes: • Neon (database hosting, EU — Frankfurt) • Cloudflare R2 (file storage, EU region) • Iyzico (payment infrastructure, Turkey) • Resend (transactional email) • Upstash Redis (rate limiting, ephemeral data) Transfers are made in accordance with KVKK Articles 8 and 9. International transfers are made to countries with adequate protection or on the basis of explicit consent.

Under Article 11 of KVKK, you have the right to: a) Learn whether your personal data is being processed b) Request information if it has been processed c) Learn the purpose of processing and whether it is used accordingly d) Know the third parties to whom data is transferred domestically or abroad e) Request correction of incomplete or inaccurate data f) Request deletion or destruction under KVKK Article 7 g) Request notification of corrections/deletions to third parties data was transferred to h) Object to a result arising against you through automated data analysis i) Claim compensation for damages caused by unlawful processing You can download your data as JSON or permanently delete your account from Settings > My Data & KVKK.

To exercise your rights under KVKK: • Email: support@reachmydoctor.com (subject: "KVKK Request") • In-app: Account > Support Requests will be responded to within 30 days. Please contact us from the email address registered to your account for identity verification. You also have the right to file a complaint with the Personal Data Protection Authority (KVKK): www.kvkk.gov.tr

The Platform uses only strictly necessary cookies for session management. No third-party analytics, advertising, or profiling cookies are used. You may disable cookies in your browser settings; some services may be limited as a result.

Your data is protected by: HTTPS/TLS encrypted transmission, AES-256 encrypted storage for sensitive fields (e.g. national ID), bcrypt password hashing, and role-based access control. If you discover a security vulnerability, please report it to support@reachmydoctor.com.

This policy may be updated from time to time. For significant changes, a notification will be sent to your registered email address. The current version is always available on this page.