Privacy Policy

Updated: October 17, 2026 · Version: 1.0

Article 1. Purpose, scope, and service provider

1.1. This Privacy Policy describes the principles regarding the processing, access, storage, and protection of account information and user content on the İthera platform operated by Biostat Sağlık Hizmetleri Limited Şirketi (“BİOSTAT”). The address of BİOSTAT is Atalar Mahallesi Yayla Sokak No:13/10 Kartal İstanbul.

1.2. This policy covers service processes concerning visitors, individual users, organization members, and share recipients. The legal grounds for personal data and the rights of the data subject are regulated separately in the KVKK Clarification Text. This document is not an explicit consent form.

Article 2. Categories of information and methods of collection

2.1. Account creation and management involve processing name, email, verification, and session information; and if added by the user, profile pictures and preferences. Organization operations include membership, role, invitation, domain name, and usage limit information; credit operations include balance and transaction records.

2.2. Voice recordings, uploaded files, templates, notes, documents, messages, and their associated information constitute user content. Depending on the feature used, text-transcribed or searchable numerical representations of this content may also be created. These representations are not considered anonymous solely because they are numerical.

2.3. Data is collected through registration and profile forms, microphone recordings, file uploads, sharing and invitation processes, support correspondence, and technical access logs. The email address of an invited person can be obtained from the user who sent the invitation. Support attachments and screenshots may also contain data.

Article 3. Purposes of use and limitation by purpose

3.1. Information is processed for account operation, execution of requested voice/text operations, organization of content and presentation to authorized recipients, usage and credit management, support provision, security protection, and applicable legal obligations.

3.2. Uploading content received for the service does not create an unlimited usage license for different purposes. Disclosure of content to the public, use in advertising, or processing for any other purpose requires separate valid legal conditions. A change in purpose cannot be legitimized solely by amending this policy.

3.3. Data controller/data processor roles may differ regarding account and service security operations versus third-party content uploaded by the customer for their own purposes. Roles are determined based on the actual purpose of the process and decision-making authority. The fact that an organization pays the credit fee does not mean it is the data controller or owner of all content.

Article 4. Artificial intelligence and content sent to external services

4.1. The current application uses a Google Gemini API connection. For speech-to-text conversion, audio; for template extraction, the relevant file or text; for document preparation, the narrative and template; and for asking questions to notes, questions and relevant note fragments may be sent to an external service. Processes do not occur solely on the user's device.

4.2. Masking applied to certain text fields does not mean that all personal information in audio or images is removed prior to transmission. The user must scrub unnecessary information before uploading. The presence of codes or pseudonyms in content does not ensure anonymity if re-identification is possible.

4.3. Artificial intelligence calls, model training, and the provider's security logs are separate processes. The scope of these processes is determined by the provider's terms of service; BİOSTAT does not make any commitment that the provider will not store data or use it for training under any circumstances.

4.4. The artificial intelligence service is provided within the framework of Google's relevant API terms of service, and sent data may be processed abroad. Information regarding transfers can be found in Article 6 of the KVKK Clarification Text.

Article 5. Access, sharing, and organization management

5.1. Access to content depends on the scope of the account and the selected sharing permissions. An organization manager, solely in that capacity, cannot see members' personal notes and documents. Access to membership and credit management data and access to content are separate permissions. A user sharing directly with the manager is a different access relationship than this rule.

5.2. Invitations, messages, and notifications may transmit contact information, content titles, or relevant notification text to the recipient. Before sharing, the recipient and the scope of permission should be checked. Disabling sharing does not delete previously downloaded or copied data from the recipient's device.

5.3. Data required for functions such as hosting, artificial intelligence, and message delivery may be processed by relevant service providers. Access required for support, security, or legal proceedings within BİOSTAT is limited to the purpose and task. No absolute commitment excluding technical operation, such as “only the user can access,” is provided.

5.4. Disclosures required for lawful requests by competent authorities and for the protection of rights are made by evaluating the legal basis and the scope of the request. This provision does not allow for the general or continuous sharing of all content.

Article 6. Temporary audio copy kept on device

6.1. To reduce recording loss, audio fragments are written to the IndexedDB area on the device when supported by the browser. This copy is not a recording uploaded to the server or an external backup. Access is limited to the relevant account and recording context in the application; the security of a shared device is also important.

6.2. In the current mechanism, the recovery period is 24 hours from the creation of the recording. Expired recordings are cleared the next time the application checks the recovery list. It is not guaranteed that physical deletion will occur at exactly the 24th hour while the application is closed.

6.3. The relevant local copy is cleared upon verification of successful transfer to the server or upon the user deleting the recording. Explicitly logging out triggers the deletion of the local recovery database; browser constraints may affect the process. Session expiration does not trigger the same process. Clearing site data from the browser may also remove recovery copies.

6.4. The recovery feature cannot restore unsaved audio, data deleted by the device, or unsupported storage. It is not guaranteed that the entire recording will be preserved or that recording will be uninterrupted in the background.

Article 7. Server storage, archive, and deletion

7.1. Active notes, documents, and templates are kept in the account for service purposes. Moving to the archive is not a deletion process. Account closure and permanent deletion requests are fulfilled by evaluating the relevant content and any legal retention requirements together.

7.2. In the current application, the 'My Notes' audio file is removed from active application storage once the text is successfully generated. When updating a note with voice, the audio is also removed after success. Failure of the process does not mean the same deletion path is executed; draft and error logs are subject to their own duration and cleanup conditions.

7.3. For document records, cleanup is based on 24 hours after creation; for expired drafts, cleanup depends on the expiration time. The task is scheduled to run hourly. Therefore, the threshold does not mean all copies are deleted at that exact moment. There is an additional cleanup check for orphaned files older than two days in the application's report audio directory.

7.4. Notes and documents in the trash are subject to permanent deletion after a 30-day threshold. Permanent deletion operations previously performed by the user are applied separately. The scope of records associated with deleted resources is evaluated according to the nature of the relevant transaction.

7.5. These periods describe the operating rules of the application. Backups, technical logs, and provider copies are stored and deleted according to their own cycles; there is no commitment to instant deletion or a fixed period for these. This situation does not grant the authority for indefinite storage.

7.6. Records that must be kept due to legal obligations or concrete disputes are stored limited to the relevant purpose and duration. The necessity of keeping a payment record does not automatically require all voice and document content to be kept for the same duration.

Article 8. Security and breach management

8.1. BİOSTAT is obliged to take technical and administrative measures appropriate to the nature of the processed data and the risks. Account verification, session management, and access controls are among the tools used in this context. A definitive certificate, level of uninterrupted service, end-to-end encryption, or commitment to store only in Turkey is not provided with this text.

8.2. Notifications of suspicious access or data loss can be sent with the time of the event, the affected account, and a brief description. Password, full card information, or content not necessary for investigation should not be shared in the application. Investigation of the event, limiting the impacts, and necessary notifications are handled according to the rules in force.

Article 9. Cookies, external links, and communication

9.1. Cookies and similar device storage are described in the Cookie Policy. Not allowing preference cookies does not stop all mandatory account and security operations. Service notifications and marketing messages are evaluated separately.

9.2. When navigating to another service via an external link, the practices of that relevant service should also be considered. Providing a link does not automatically grant permission for personal data sharing or eliminate BİOSTAT’s own responsibility for transfer.

Article 10. Applications and policy changes

10.1. The scope and procedure of applications regarding personal data are contained in the KVKK Clarification Text. Contact address: BİOSTAT — Atalar Mahallesi Yayla Sokak No:13/10 Kartal İstanbul; email: info@itheralab.com.

10.2. Policy changes are published with date and version information. Necessary clarifications and legal requirements regarding new purposes or recipients are fulfilled separately. The user re-entering the site is not considered acceptance of every change requiring explicit consent.