KVKK Clarification Text
Last Updated: October 17, 2026 · Version: 1.0
Article 1. Identity of the data controller and scope
1.1. This text has been prepared by Biostat Sağlık Hizmetleri Limited Şirketi (“BİOSTAT”), which is the data controller regarding the account, communication, security, and service management processes of the İthera service, within the scope of the Personal Data Protection Law No. 6698 (“Law” or “KVKK”).
1.2. BİOSTAT's address is Atalar Mahallesi Yayla Sokak No:13/10 Kartal İstanbul, and the contact email address is info@itheralab.com. This clarification provides information regarding the processing of personal data; it is not a request for general or unlimited explicit consent.
1.3. In cases where the user uploads content concerning third parties for their own purposes, the roles of the parties as data controller and data processor are determined separately in accordance with actual purposes and instructions. BİOSTAT’s responsibility for its own processing activities, such as account management, continues. Corporate content processing relationships are subject to separate data processing agreements when necessary.
Article 2. Categories of processed data
2.1. Depending on the feature used and the relationship established, the following data are processed. It is not the case that data is collected from every user in all categories.
| Data category | Examples of related information |
|---|---|
| Identity and account | Name, surname, account ID; profile picture if added |
| Communication | Email address, contact information provided during application, invitation address |
| Account and transaction security | Verification and login information, IP and technical transaction logs |
| User content | Audio, text, uploaded files, templates, notes, documents, messages, and related transaction info |
| Organization and sharing | Membership, role, invitation, domain name, sharing recipient and permissions |
| Usage and finance | Credit movement, balance, usage limit; invoice and order info if applicable |
| Support and legal proceedings | Request, complaint, correspondence, investigation records, and necessary legal documents |
| Device preferences | Cookie preferences, allowed language and interface preferences; local audio fragments for recording recovery |
2.2. Numerical content representations created for search purposes and records associated with a pseudonym retain their nature as personal data as long as they can be linked to a person. User content may contain personal data belonging to third parties or special categories of personal data depending on the information entered.
Article 3. Purposes and legal grounds
3.1. Each processing activity is evaluated within its own purpose and conditions. The following legal grounds are not a general permission applied to all data simultaneously.
| Processing process and purpose | Related data | Legal ground |
|---|---|---|
| Establishing membership, login and operating the account | Account, communication and necessary verification data | Necessity for the establishment or performance of a contract — Art. 5/2(c) |
| Conversion, storage and sharing service requested by the user | Necessary content and transaction data belonging to the user party to the contract | Necessity for the performance of a contract — Art. 5/2(c) |
| Membership, credit and usage management | Membership, role, balance and usage records | Performance of the relevant contract — Art. 5/2(c); if there is a concrete necessity and balance of rights for non-party individuals, Art. 5/2(f) |
| Security, prevention of misuse and error investigation | Session, IP and necessary technical records | Legitimate interest that does not harm fundamental rights and freedoms — Art. 5/2(f) |
| Fulfilling support requests | Communication, request and necessary transaction info | Performance of the relevant contract — Art. 5/2(c); in case of dispute, Art. 5/2(e) |
| Accounting, legal notification and keeping mandatory records | Financial, identity and transaction data required by the obligation | According to the relevant legal regulation, Art. 5/2(a) and/or Art. 5/2(ç) |
| Establishment, exercise or protection of rights | Necessary records related to concrete disputes | Art. 5/2(e) |
| Remembering optional device preferences | Allowed preference data | Separate explicit consent — Art. 5/1 |
3.2. The basis of performance of the contract is not automatically applied to all data of third parties who are not party to the contract. The user must separately provide the appropriate legal basis and necessary notification for processing content regarding these individuals. BİOSTAT is also responsible for fulfilling the obligations required by its own role.
3.3. A legitimate interest assessment requires a balance between the purpose, necessity, and the rights of the data subject. For special categories of personal data, the applicable conditions and necessary measures in Article 6 of the Law must also be provided. Uploading by the user is not proof that the data subject has given their explicit consent.
3.4. For activities based on explicit consent, consent must be specific to the subject and informed; it can be withdrawn when necessary. Withdrawal affects subsequent processing activities where no other valid basis exists. Acceptance of membership is not a general consent for advertising, model training, or international transfer on its own.
Article 4. Collection methods
4.1. Data is obtained through automatic means such as site and application forms, microphone recording, file uploading, content editing, sharing and invitation processes, cookies and similar storage tools; and through partially automated or non-automated means provided they are part of a data filing system via support or legal applications.
4.2. Invitation addresses and membership information may be obtained from the organization administrator or the user who is sharing. This does not mean that all other information of the invited person can be used. In cases where the data is not obtained directly from the data subject, applicable notification obligations are observed.
Article 5. Recipients and purposes of transfer
| Recipient group | Purpose and scope of transfer |
|---|---|
| AI service: Google Gemini | Requested conversion, document preparation and search/question answering process; relevant audio, file, text, template or question |
| Hosting and technical infrastructure providers | Running the application and storing necessary data; scope limited to the service used |
| Email and notification providers | Recipient and relevant message content for verification, invitation and notification delivery |
| Recipients authorized by the user | Content and related info within the scope of the given sharing permission |
| Organization administrators | Information provided for membership and credit management; administration alone does not grant access to personal content |
| Legal and financial consultants | Records required by the relevant service and obligation |
| Authorized public institutions and judicial authorities | Records required by a lawful request or notification |
5.1. The transfer is limited to the scope necessary for the relevant purpose. When the payment service is activated, data flow with the used payment and billing providers is added to this text; unless payment is received, no transfer is made within this scope.
5.2. Sharing content by the user does not give BİOSTAT the authority to disclose the content to an unlimited group of recipients. The transfer conditions in Articles 8 and, if necessary, 9 of the Law apply separately.
Article 6. International transfer
6.1. External AI and infrastructure services may lead to data being processed abroad or accessed from abroad. The existence of a legal ground for processing does not remove the requirement to separately fulfill international transfer conditions. Acceptance of this text does not constitute a transfer mechanism on its own.
6.2. International transfers are subject to the conditions in Article 9 of the Law; exceptions regarding occasional transfers are not considered a general basis for regular service flows.
6.3. The AI service is provided by Google; hosting, backup and email services are provided by the relevant infrastructure and message providers. For information about processing countries and durations, you may contact info@itheralab.com.
Article 7. Storage and deletion principles
7.1. Storage is determined according to the purpose of the data, the relevant process, legal obligations, and the duration required for the protection of rights. When the purpose and valid legal basis end, the data is deleted, destroyed, or anonymized in accordance with the legislation. A single and unlimited period does not apply to all data categories.
7.2. There is a 24-hour access period for local audio recovery; a cleaning threshold of 24 hours for document audio on the server; and a 30-day threshold for notes and documents in the trash. Successfully processed note audios are removed from active storage. Details regarding the triggering of cleaning, failed operations, and backups are explained in articles 6 and 7 of the Privacy Policy.
7.3. Backups, technical logs, and external provider copies are stored and deleted according to their own cycles; this does not grant indefinite storage authority. Data to be stored due to accounting or disputes must be limited to the necessary records.
Article 8. Rights of the data subject
8.1. Under Article 11 of the Law, the data subject may learn whether their personal data is processed, request information if it has been processed, question the purpose of processing and the use in accordance with the purpose, and learn about the recipients at home and abroad. They may request the correction of incomplete or incorrect data, its deletion or destruction under legal conditions, and the notification of these actions to third-party recipients. They may object to the result occurring against them solely as a result of automated analysis; they may request the compensation of damages suffered due to unlawful processing.
Article 9. Application method and response
9.1. Applications may be submitted in writing to BİOSTAT — Atalar Mahallesi Yayla Sokak No:13/10 Kartal İstanbul in accordance with the Communiqué on the Principles and Procedures for Application to the Data Controller; or by using the previously notified and registered email address in the system, or via secure electronic signature/mobile signature to info@itheralab.com. Other legally valid methods are reserved.
9.2. The application must include the name-surname, signature for written applications, identification information required by legislation, notification address, and the subject of the request, along with an email/phone number for notification if available. Documents explaining the request are attached to the extent necessary. Representation authority is verified for applications made through a representative. Copies of unnecessary identification documents, passwords, or content should not be sent.
9.3. Requests are concluded as soon as possible and within thirty days at the latest, depending on their nature. The principle is a free response; only the fee determined by the Board can be applied for transactions requiring additional costs. If the application is caused by BİOSTAT's error, the fee collected is refunded. The reason for refusal is explained; the right to complain and other application rights under the Law are reserved.
Article 10. Updates and separate clarifications
10.1. This text may be updated in line with changing actual processes and legislation. In cases where clarification must be provided separately at the time of data collection or as required by the relevant process, this general text is not considered sufficient on its own. A separate preference is offered from the clarification for activities requiring explicit consent.