Privacy notice (KVKK disclosure)

1. Data controller

The data controller under Law No. 6698 on the Protection of Personal Data (KVKK) is Veli YILMAZ. Buddy Forever is currently in a closed beta.

Contact: contact@buddyforever.app

2. Which data do we process?

• Account: your name, email address, an irreversible hash of your password (the password itself is never stored), your avatar, language and time zone.
• Study setup: your school, preset or the classes you add yourself, quotas, targets and clinic hours.
• Calendar: your lectures, labs, exams and personal events.
• Patient planning data: only a made-up nickname that you choose, plus an optional age range, tags, notes, oral diagnosis and treatment plan. The app has no field for a patient's name, initials, file number, phone number or any other identifier, and you must not enter real patient data.
• Progress: the points you earn, case counts and finished procedures.
• Appointments and buddy pairing: the visits you propose and the ones that are approved, your buddy link, and visits you join as a temporary assistant.
• Notifications: the notices in your in-app inbox.
• Suggestions: the text of suggestions you send from the app.
• Invite requests (website form): your email address and, if you choose, your first name, school, year of study and message, the time you gave consent and your language.
• Technical data: technical information such as the IP address, used for security and rate limiting, and error logs. These are kept for a short time and used to protect the service, not to identify you.

3. What do we use your data for?

• To create your account, manage your session and provide the app.
• To run the shared calendar, appointment approval, patient tracking and quota and progress features with your buddy.
• To send in-app notifications.
• To review your invite request and send you the beta invite code by email.
• To read your suggestions and improve the product.
• To keep the service secure, limit abuse and automated requests, and keep a record of admin actions.
• To meet legal obligations and let you use your rights.

We do not use your data for advertising, we do not sell it and we do not build profiles.

4. Legal bases

• Contract (KVKK art. 5/2-c): providing your account and the app's features.
• Legitimate interest (KVKK art. 5/2-f): service security, preventing abuse and logging admin actions. We take care not to harm your fundamental rights and freedoms when we do this.
• Explicit consent (KVKK art. 5/1): the consent you give on the invite request form for us to email you about your invite. You can withdraw it at any time.
• Legal obligation (KVKK art. 5/2-ç): lawful requests from authorities and answering rights requests.

The app is not designed to process health data, which is a special category of personal data. Patients are kept only under made-up nicknames, and at sign-up you agree not to enter real patient data. If a patient record is nevertheless filled in so that a person could be identified, it is still protected as sensitive data: only you and, while assisting on a live visit, your buddy can see it, and admins cannot. When you delete such a record it is removed from the system.

5. Who receives your data?

• Your buddy: the person you choose to pair with sees your calendar and, only for a live visit they are assisting, the related patient plan. Everything else, such as lectures, personal events and progress, stays private to you. A temporary assistant sees only the appointment they were invited to.
• Admins: can see your account details (name, email, role) and the suggestions or invite requests you send. They cannot see patient records. Admin actions are logged.
• Cloudflare: our service provider (data processor) for hosting the website and the app, the database, network security and rate limiting.
• Email delivery service: the provider used to deliver sign-in code emails. The app sends no other email.
• Public authorities: only where the law requires it.

Transfers outside Türkiye: because Cloudflare runs a global network, your data may be processed or stored outside Türkiye. The basis for this transfer under KVKK art. 9 (for example standard contractual clauses or explicit consent) will be finalised before the public launch and this notice will be updated. During the closed beta only invited users can use the app.

6. How long do we keep your data?

• Your account and app data: until you delete your account.
• When you delete your account you have 7 days to change your mind; the account and everything it owns is fully removed within 14 days.
• Backups age out within 5 weeks, so a deleted account also disappears from backups after that time.
• Records you delete (for example a patient or an event) stay recoverable for 30 days, then are removed.
• Invite requests are kept as long as the invite process needs them; write to us if you want yours removed.
• Technical logs and rate-limit counters are kept for a short time.

7. Your rights under KVKK art. 11 and how to use them

Under article 11 of KVKK you can:

• Find out whether your personal data is processed,
• Ask for information if it has been processed,
• Learn the purpose of processing and whether it is used accordingly,
• Know the third parties to whom your data is transferred in Türkiye or abroad,
• Ask for correction if it is incomplete or wrong,
• Ask for deletion or destruction under KVKK art. 7 and ask that this be notified to third parties who received the data,
• Object if analysis by automated systems leads to a result against you,
• Ask for compensation if you suffer damage from unlawful processing.

Send your request by email to contact@buddyforever.app. We may ask you questions to confirm who you are. We answer within 30 days at the latest.

In the app: in Settings you can export your data as a single JSON file and delete your account. After a deletion request you can change your mind within 7 days; the data is fully removed within 14 days.

If you are not satisfied with our answer, you also have the right to complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).

8. Cookies

The website (buddyforever.app) sets no cookies, has no tracking or analytics and loads nothing from third parties. The app (my.buddyforever.app) uses only one strictly necessary session cookie that keeps you signed in. See the Cookies page for details.

9. Changes to this notice

We update this notice when the app or legal requirements change. The "Last updated" date at the top always shows the newest version. For an important change we will tell you in the app.

Questions? Write to contact@buddyforever.app.