GRID MOBILE HEALTH PLATFORM
PROTECTION AND PROCESSING OF PERSONAL DATA
PRIVACY NOTICE
Ordinatrum Bilişim Teknolojileri ve Danışmanlık A.Ş.
Document No: GRID-KVKK-001 | Revision: 1.0
Document Information
| Document | Privacy Notice on the Protection and Processing of Personal Data |
| Document No | GRID-KVKK-001 |
| Revision | 1.0 |
| Data Controller | Ordinatrum Bilişim Teknolojileri ve Danışmanlık A.Ş. |
| Capacity | Remote health information system (USBS) provider registered with the Ministry of Health. |
| Publication Date | 01.01.2026 |
| Approval | 01.01.2026 |
1. Identity of the Data Controller and Scope of This Notice
This Privacy Notice has been prepared by Ordinatrum Bilişim Teknolojileri ve Danışmanlık A.Ş. (the “Company”) to inform users of the GRID Mobile Health Platform (the “Platform”), pursuant to Article 10 of the Personal Data Protection Law No. 6698 (“KVKK”) and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform.
The Company is a remote health information system (“USBS”) provider registered with the Ministry of Health (the “Ministry”) under the Regulation on the Provision of Remote Health Services published in the Official Gazette dated 10.02.2022 and numbered 31746 (the “Regulation”). The Company is not a healthcare facility; it does not provide healthcare services and takes no part in diagnosis or treatment. Remote health services are provided over the Platform by healthcare facilities licensed under the Regulation, through healthcare professionals.
This notice covers the personal data processing activities the Company carries out as a data controller. For health data processed while remote health services are provided, the data controller is the healthcare facility providing the service; the obligation to inform in this respect belongs to that facility, and its privacy notice is provided to you separately by the facility you receive services from (Regulation Art. 12/1-2).
2. The Company's Capacities as Data Controller and Data Processor
Under Regulation Art. 12/2, persons acting as data controllers and data processors in the provision of remote health services must process the personal data they obtain in accordance with the KVKK, ensure its security and fulfil their obligation to inform. The Company's role on the Platform differs by the nature of the processing activity, as follows:
| Capacity | Processing activities covered |
|---|---|
| Data Controller (our Company) |
Platform membership and account management; operation of the identity verification infrastructure; technical management of the appointment and call flow; access via healthcare facility platforms; transaction security (log/audit records, IP and device information); invoicing and contract processes; support and complaint management; security, maintenance and development of the Platform; fulfilment of legal obligations. |
| Data Processor (our Company, on behalf of the healthcare facility) |
Hosting, transmitting and storing, on behalf of and on the instructions of the healthcare facility, the health data generated during remote health services (examination records, medical assessments, e-prescription/e-report information, laboratory results, measurement/parameter data) in the facility's information management systems or in a data center environment under the facility's control, and technically facilitating the transfer of these records to the Ministry's central health data system. |
As a data processor, the Company never processes health data for its own purposes, derives no secondary benefit from such data, and does not cause it to be transferred to third parties other than under the healthcare facility's written instructions and applicable legislation.
3. Categories of Personal Data Processed
As a data controller, the Company processes the following categories of personal data:
- Identity: Information required for identity verification, such as name, surname, Turkish ID number and date of birth.
- Contact: Phone number, e-mail address, address information.
- Customer transactions: Membership information, appointment records, service usage history, request and complaint records.
- Transaction security: IP address, log and audit records, connection date-time information, device and browser information, application usage data.
- Finance: Information on invoicing and payment transactions.
Health data: Examination records, medical assessments, laboratory results, e-prescription and e-report information and wearable device/measurement data are not processed by the Company as a data controller; this data is hosted and transmitted on behalf of the healthcare facility providing the service, solely in the capacity of data processor, on the facility's information management system or in a data center environment under the facility's control.
4. Purposes and Legal Grounds for Processing Personal Data
Your personal data processed by the Company as a data controller is processed for the following purposes, based on the legal grounds stated against each:
| Purpose of Processing | Related Data Categories | Legal Ground (KVKK Art. 5) |
|---|---|---|
| Creating Platform membership, managing the account and providing Platform services | Identity, contact, customer transactions | Art. 5/2-c: Directly related to the conclusion and performance of a contract |
| Identity verification before remote health services (Regulation Art. 10) | Identity, transaction security | Art. 5/2-a: Expressly provided for by law (applicable legislation); Art. 5/2-ç: Fulfilment of a legal obligation |
| Access to the healthcare facility's platform, ensuring transaction security; keeping access, audit (log) and traffic records | Transaction security (IP, date-time, device and connection information) | Art. 5/2-a and Art. 5/2-ç: Obligations under Law No. 5651 and related legislation |
| Technical management of the appointment and call flow, sending notifications | Identity, contact, customer transactions | Art. 5/2-c: Performance of a contract |
| Invoicing, pricing and fulfilment of financial obligations | Identity, contact, finance | Art. 5/2-c and Art. 5/2-ç: Obligations under tax legislation |
| Handling requests and complaints, support services | Identity, contact, customer transactions, requests/complaints | Art. 5/2-e: Establishment, exercise or protection of a right; Art. 5/2-f: Legitimate interest |
| Security, maintenance and error detection of the Platform, and improving service quality | Transaction security, application usage data | Art. 5/2-f: Legitimate interest, provided that fundamental rights and freedoms are not harmed |
| Providing information to authorized institutions and conducting legal proceedings | All relevant categories | Art. 5/2-a, Art. 5/2-ç and Art. 5/2-e |
Where none of the legal grounds above applies, your personal data is processed only on the basis of your explicit consent; for processing activities that require explicit consent (for example, sending commercial electronic messages), your consent is obtained separately and specifically for that processing. You may withdraw your explicit consent at any time.
5. Special Categories of Personal Data and Call Recordings
Your health data is a special category of personal data under KVKK Art. 6. For health data generated within remote health services, the data controller is the healthcare facility, and the legal grounds for processing this data are set out in the facility's privacy notice. The Company carries out only technical hosting and transmission of this data, as a data processor bound by the facility's instructions, and applies the technical and administrative measures required by KVKK Art. 12 and the decisions of the Personal Data Protection Board.
Under Regulation Art. 12/3, remote health services may not be recorded on video or audio without the explicit consent of both parties, and no photographs may be taken during the service. Where a recording is made with the parties' explicit consent, it is stored at the healthcare facility or in secure data centers permitted by the Ministry; access by legally authorized authorities and by Ministry inspectors in administrative investigations is reserved, and recordings are kept for no more than twelve months and deleted when that period ends (Regulation Art. 12/4).
6. Transfer of Personal Data
Your personal data processed by the Company as a data controller may be transferred to the following recipient groups, in accordance with the conditions in KVKK Art. 8 and Art. 9 and only to the extent limited to the purpose:
- Healthcare facilities: To the healthcare facility you receive services from, so that remote health services can be provided (including identity verification and appointment information).
- Ministry of Health: Within the scope of sending records of remote health services to the Ministry's central health data system under Regulation Art. 13; this transfer is the obligation of the healthcare facility as data controller, and the Company only provides the technical infrastructure.
- Authorized institutions: To public institutions and judicial authorities authorized to request it, within the framework of obligations arising from legislation.
- Suppliers: To service providers from whom hosting, security, maintenance and support services are obtained, acting as data processors and having signed a data processing agreement with the Company.
Data processed on the Platform is hosted in Türkiye, and your personal data is not transferred abroad. If a transfer abroad becomes necessary in the future, the conditions in KVKK Art. 9 will be complied with and you will be informed separately.
7. Method of Collecting Personal Data
Your personal data is collected electronically, by partially automated or automated means, based on the purposes and legal grounds stated above: through the mobile application and web interface during Platform membership, use of the healthcare facility's platform, identity verification, appointment creation and call processes; through the call center and support channels; and automatically while the Platform operates (log and audit records).
8. Retention Periods
Your personal data is retained for the period required for the purpose of processing and the minimum periods set by applicable legislation; at the end of these periods it is deleted, destroyed or anonymized in accordance with KVKK Art. 7 and the Regulation on the Deletion, Destruction or Anonymization of Personal Data.
| Data / Record Type | Retention Period |
|---|---|
| Membership and contract records | 10 years from the end of the contractual relationship (general limitation period under Turkish Code of Obligations No. 6098) |
| Traffic and access (log) records | Periods set by applicable legislation (including minimum periods under Law No. 5651) |
| Invoices and financial records | Periods set by applicable financial legislation |
| Audio/video recordings of calls made with the parties' explicit consent | At most 12 months; deleted when the period ends without further notice (Regulation Art. 12/4) |
| Health data hosted on behalf of the healthcare facility | Periods set by the legislation the healthcare facility is subject to; the retention period is determined by the facility as data controller |
9. Data Security Measures
In line with the Ministry's minimum standards underlying USBS registration, the Remote Health Information System Guide and KVKK Art. 12, the Company takes all necessary technical and administrative measures, including end-to-end encrypted communication, access authorization matrices, secure identity verification, log management, penetration tests and staff confidentiality undertakings. Calls are conducted over secure communication protocols in line with the requirements of the Regulation and the Guide.
10. Your Rights as a Data Subject
Under KVKK Art. 11, by applying to the Company you have the right to:
- learn whether your personal data is processed and, if so, request information about it,
- learn the purpose of processing and whether the data is used in line with that purpose,
- know the third parties in Türkiye or abroad to whom the data is transferred,
- request correction of incomplete or inaccurate data,
- request deletion or destruction of the data under the conditions in KVKK Art. 7, and request that these actions be notified to third parties to whom the data was transferred,
- object to an outcome against you arising from analysis of the processed data exclusively by automated systems,
- claim compensation if you suffer damage due to unlawful processing of personal data.
11. How to Apply
You may submit requests regarding the rights above, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, in writing to the Company's head office together with documents proving your identity, to our registered electronic mail (KEP) address, with a secure electronic signature or mobile signature, or from the e-mail address you previously notified to the Company and that is registered in our system. Your application is concluded free of charge as soon as possible according to its nature and within thirty days at the latest; if the process requires an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged.
For requests concerning your health data processed within remote health services (examination records, medical assessments, e-prescriptions/e-reports, etc.), the data controller is the healthcare facility you receive services from; such applications should be addressed to that facility. If submitted to the Company, your application is forwarded to the competent healthcare facility within the periods in the KVKK, and you are informed.
Data Controller Contact Information
| Title | Ordinatrum Bilişim Teknolojileri ve Danışmanlık A.Ş. |
| Address | Rıhtım Cad. Derya İş Merkezi No.28 Ablok No.91 Kadıköy İstanbul |
| MERSIS No | 0645077929600001 |
| KEP Address | [email protected] |
| [email protected] |