Anaduyu MYS

Privacy Policy

Information on how we process and protect your personal data.

Anaduyu Yazılım ("Company", "we") takes the security of your personal data seriously in the Anaduyu MYS service we provide at anaduyu.com.tr. This Privacy Policy is issued to inform you in our capacity as data controller under Turkish Law No. 6698 on the Protection of Personal Data (KVKK). KVKK applies to our processing. Additional information for users in the EU/EEA/UK is set out in the GDPR section below.

1. Data Controller

2. Categories of Data Processed

The following data may be processed in connection with use of the platform:

  • Identity and contact: first name, last name, email, phone, clinic title
  • Account and transactions: username, password (hashed), subscription plan, invoice and payment records
  • Clinic operations data: client, session, finance and WhatsApp message records (data entered into the system by the clinic)
  • Technical data: IP address, browser information, session logs, cookies

3. Purposes of Processing

  • Providing the service, account management and subscription operations
  • Collection and invoicing via the payment infrastructure (iyzico)
  • Technical support, security and fraud prevention
  • Compliance with legal obligations
  • Improving service quality and statistical analysis

4. Legal Bases

Your personal data are processed under KVKK Art. 5 and Art. 6 where processing is necessary for the establishment or performance of a contract, for compliance with a legal obligation, for our legitimate interests, or where we have your explicit consent.

5. Data Transfers

Your data may be shared, only to the extent required to provide the service, with hosting providers, the payment institution (iyzico), and email and communications infrastructure providers. Where a transfer abroad takes place, safeguards required under KVKK are applied.

6. Retention Period

Data are retained for as long as required by the purpose of processing and for the limitation periods in applicable law; at the end of that period they are deleted, destroyed or anonymised.

7. Your Rights under KVKK

Under KVKK Art. 11 you may:

  • Learn whether your data are processed
  • Request information if they have been processed
  • Learn whether they are used in accordance with the purpose
  • Request correction if they are incomplete or inaccurate
  • Request deletion or destruction
  • Object and request compensation for damage

You may send requests to [email protected] or [email protected], or close your clinic administrator account via the Delete my account page.

8. Cookies

Cookies and similar technologies are used for session management, security, payment flows and (where enabled) analytics. For types, purposes and management options, see the Cookie Policy. You can manage cookies in your browser settings; disabling strictly necessary cookies may affect how the service works.

9. Security

Your data are transmitted with TLS/SSL encryption; access control and encryption measures are applied. The production environment uses a secure connection with 256-bit SSL.

10. Changes

This text may be updated. The current version is always published at /privacy. The Turkish version is at /gizlilik.

11. GDPR – Information for users in the EU/EEA/UK

If you are in the European Union, the European Economic Area or the United Kingdom, the following additional information applies under the GDPR (and, where applicable, the UK GDPR). Turkish Law No. 6698 on the Protection of Personal Data (KVKK) also applies to our processing. Related documents: Cookie Policy and Terms of Use.

Data controller identity and contact

  • Controller: Anaduyu Yazılım
  • Address: Beşevler Mah. Büyük Sok. No:14ac Nilüfer/Bursa, Türkiye
  • Phone: +90 850 346 8 635
  • Privacy requests: [email protected]
  • Support: [email protected]

Purposes of processing

We process personal data to provide Anaduyu MYS (accounts, clinic operations tools, subscriptions), to collect payment and issue invoices via iyzico, to provide technical support, to protect security and prevent fraud, to meet legal obligations, and to improve service quality including statistical analysis.

Legal bases

  • Art. 6(1)(a) GDPR — consent: where you have given consent, for example for optional analytics cookies.
  • Art. 6(1)(b) GDPR — contract: processing necessary to perform our contract with you, including creating and managing your account, delivering the service and handling subscriptions.
  • Art. 6(1)(c) GDPR — legal obligation: processing required to comply with tax, accounting and other legal duties.
  • Art. 6(1)(f) GDPR — legitimate interests: processing necessary for our legitimate interests in operating a secure service, preventing fraud, providing support and improving the product, balanced against your rights and interests.

International transfers

Personal data are stored and processed in Türkiye and by our processors. Processors include the payment institution (iyzico), PostHog (EU region endpoint, where analytics are enabled), and hosting and CDN providers, as well as email and communications infrastructure providers, each only to the extent required to provide the service. Where data are transferred from the EU/EEA/UK to Türkiye or another third country, we implement appropriate safeguards such as Standard Contractual Clauses (SCCs) where applicable.

Retention periods

We keep data for as long as the purpose of processing requires and for the statutory limitation and record-keeping periods that apply; we then delete, destroy or anonymise them.

Data subject rights

Subject to the conditions in the GDPR, you have the right to:

  • Access your personal data
  • Rectification of inaccurate data
  • Erasure ("right to be forgotten")
  • Restriction of processing
  • Data portability
  • Object to processing based on legitimate interests
  • Withdraw consent at any time, without affecting processing already carried out on the basis of consent
  • Lodge a complaint with a supervisory authority in your country of residence, place of work, or the place of the alleged infringement

How to exercise your rights

To exercise these rights, email [email protected]. Clinic administrators may also close their account via Delete my account (/hesabimi-sil).

Last updated: October 2026