🔒 Privacy Policy (KVKK)

1) Data Controller

Data Controller: Dietitian Nilay Göktepe Yılmaz

Address: Cubes Plaza, B Block No:208, Çukurambar, Öğretmenler St. No:6, 06510 Çankaya/Ankara, Turkey

Email (KVKK applications): dytnilaygoktepe@gmail.com

Phone: 0533 284 43 33

2) Personal Data Processed

The following personal data may be processed when using the NGY App:

A) Account / Membership Data

• Login/session information, user account information, user ID

B) Identity and Contact Information (if provided by user)

• Name-surname (if any), email, phone (if any)

C) Profile / Demographic Information (entered by user)

• Age, height

D) Tracking Data (entered by user)

• Measurement information (e.g., weight/body measurements – based on user input)
• Daily water consumption
• Daily step count

E) Content Data

• Meal photos (uploaded by selecting from camera/gallery)
• Descriptions/notes related to photos

F) Messaging (Chat) Data

• User-dietitian message content
• Images shared in messages (e.g., meal photos) and additional descriptions

G) Notification Data

• Device notification token (FCM token) and notification preferences for sending push notifications
• Notification settings scheduled on device for meal reminders (local notifications)

3) Purposes of Processing Personal Data

Your personal data is processed for the following purposes:

• Creating membership, login/session management, and managing your account
• Managing the diet/nutrition process: creating, viewing, and reporting your measurement and tracking records
• Managing the meal photo upload and evaluation processes by the dietitian
• Managing messaging/communication processes between user and dietitian
• Delivering meal reminders and application notifications (push and/or device-scheduled notifications)
• Managing support requests
• Fulfilling obligations arising from legislation and responding to requests from authorized institutions/organizations

4) Method of Collecting Personal Data

Data is collected electronically through:

• Entry by the user through application screens,
• Uploading by selecting photos from camera/gallery,
• Using the messaging (chat) function,
• Generation of device notification token for delivering push notifications

5) Legal Grounds

Your personal data is processed based on the processing conditions stipulated in KVKK.

• Non-special category personal data (e.g., age, height, water consumption, step count, account data): may be based on processing conditions in KVKK such as being necessary for service provision, legal obligations, and legitimate interest.
• Special category personal data (e.g., measurement information and chat content that may be health-related): processed under the conditions stipulated in KVKK; Explicit Consent is obtained when necessary.

6) Transfer of Personal Data (Domestic)

Your personal data;

• Is viewed and managed by the dietitian who is the Data Controller within the scope of service provision.
• May be shared with relevant institutions/organizations only to the extent of the request, upon request by authorized public institutions and organizations.

7) Service Providers (Firebase/Google) and Data Processors

Google Firebase services are used in the application infrastructure:

• Authentication/session: Firebase Authentication
• Database: Firebase Firestore
• Image storage: Firebase Storage
• Push notification infrastructure: Firebase Cloud Messaging (FCM)

In this context, your personal data may be processed in the service provider infrastructure for the provision of relevant services.

On iOS devices, Apple push infrastructure (APNs) may technically be involved in the push notification delivery process. On Android devices, relevant operating system/service infrastructures may be used in notification delivery processes.

Google Privacy Policy: https://policies.google.com/privacy

8) Transfer of Personal Data Abroad

Due to cloud infrastructure and notification services, your personal data may be stored and/or processed on servers abroad. Transfer abroad processes are carried out in accordance with KVKK's provisions on transfer abroad.

9) Retention Periods

Your personal data is retained;

• As long as your account is active,
• For the period necessary for service provision,
• Limited to the periods necessary for legal obligations and establishment/exercise/protection of rights in possible disputes

and is deleted, destroyed, or anonymized at the end of the period.

10) Data Subject Rights (KVKK Article 11)

Under KVKK, you have the right to apply to the data controller and;

• Learn whether your personal data is being processed,
• Request information if it has been processed,
• Learn the purpose of processing and whether it is used in accordance with its purpose,
• Know the third parties to whom it is transferred domestically/abroad,
• Request correction if it has been incompletely/incorrectly processed,
• Request its deletion or destruction under the conditions stipulated in KVKK,
• Request notification of correction/deletion/destruction operations to third parties to whom it has been transferred,
• Object to the emergence of a result against you by analyzing exclusively through automated systems,
• Demand compensation for damages if you suffer damage due to unlawful processing

11) Application Method

You can submit your requests under KVKK through the following channels:

Applications are concluded as soon as possible and within 30 days at the latest, depending on the nature of the request.

12) Changes

This notice may be updated as needed. The current version is published within the application.