Privacy Policy & Data Protection

1. Scope and controller

This policy covers the doktorclub.com website and the DoktorClub iOS and Android apps. The data controller is Mobisera Bilişim İç ve Dış Ticaret Limited Şirketi (DoktorClub).

Not every data flow has the same purpose or processing condition. Processing required for accounts, security and requested services is distinguished below from optional product measurement and diagnostics.

2. Data categories

• Account and contact data: name, email, telephone number, profile image, user number and session data.
• Professional verification: physician, dentist or student status, specialty, institution, school, graduation and diploma data.
• Location declaration: the province and district selected by the user during registration or profile setup. The mobile app does not request GPS or precise-location permission for this purpose.
• Identity data: when required by the applicable registration or verification flow, a Turkish identity number or an internal record derived from it; country/citizenship declaration for foreign-user flows. A derived record is still treated as personal data, not anonymous data.
• User content: direct and clinical messages, attachments, photos, videos, audio, documents, posts, stories, comments, likes, reports and blocking records.
• Search and professional tools: search terms sent to the server, DOKGPT/assistant queries and responses, values and results from medical calculators, and learning/quiz progress.
• Device, notification and security data: platform, app version, language, push token, a device identifier where needed, IP or a security-derived digest, user agent, timestamp and session/security events.
• Interactions: content views, notification impression/open/click and sponsored-content click. Optional mobile-measurement signals are sent only when the relevant preference is enabled.
• Diagnostics: with permission, a Crashlytics record that may include app/OS/device information, an error trace, app logs and a numeric DoktorClub user number.

3. Processing for core services

Core processing supports account creation and verification, secure sessions, requested content, message and media delivery, search, medical tools, notification preferences, abuse prevention, support, data export and account deletion. It is separate from the mobile product-measurement preference.

Specialty, school, graduation information, user number and in-app progress/interactions may be used to personalize news, case, education and “For You” recommendations.

Camera, microphone and photo-library access is used only after you start the relevant feature and grant the operating-system permission. The app does not automatically upload your entire photo library or address book.

4. Optional mobile measurement and diagnostics

“Product usage measurement” and “Crash reports” are off by default and can be chosen independently. Accept all, Reject all and Preferences are presented equally. The choice is stored on the device with the notice version and time and can be changed under Settings > Privacy and measurement.

If product measurement is enabled, article views, sponsor clicks and notification impression/open/click signals may be sent to the DoktorClub API. A record may include the content, campaign or notification ID, the account-linked numeric user number, time and limited request information.

If crash reports are enabled, Firebase Crashlytics may receive app version, device/OS information, error traces, diagnostic logs and a numeric user number. DoktorClub does not intentionally attach patient fields, but patient identifiers must not be entered into messages or free-text fields.

In this policy version the mobile app does not integrate a GA4/Firebase Analytics module, does not perform cross-app advertising tracking and does not use IDFA. Website cookie/analytics choices are separate from the mobile preference.

Withdrawal stops new optional measurement calls; Crashlytics collection is disabled and the app attempts to remove unsent reports on the device. Records already received by a provider remain subject to the service configuration and applicable retention duties.

5. Messages, media, search and clinical data

Messages and attachments are shared with recipients you choose; posts, stories, comments and other community content are shared with the audience shown by the feature. DoktorClub systems process content for delivery, security, abuse review and user controls. Reported content may be reviewed for moderation.

General search terms are sent to the API to produce results; that does not by itself mean a separate general-search history is created. DOKGPT/assistant conversations and calculator inputs/results may be associated with the account as feature history.

DoktorClub tools are not patient-record systems. Do not enter patient names, identity numbers, contact details or other identifiable health data in messages, search, DOKGPT, calculators or media. Professional users remain responsible for any required authority, notice and patient consent.

6. Push, service providers and international processing

When push is enabled, the token, platform, app version and language are linked to the DoktorClub account. Delivery uses Google Firebase Cloud Messaging and, on iOS, Apple Push Notification service (APNs). Permission can be disabled in device settings; logout and account-deletion flows are designed to remove or invalidate relevant device registrations.

User content may be disclosed to the selected DoktorClub members; technical data to providers needed for hosting, security, push delivery or user-enabled diagnostics; and data to authorities when lawfully required. Crashlytics sends data to Google Firebase only when that preference is enabled.

Google and Apple services may involve processing outside Türkiye. This notice does not assert an unverified specific international-transfer mechanism or contract type. You may request information about the applicable transfer condition and safeguard at [email protected].

7. Sponsored content and external links

Sponsored content is visibly labelled. If product measurement is enabled, a sponsored-banner click may send DoktorClub a measurement record linked to a campaign ID, user number and time. Sending that signal is not required to open the link.

Tapping a sponsored link may open a sponsor or other third-party site. Processing there is governed by that site’s own notice. If a campaign involves transferring personal data to a sponsor, the scope and processing condition must be explained separately in the campaign-specific notice.

8. Retention and security

Data is retained for as long as needed to provide the feature, manage account security, meet a user request, preserve dispute/abuse records and satisfy applicable legal duties. The period varies with the data type, feature/account state, the effect of shared content on other users and legal requirements. This notice does not invent a single retention period.

TLS in transit, authentication and access controls are used; native-app session secrets are held in the operating system Keychain/keystore. No internet service can promise absolute security. The former blanket statement that “all medical data is protected with AES-256” has been removed; this policy does not promise one unverified storage algorithm for every field.

9. Choice, access, export and deletion

Under Settings > Privacy and measurement you can independently enable or disable optional product measurement and Crashlytics. Under Settings > Account, “Export My Data (KVKK)” starts an account export and “Delete My Account” starts in-app account deletion.

Your rights include asking whether data is processed, requesting information and correction, learning recipients, requesting erasure where applicable and objecting to qualifying automated analysis. Shared conversations/content, moderation, security or legal records may be erased, de-identified or restricted where a valid retention need applies.

Provide enough information to identify the account and requested action; do not email patient records or unnecessary identity documents.

Detailed legal notices

• KVKK Information Notice (Turkish)
• Retention and Destruction Policy (Turkish)
• Explicit Consent Notice (Turkish)