Privacy policy

1. Who is the data controller?

The Company is the controller of clinic staff account data (name, email, phone) and of the data of visitors to the SinaRoute website.

For data about a clinic's patients, prospective patients and people who message the clinic, the clinic is the controller and the Company is a processor that processes that data only on the clinic's instructions and only to provide the service. These individuals should exercise their rights with the clinic first; requests sent to us are forwarded to the clinic.

2. What data we process

• Account and identity data: name, email, phone, a one-way hash of the password, two-factor authentication data, role and permissions.
• Usage and security logs: sign-in time, IP address, browser and device information, an audit log of actions.
• Business data entered by the clinic: patient records, appointments, quotes, sales and payments, consent forms, notes and files (under the clinic's responsibility; may include health data).
• Messaging data: when a clinic connects its WhatsApp, Instagram, Messenger or Gmail account, the messages and attachments sent to and from the clinic, and the sender's profile name, username and phone number.
• Advertising and lead data: when a clinic connects a Meta, Google Ads or TikTok ad account, lead form answers, campaign / ad set / ad names and daily spend.
• Payment data: subscription invoices and payment status. Card data is processed by the payment institution (iyzico); we do not store card numbers.

3. Data from Meta (WhatsApp, Instagram, Messenger, Facebook)

We receive no data from Meta unless a clinic explicitly authorizes its own Meta business account with the “Connect” button in SinaRoute. Once authorized, we only receive data related to the page, Instagram account, WhatsApp Business account and phone number the clinic selects.

This data is used only to: show messages in the clinic's inbox and send the replies the clinic writes, send messages the clinic sets up such as appointment reminders, add lead form answers to the clinic's lead list, and show ad spend in the clinic's reports.

Data from Meta is never sold, never used for ad targeting or profiling, and never shared with anyone other than the clinic itself and the service providers listed below. Access tokens are stored encrypted. When a clinic removes the connection on the Integrations page, its tokens are deleted.

4. Data from Google

When a clinic or staff member connects Google Calendar, Gmail, Google Business Profile or Google Ads, SinaRoute only accesses the data needed for that connection (calendar events, the clinic's email correspondence, business reviews, ad campaigns and spend).

SinaRoute's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. This data is not used for advertising, not sold, and not used to train AI models.

5. Purposes and legal bases

• Performance of the service contract: creating accounts, storing and showing the clinic's data, sending messages.
• Legal obligation: invoicing, tax and requests from authorities.
• Legitimate interest: security, abuse prevention, troubleshooting and service improvement.
• Consent, or the legal basis relied on by the clinic: AI features that require international transfer, and marketing messages (see section 7).

6. Who we share data with (service providers)

• Hosting and backup providers (servers, database, file storage).
• Meta Platforms (WhatsApp Business Platform, Instagram, Messenger), Google and TikTok: only when the clinic enables the related connection.
• SMS, email and e-invoice providers: for notifications and invoices the clinic sends.
• Payment institution (iyzico): for subscriptions and online payments the clinic collects from patients.
• AI provider (Anthropic): only when the clinic enables the feature and approves the international transfer; phone numbers, emails and ID numbers are masked before sending.
• Competent public authorities: when legally required.

7. International transfers

Servers of Meta, Google, TikTok and the AI provider may be located outside Türkiye. Such transfers are made in line with Article 9 of KVKK (standard contracts, adequacy decision or explicit consent) and only when the clinic enables the related connection or feature. AI features do not run until the clinic approves the international transfer.

8. Retention and deletion

Account data is kept for the duration of the membership and then for the statutory limitation periods. A clinic's business data is kept for the retention periods the clinic sets; expired data is deleted or anonymized by a nightly job. When a subscription ends, a copy of the data is delivered to the clinic on request; the clinic data is then deleted: a closed clinic account is suspended immediately and its personal data is irreversibly destroyed after 30 days; sales and invoice records that must be retained by law remain without personal data. Security and audit logs are kept as long as the law requires.

Industry benchmark: for participating clinics, response time, lead-to-patient conversion, quote acceptance, no-show, satisfaction and returning-patient rates (no patients, amounts or personal data) are combined anonymously. Clinics only see the median and quartiles of a group of at least 10 clinics, never another clinic's value. A clinic can stop participating from the Insights screen; its records are then removed from the group immediately.

For deletion requests, see the “Data deletion” page.

9. Security

• Encryption in transit (TLS) and field-level encryption for third-party keys and access tokens.
• Separation of each clinic's data (database row-level security), role-based access, two-factor authentication.
• Audit log of every change and of patient record views; patient data is masked in logs.

10. Your rights

Under Article 11 of KVKK you have the right to learn whether your personal data is processed, request information, request correction, deletion or destruction, learn the third parties it was transferred to, object to an outcome against you resulting from automated analysis, and claim compensation. Individuals covered by GDPR may also exercise the rights to data portability and to object.

Send requests to kvkk@sinaroute.local. Requests are answered free of charge within 30 days. If you are a patient of a clinic or someone who messaged a clinic, you may apply directly to that clinic; we forward requests we receive to the clinic.

11. Cookies

SinaRoute only uses cookies that are strictly necessary to keep you signed in and for security. No advertising or tracking cookies are used. Public pages opened by patients (online booking, consent forms) use no cookies.

12. Contact and changes

Controller: [Şirket unvanı], [Şirket adresi], [MERSİS ya da vergi numarası]. Email: kvkk@sinaroute.local.

When this policy changes, the current version is published on this page and significant changes are announced to clinic administrators in the app.