Privacy & Data Notice
Last updated: August 11, 2026
Pursuant to Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK) and in accordance with international privacy best practices, we wish to inform you about how your personal data is processed within the "Kelan" mobile application and its associated booking platform ("Platform").
In short:
- Your data is stored on servers located in Turkey.
- Appointment and scheduling records are general-category data; we do not process sensitive categories such as health, religion, or political views.
- Only pseudonymized technical error logs are sent abroad (Sentry — Frankfurt, Germany). Your real name, email, phone, or IP address are never sent outside Turkey.
- We do not process data for advertising or third-party tracking.
- If you cancel or fail to attend an appointment, that outcome is recorded and shown to the provider you booked with. It is visible to that provider only, and only the last 12 months of it are shown.
1. Data Controller
The data controller for personal data collected through the Platform is Öncüm Korkmaz Yılmaz, a natural person resident in Turkey.
2. Data We Collect and How
Data is collected automatically or semi-automatically via digital forms on the App and Website, and via server logs:
- Service Providers (Professionals): Full name, email address, and unique user identifier (UUID) obtained via third-party sign-in (Google/Apple); working schedule preferences created within the app.
- Service Recipients (Clients): Name, surname, phone number, email address, and selected time slot submitted via the booking form.
- Appointment conduct records (Clients): The outcome of an appointment (cancelled / cancelled last-minute / did not attend), when the notice was given, and whether it fell inside the free-cancellation window the provider had stated. This is not collected from a form; it is derived from your use of the service and held as part of the appointment record.
- Technical Data: IP address, request timestamps, and API status codes collected for system security purposes.
3. Legal Basis and Purposes of Processing
- Performance of a contract (KVKK Art. 5/2-c): Delivering appointment requests to the relevant parties, operating email verification (OTP) flows, notifying parties of approval or rejection, and sending appointment reminders.
- Legitimate interest (KVKK Art. 5/2-f): Keeping appointment conduct records and showing them to the provider you booked with. A provider has a legitimate interest in managing missed appointments and wasted time slots, and may take this information into account when considering future booking requests. This is not treated as contract performance (Art. 5/2-c) because the record outlives the appointment it arose from.
- Legal obligation (KVKK Art. 5/2-ç) and legitimate interest (KVKK Art. 5/2-f): Maintaining server logs to ensure information security, prevent cyberattacks, and block malicious or duplicate requests.
4. Statement on Sensitive Data
There are no free-text note fields in the booking flow. Selecting a time slot with a dentist, dietitian, or coach constitutes general-category data processing for appointment coordination purposes; individual health records or medical histories are strictly not processed on the Platform.
5. Data Transfers
Your personal data is hosted on secure servers within Turkey and is never transferred to third parties or advertising networks except as required by law (e.g., judicial or authorized public authority requests).
Error log data sent to Sentry (Germany/EU) for performance monitoring is masked to exclude personal data and contains only pseudonymized UUIDs.
6. Retention Periods
- Active accounts: Data is retained while the Service Provider account remains active.
- Account deletion: Upon a "Delete Account" request, all account data is permanently destroyed within 30 days.
- Technical error logs (Sentry): Automatically deleted after 30 days.
- Appointment conduct records: Not stored separately — they are part of the appointment record and are destroyed with it. When a provider deletes their account they are erased within 30 days along with everything else. Providers are shown only the last 12 months; anything older is not surfaced.
- Legally mandated logs: Retained for the period required by applicable law.
7. Your Rights
You have the right to learn whether your personal data is being processed, to request correction or deletion, and to object to processing. The right to object matters particularly for appointment conduct records, which rest on legitimate interest and may inform a decision about you. Submit requests to destek@kelan.me. Requests are processed free of charge within 30 days.
If you are dissatisfied with our response, you may lodge a complaint with Turkey's Personal Data Protection Authority (KVKK).