Privacy & Data Notice

Last updated: September 23, 2026

Pursuant to Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK) and in accordance with international privacy best practices, we wish to inform you about how your personal data is processed within the "Kelan" mobile application and its associated booking platform ("Platform").

1. Data Controller

The data controller for personal data collected through the Platform is Öncüm Korkmaz Yılmaz, a natural person resident in Turkey.

• Email: destek@kelan.me
• Website: kelan.me

2. Data We Collect and How

Data is collected automatically or semi-automatically via digital forms on the App and Website, and via server logs:

• Service Providers (Professionals): Full name, email address, and unique user identifier (UUID) obtained via third-party sign-in (Google/Apple); working schedule preferences created within the app.
• Service Recipients (Clients): Name, surname, phone number, email address, and selected time slot submitted via the booking form.
• Appointment conduct records (Clients): The outcome of an appointment (cancelled / cancelled last-minute / did not attend), when the notice was given, and whether it fell inside the free-cancellation window the provider had stated. This is not collected from a form; it is derived from your use of the service and held as part of the appointment record.
• Technical Data: IP address, request timestamps, and API status codes collected for system security purposes.
• Aggregate Usage Counters: Records consisting only of an event name, an outcome code and a time, kept to measure where the service fails or people give up (for example "a booking page was viewed", "a verification code was entered incorrectly"). Event names come from a fixed, predefined list; these records contain no free text, name, email, phone number or appointment identifier. Nothing identifying a booking page's visitor is stored — no IP, cookie, device or session identifier. A record shows only which provider's page it happened on, and is linked to that provider's account.

3. Legal Basis and Purposes of Processing

• Performance of a contract (KVKK Art. 5/2-c): Delivering appointment requests to the relevant parties, operating email verification (OTP) flows, notifying parties of approval or rejection, and sending appointment reminders.
• Legitimate interest (KVKK Art. 5/2-f): Keeping appointment conduct records and showing them to the provider you booked with. A provider has a legitimate interest in managing missed appointments and wasted time slots, and may take this information into account when considering future booking requests. This is not treated as contract performance (Art. 5/2-c) because the record outlives the appointment it arose from.
• Legal obligation (KVKK Art. 5/2-ç) and legitimate interest (KVKK Art. 5/2-f): Maintaining server logs to ensure information security, prevent cyberattacks, and block malicious or duplicate requests.
• Legitimate interest (KVKK Art. 5/2-f): Keeping aggregate usage counters relating to a provider. We have a legitimate interest in seeing where the service errors, which notification failed to arrive, and where people give up; without this, faults can only be discovered when a user complains.

Counters relating to booking page visitors contain no identifier and cannot be linked to an individual, so they are not personal data; KVKK does not apply to those records.

4. Statement on Sensitive Data

There are no free-text note fields in the booking flow. Selecting a time slot with a dentist, dietitian, or coach constitutes general-category data processing for appointment coordination purposes; individual health records or medical histories are strictly not processed on the Platform.

5. Data Transfers

Your personal data is hosted on secure servers within Turkey and is never transferred to third parties or advertising networks except as required by law (e.g., judicial or authorized public authority requests).

6. Retention Periods

• Active accounts: Data is retained while the Service Provider account remains active.
• Account deletion: Upon a "Delete Account" request, all account data is permanently destroyed immediately (and within 30 days at the latest). The link between that account and its aggregate usage counters is severed at the same moment, rendering those records anonymous (KVKK Art. 7); what remains is numbers that cannot be connected to any person.
• Appointment conduct records: Not stored separately — they are part of the appointment record and are destroyed with it. When a provider deletes their account they are erased within 30 days along with everything else. Providers are shown only the last 12 months; anything older is not surfaced.
• Aggregate usage counters (raw records): Retained for at most 180 days, then deleted automatically.
• Daily totals: Before raw records are deleted they are folded into daily counts containing no personal data and no identifier of any kind. Those totals are anonymous and may be kept indefinitely.
• Legally mandated logs: Retained for the period required by applicable law.

7. Your Rights

You have the right to learn whether your personal data is being processed, to request correction or deletion, and to object to processing. The right to object matters particularly for appointment conduct records, which rest on legitimate interest and may inform a decision about you. Submit requests to destek@kelan.me. Requests are processed free of charge within 30 days.

If you are dissatisfied with our response, you may lodge a complaint with Turkey's Personal Data Protection Authority (KVKK).