Privacy Notice

This Privacy Notice is prepared to inform you about how your personal data is processed by ScolioPath ("Data Controller"), in accordance with Article 10 of Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") and Articles 13/14 of the EU General Data Protection Regulation ("GDPR").

A. The personal data we process, and how we collect it

As part of your use of the Platform, the following data is collected digitally, automatically or semi-automatically:

• Identity and contact data: name, surname, email address, date of birth/age.

• Usage and transaction data: app login records (logs), IP address, device model, operating system version, preferred language, exercise-completion history.

• Special-category personal data (health data): scoliosis degree (Cobb angle), spine/X-ray images, posture assessment data, physical complaint records. This data is only processed based on your explicit consent — see our Health Data Consent page.

B. Legal grounds and purposes of processing

• Performance of a contract (KVKK Art. 5/2-c, GDPR Art. 6/1-b): creating your account, providing the Platform's services and administering membership.

• Explicit consent (KVKK Art. 6/2, GDPR Art. 9/2-a): storing, analyzing and presenting your health data (scoliosis degree, chart tracking, images) within the app for your own progress tracking.

• Legitimate interest and legal obligation (KVKK Art. 5/2-ç/f, GDPR Art. 6/1-c/f): cybersecurity measures, keeping log records (pursuant to Turkish Law No. 5651), and improving the Platform.

C. Storage and transfer of personal data (cross-border transfer)

Your data is stored, encrypted, on high-security server infrastructure that meets GDPR and KVKK standards (e.g. AWS Frankfurt / Turkish data centers). Your special-category personal data is never shared with third-party marketing or advertising companies without your explicit consent. Data may be transferred to service providers bound by data-security commitments, for the purposes of technical infrastructure, cloud storage and database administration.

D. Your rights as a data subject (KVKK Art. 11 & GDPR Art. 15–22)

By applying to ScolioPath, you have the right to:

• Learn whether your personal data is being processed, and request information about it;

• Learn the purpose of processing and whether it is being used consistently with that purpose;

• Request correction if your data is incomplete or incorrectly processed;

• Request deletion or destruction of your data, pursuant to KVKK Art. 7 and GDPR Art. 17 (the right to be forgotten) — see the account-deletion option in your Profile settings;

• Object to a result arising to your detriment from analysis of your processed data exclusively through automated systems;

• Obtain a copy of your processed data (data portability) — see the data-export option in your Profile settings.

You can send your requests to privacy@scoliopath.com.

E. Commercial electronic messages

If you separately opt in during registration, ScolioPath may send you commercial electronic messages (email, SMS, app notifications) about updates, campaign announcements, newsletters, reminders and promotional content, pursuant to KVKK and the Turkish Regulation on Commercial Electronic Messages. This is entirely optional and unrelated to using the Platform's core service. You can withdraw this permission at any time, free of charge, via the unsubscribe link at the bottom of any email or from your in-app settings.