Data Processing Terms

1. The parties

Glojour is operated by Ali Can Akdoğan. In this text, "Glojour", "we" and "us" mean Ali Can Akdoğan as the operator of Glojour.

Address

Tomtom Mah. İstiklal Cad. Turhol Han No: 189 İç Kapı No: 3, Beyoğlu, İstanbul

Email

info@glojour.com

Phone

+905335604450

In this text, "the clinic" means the doctor who owns the clinic account on Glojour and the clinic that doctor runs. The clinic owner accepts these terms for the clinic and is responsible for the clinic team's use of Glojour.

2. Roles and scope

For the data described in The people and the data, the clinic is the data controller and Glojour is the data processor within the meaning of Turkish Law No. 6698 on the Protection of Personal Data (KVKK). These terms do not cover the data for which Glojour is itself the data controller, such as members' accounts, what members publish in the community, and the act of sending a patient's request to the doctor the patient chose; our Privacy Policy covers that data.

3. Subject, nature, purpose and duration

Subject

Providing Glojour's clinic features to the clinic.

Nature

Receiving, storing, organising and displaying information to the clinic team, transmitting the messages the team writes, and deleting information.

Purpose

Only to let the clinic handle consultation requests, keep its patient records and talk to its patients and prospective patients, including on WhatsApp.

Duration

For as long as the clinic uses the clinic features, and then until the deletion described under When the clinic stops using Glojour.

4. The people and the data

People concerned

The clinic's patients and prospective patients: people who send the clinic a consultation request on Glojour, people who write to the clinic's WhatsApp number connected to Glojour, and people the clinic adds or imports itself. Also the clinic's team members, as far as their activity appears in the records.

Data

Identity and contact details (name, phone number, email address); the content of requests and messages, with their attachments and captions; the notes, labels, tasks and stages the team adds; delivery and read records of messages; and records of which team member did what.

Special categories

Health data contained in requests, messages and notes.

5. Processing only on the clinic's instructions

Glojour processes this data only on the clinic's documented instructions. The clinic gives its instructions through the way it sets up and uses the clinic features, through its settings, and in writing. Glojour does not use the data for purposes of its own, does not sell it, does not use it for advertising and does not use it to train AI models.

If the law requires Glojour to process the data in another way, Glojour tells the clinic first, unless the law forbids that. If Glojour considers that an instruction breaks the law, it tells the clinic.

6. Confidentiality and access

Only the Glojour staff who need access to support the clinic, keep the platform secure or meet a legal obligation can open the clinic's records, and they are bound to keep them confidential. Within the clinic, the clinic owner decides who joins the team and what each member can see and do.

7. Security

• Every connection to Glojour is encrypted (HTTPS).
• Database access rules decide, row by row, who can read each record: a team member sees only what their permissions allow, and other clinics see nothing.
• Files are kept in private storage and shown only through links that expire.
• Glojour records which records its authorised staff open.
• The database and application servers are in Frankfurt, Germany.

Under Article 12 of the KVKK, the clinic and Glojour are jointly responsible for taking the necessary security measures. The clinic does its part by managing its team's access, removing a member's access when they leave, and keeping its devices and passwords secure.

8. Sub-processors

The clinic authorises Glojour to use the sub-processors below for this data. Each receives only what its service needs. We keep this list current, and we tell clinic owners by email before a new sub-processor starts receiving their patients' data. A clinic that objects can stop using the clinic features and have its data deleted.

9. Requests from the people concerned

When a person asks Glojour to access, correct or delete data that a clinic holds about them in Glojour, Glojour tells the clinic and helps it answer within the 30 days the KVKK allows. By these terms, the clinic instructs Glojour to carry out a verified deletion request it receives directly, in Glojour, and to tell the clinic when it has done so. The clinic answers for its own records outside Glojour. Data Deletion describes the steps for people who wrote to a clinic on WhatsApp.

10. Data breaches

If Glojour becomes aware of a breach affecting the clinic's data, it tells the clinic without undue delay, with what it knows about what happened, the data and people affected and the measures taken. This lets the clinic notify the Personal Data Protection Board and the people concerned within the 72 hours the Board expects.

11. Transfers abroad

Several sub-processors are based abroad or process data outside Turkey, as listed above. These transfers from Turkey are governed by Article 9 of the KVKK, which requires appropriate safeguards for regular transfers abroad, such as the standard contracts published by the Turkish Personal Data Protection Board. We are preparing those contracts with our service providers; we will notify each signed contract to the Board within five business days and update this section.

12. When the clinic stops using Glojour

When the clinic owner's account is deleted, Glojour deletes the clinic's records in Glojour, including its patients' requests, chats, notes and WhatsApp conversations, within 30 days. Copies in the database backups are overwritten within seven days after that. Before the account is deleted, the clinic can ask us at info@glojour.com for a copy of its patient records in a common electronic format.

13. Information and cooperation

On request, Glojour gives the clinic the information it needs to show that these terms are being met, and answers its questions about our measures. If a competent authority asks the clinic about Glojour's processing, Glojour helps the clinic answer.

14. The clinic's responsibilities

• Have a legal basis for its processing as a health professional and data controller, and inform its patients about it as Article 10 of the KVKK requires.
• Record in Glojour only the information it needs, and keep its records accurate.
• Obtain the permissions it needs from its patients, and keep the content it publishes in line with the health promotion rules that apply to it.
• On WhatsApp, message only people who wrote to it first or gave it permission, follow the WhatsApp Business Messaging Policy and Meta's terms for the WhatsApp Business Platform, and respect every request to stop.
• Manage its team's access, and remove a team member's access when they leave the clinic.

15. How these terms fit with the Terms of Use

These terms form part of our Terms of Use. On the processing of the clinic's patient data, these terms prevail over the Terms of Use. When we change them, we publish the new version here with its date and a note on what changed, and tell clinic owners by email before the change takes effect.

16. Contact

Questions about these terms or about the processing of your patients' data: info@glojour.com.