KVKK Information Notice

Your account and signing in

Whose data

All members

Glojour's role

Data controller (role c)

What data

Your email address, your password (we keep only a one-way hash of it), your account type (patient or doctor) and, if you signed up with your email address, the version and date of the texts you accepted. If you sign in with Google, the name, email address and profile photo link Google sends us.

Purpose

To create your account, recognise you when you sign in and keep your account secure.

Legal basis

Entering into and performing our contract with you (KVKK Art. 5(2)(c)).

Your profile and the age check

Whose data

Patient members

Glojour's role

Data controller (role c)

What data

Your first and last name, the display name and handle other members see, your profile photo, your city and country, and your date of birth. Your date of birth is never public; only you and authorised Glojour staff can see it.

Purpose

To show your profile, and to make sure that the platform is used only by adults and that sensitive photos are never shown to minors.

Legal basis

Performance of our contract (Art. 5(2)(c)) and our legitimate interest in protecting minors (Art. 5(2)(f)).

What you publish in the community

Whose data

Members who post

Glojour's role

Community platform (role a)

What data

Your posts, journeys and their chapters, comments, questions, reactions, saves and follows; the photos you upload, including before and after photos; and the treatment, city and recovery stage you add to a post. This can include health data. We remove location data from photo files when you upload them.

Purpose

To publish and host what you choose to publish, after our moderators have reviewed it, under the identity you choose (your name or anonymously), and to keep the community safe.

Legal basis

For health information in what you choose to publish, the fact that you have made it public yourself, in line with your choice to publish it (KVKK Art. 6(3)(ç)). For everything else, performance of our contract (Art. 5(2)(c)) and our legitimate interest in keeping the community safe (Art. 5(2)(f)).

Consultation requests and chats with doctors

Whose data

Patients, doctors and clinic teams

Glojour's role

Data controller (role c); The clinic's data processor (role b)

What data

The treatment and message in your request, your phone number and budget range if you choose to give them, and the page you sent the request from; the messages in your chats and the photos and files you attach. This can include health data.

Purpose

To send your request, at your request, to the doctor you chose, and to let you continue your conversation with that doctor and their clinic team on Glojour.

Legal basis

For sending your health information to the doctor or clinic you choose, and keeping it on Glojour for that purpose, your explicit consent (KVKK Art. 6(3)(a)); for your other details, performance of our contract (Art. 5(2)(c)). Once your request has reached the clinic, the clinic is the data controller for its own use of the information, on its own legal basis as a health professional, and Glojour processes the clinic's records only on the clinic's behalf, as its data processor.

The pre-consultation form

Whose data

Patients who fill it in

Glojour's role

Data controller (role c)

What data

Your answers to questions such as pregnancy or breastfeeding, blood thinners, chronic conditions and previous procedures. These answers are health data. You can skip any question.

Purpose

To keep your answers private until you choose to share them with a doctor. They are shown only to the doctor you share them with, and you can withdraw the sharing at any time.

Legal basis

Your explicit consent (Art. 6(3)(a)).

The AI preview (switched off)

Whose data

Members who used the preview before it was switched off

Glojour's role

Data controller (role c)

What data

The face photo you uploaded, the area you chose, the preview image generated, your statement that you are 18 or older, and the record of your consent. If you shared a preview with a doctor, that doctor could see it too. The preview is switched off, so no new photos are taken.

Purpose

To create an illustrative preview on your photo. A preview is not a prediction of your result and not a medical assessment.

Legal basis

Your explicit consent, asked for separately at the start of the preview (Art. 6(3)(a)).

Doctor accounts and verification

Whose data

Doctors

Glojour's role

Data controller (role c)

What data

Your name, title, specialty and place of practice; your phone number (never public); your diploma and licence details and the documents you upload; the information and images you publish on your doctor page and clinic site; professional details we find in public sources such as your website, Google Business Profile or Instagram account and put to you for confirmation; and the campaign tag and referring site domain that brought your sign-up.

Purpose

To open your doctor account, verify your identity and your right to practise, show you to patients as a verified doctor, let our team reach you, and measure which channels bring doctors to Glojour.

Legal basis

Performance of our contract (Art. 5(2)(c)); our legitimate interest in preventing fake doctor profiles and in measuring our channels (Art. 5(2)(f)); and, for information you have published yourself, the fact that you made it public (Art. 5(2)(d)).

The clinic desk, the team and patient records

Whose data

Clinic teams and the people clinics record

Glojour's role

The clinic's data processor (role b); Data controller (role c)

What data

Team members' names, email addresses, roles and permissions, online status and records of who did what; the notes, tasks and stages clinics keep about requests; and the names, phone numbers, email addresses and notes of people a clinic adds or imports itself.

Purpose

To let clinics handle their requests, patient records and patient conversations as a team.

Legal basis

The clinic is the data controller for what it records about its patients; Glojour processes that information only on the clinic's behalf and instructions, as its data processor. For team members' own account details, Glojour is the data controller and relies on performance of our contract (Art. 5(2)(c)).

The WhatsApp channel

Whose data

People who write to a clinic's WhatsApp number connected to Glojour, and that clinic's team

Glojour's role

The clinic's data processor (role b)

What data

Your WhatsApp phone number; the text of the messages you and the clinic send; for a photo or file you send, only its caption; when each message was sent, delivered and read; the notes and labels the clinic team adds to the conversation; and which team member sent each reply. We do not download the photos or files you send into Glojour, and we do not store your WhatsApp profile name.

Purpose

To bring your messages to the team of the clinic you wrote to and let the team reply to you through Glojour.

Legal basis

The clinic you wrote to is the data controller for these conversations; Glojour stores and transmits the messages only on the clinic's behalf and instructions, as its data processor, and does not use them for purposes of its own.

Safety, moderation and preventing abuse

Whose data

All users and visitors

Glojour's role

Data controller (role c)

What data

Reports you make and reports made about you, moderation decisions and account restrictions; records of which record our authorised staff viewed and when; the IP address, account ID or email address we hold to limit abuse; and technical error records.

Purpose

To protect the platform, its members and their data, to remove unlawful content, and to find and fix errors.

Legal basis

Our legitimate interest (Art. 5(2)(f)), our legal obligations (Art. 5(2)(ç)) and the establishment, exercise or defence of legal claims (Art. 5(2)(e)).

Measuring how Glojour is used

Whose data

Members and visitors

Glojour's role

Data controller (role c)

What data

Which pages and posts you see and for how long, your device type and country; if you are signed in, usage events linked to your account and the campaign tag and referring site domain that brought you to Glojour. We do not store your raw IP address for this: views are counted with a key derived one way from your IP address and the date. Page visit statistics are also collected with Vercel Web Analytics, which uses no cookies.

Purpose

To understand how Glojour is used, improve its pages and feed, and measure which channels work. We use these records only to count totals, never to build a profile of you, to target advertising or to train AI models.

Legal basis

Our legitimate interest (Art. 5(2)(f)).

Support and what you write to us

Whose data

Anyone who writes to us

Glojour's role

Data controller (role c)

What data

The message you send through the support window or by email, your email address and the page you sent it from; and the service emails we send you (such as welcome, request notifications and password resets).

Purpose

To answer your question and send the notices your account needs. We do not send you marketing messages.

Legal basis

Performance of our contract (Art. 5(2)(c)) and our legitimate interest (Art. 5(2)(f)).

Doctors who are not members

Whose data

Doctors who are not Glojour members

Glojour's role

Data controller (role c)

What data

Name, specialty, institution and district as they appear in public professional sources. No contact details are kept.

Purpose

To plan inviting doctors to review content in their specialty or to join Glojour.

Legal basis

Our legitimate interest (Art. 5(2)(f)) and data the person has made public (Art. 5(2)(d)).

Doctors who ask us to call them

Whose data

Doctors who ask to be called through the form on our page for doctors

Glojour's role

Data controller (role c)

What data

Your first and last name, your phone number, your specialty if you chose one, the page's language, the campaign tags of the ad or link that brought you and the name of the referring site, when you sent the form and the version of the contact permission text it showed; afterwards, notes of our calls with you.

Purpose

To call you and write to you on WhatsApp, show you Glojour, help you open your account and prepare your profile if you wish, and measure which ads and links reach doctors.

Legal basis

Steps taken at your request before entering into a contract (Art. 5(2)(c)) and our legitimate interest in measuring the results of our ads (Art. 5(2)(f)). For calls and WhatsApp messages, the permission you gave on the form (Law No. 6563).

Traffic records (Law No. 5651)

Whose data

Everyone who uses the site

Glojour's role

Data controller (role c)

What data

For every request: the IP address, the date and time, the page address asked for (with secret values such as sign-in codes removed), the method (GET, POST), the result and the browser details; for a file upload, also the account that uploaded it and where the file is stored.

Purpose

To meet our duty as a hosting provider under Article 5 of Law No. 5651 to keep traffic data, and to answer lawful requests from competent authorities.

Legal basis

It is expressly provided for by law (Art. 5(2)(a)) and it is our legal obligation (Art. 5(2)(ç)).

Legal obligations and requests

Whose data

Anyone concerned

Glojour's role

Data controller (role c)

What data

Your requests under the KVKK and their outcome; information that is the subject of lawful requests from competent public authorities.

Purpose

To let you exercise your rights and to meet our legal obligations.

Legal basis

Our legal obligations (Art. 5(2)(ç)) and the establishment, exercise or defence of legal claims (Art. 5(2)(e)).