Privacy and Security

As TOBBVITA, we value the privacy and security of our users’ personal data. This Privacy and Security statement provides general information about the personal data processed through the TOBBVITA mobile application, the TOBBVITA Remote Patient Monitoring System, compatible medical devices, related digital services, and user communication channels.

1.1. Data Controller

Spinex Io Bilişim Teknolojileri A.Ş. (“SPINEX”) acts as the data controller within the scope of applicable personal data protection legislation, including Turkish Law No. 6698 on the Protection of Personal Data (KVKK).

Contact information:

Website: https://spinex.io/
E-mail: [email protected]
Telephone: +90 850 532 62 49
Address: ODTÜ COZONE, Mustafa Kemal Neighborhood, Dumlupınar Blvd. No:280/G Inner Door No:1118, Çankaya / Ankara, Türkiye

1.2. Categories of Personal Data Processed

Depending on the features used and the services provided, the following categories of personal data may be processed:

Identity and contact information: Name, surname, e-mail address, phone number, date of birth, and other registration information.
Profile and demographic information: Age, gender, height, weight, and other user-provided profile details.
Health and medical data: Vital signs, blood pressure, heart rate, oxygen saturation (SpO₂), body temperature, blood glucose, electrocardiogram (ECG) recordings, and other health measurements collected through compatible devices or entered by users.
Medical records and user content: Medical documents, examination results, images, photographs, messages, audio content, and other files shared through the system, where applicable.
Patient and healthcare professional information: Healthcare provider and institution details, authorized connections, and information necessary to facilitate patient monitoring and communication.
Medication and measurement records: Medication schedules, reminders, measurement timestamps, historical records, and related tracking information.
Device and technical information: Device identifiers, operating system and application versions, IP address, session information, crash reports, performance data, and security logs.
Usage and communication information: Application interactions, support requests, feedback, and communication records.

The categories of data processed depend on the services and permissions used by the user.

1.3. Purposes of Data Processing

Personal data may be processed for the following purposes:

Creating and managing user accounts and providing TOBBVITA services.
Recording, displaying, and managing health measurements and medical records.
Enabling compatible medical devices to transmit measurement data to the application.
Supporting patient monitoring and the authorized sharing of relevant health information with healthcare professionals.
Providing medication and measurement reminders.
Facilitating communication between patients and healthcare professionals through available messaging, file-sharing, and video communication features.
Providing technical support, maintaining system security, detecting errors, and improving service performance.
Fulfilling legal, regulatory, record-keeping, reporting, and notification obligations.
Preventing unauthorized access, misuse, and fraudulent activity.
Exercising, establishing, or defending legal claims where necessary.

Personal data is processed on an applicable legal basis under relevant legislation. Where required, explicit consent is obtained, particularly for the processing of special categories of personal data.

1.4. Transfer of Personal Data

Personal data may be transferred, to the extent necessary and in accordance with applicable legislation, to:

Healthcare professionals and healthcare institutions authorized to access relevant patient information.
Technical infrastructure, hosting, maintenance, analytics, and customer support providers (for example Google Firebase for notifications and crash reporting, and Agora for video calls).
Business partners and service providers involved in delivering TOBBVITA services.
Authorized public institutions, regulatory authorities, and judicial authorities where legally required.
Other recipients where the transfer is necessary for a lawful purpose and supported by an appropriate legal basis.

Health data is subject to additional safeguards. Access and sharing are limited according to applicable legislation, the relevant service configuration, and the user's authorization where applicable. International transfers, if any, are carried out in accordance with applicable data protection requirements.

Personal data is not sold and is not used for advertising.

1.5. Data Security

SPINEX aims to protect personal data against unauthorized access, loss, alteration, misuse, and disclosure through appropriate technical and administrative safeguards.

Depending on the service and infrastructure involved, these measures may include access controls, authentication, secure data transmission, system monitoring, security logging, backups, and operational security procedures.

No electronic transmission or storage method can be guaranteed to be completely secure. Users should also protect their account credentials and devices against unauthorized access.

1.6. Data Retention and Deletion

Personal data is retained for the period necessary to provide the services, fulfill applicable legal obligations, maintain system security, resolve disputes, and protect legitimate legal interests.

Users may be able to delete specific records or request deletion of their TOBBVITA accounts through the available application features or by contacting [email protected]. For the steps, see TOBBVITA Account Deletion.

Some records may be subject to a security waiting period or mandatory legal retention requirements. Where deletion cannot immediately be completed due to a legal obligation, the relevant data will be retained only for the required purpose and period, subject to applicable legislation.

1.7. Your Rights

Under applicable data protection legislation, including Article 11 of the Turkish Personal Data Protection Law (KVKK), you may have the right to:

Learn whether your personal data is being processed.
Request information about the processing of your personal data.
Learn the purposes of processing and whether the data is used in accordance with those purposes.
Learn the third parties to whom your personal data has been transferred.
Request the correction of incomplete or inaccurate personal data.
Request the deletion or destruction of personal data where the applicable legal conditions are met.
Request notification of relevant corrections or deletions to third parties where required by law.
Object to certain results arising from automated processing, as provided by law.
Claim compensation for damage caused by unlawful processing, where applicable.

Requests may be submitted through the official contact channels of SPINEX in accordance with the applicable procedures and legal requirements.

1.8. Health Data and Medical Disclaimer

TOBBVITA is a remote patient monitoring and digital communication system designed to facilitate the recording, transmission, and sharing of health information between users and authorized healthcare professionals.

Measurements, records, notifications, and information displayed in the application do not, by themselves, constitute a medical examination, diagnosis, treatment, or emergency medical service. The application does not replace professional medical judgment or emergency care.

Users should follow the instructions provided by their healthcare professionals and the manufacturers of compatible medical devices. Medical decisions should be made in consultation with a qualified healthcare professional.

For emergencies, contact the appropriate local emergency services.

1.9. Changes and Contact

This statement may be updated to reflect changes in TOBBVITA services, applicable legislation, or data processing practices. Please check this page for the current version.

For questions about privacy, data security, or personal data requests, contact [email protected] or visit https://spinex.io/.