DiyetPanel Privacy Policy

Effective date: 27 March 2026

This Privacy Policy explains how DiyetPanel ("Platform", "we", "us" or "our") collects, uses, stores and discloses personal data when you use our website, mobile application and related services (collectively, the "Services"). We are committed to protecting your privacy and handling your personal data in a transparent and secure manner.

1. Data Controller

2. Scope

This policy applies to personal data processed through our Services, including the web site, mobile app, admin panels and integrations. It covers clients (patients / diet plan recipients), nutritionists, visitors and business partners.

3. Categories of Personal Data We Collect

3.1 Data Provided Directly

• Full name
• Email address and phone number
• Date of birth and gender
• Address and contact details
• Username and password (passwords are stored as one-way cryptographic hashes — never in plain text)
• Payment and billing details (card details are processed exclusively by certified payment providers and are not stored on our systems in full)

3.2 Health and Sensitive Data

We may process health-related and special categories of data such as height, weight, body fat percentage, muscle mass, waist/hip measurements, diet history, chronic conditions, allergies, medication use and laboratory results. Such data is treated as sensitive and is processed only with your explicit consent or another valid legal basis.

3.3 Technical and Automatically Collected Data

• IP address, device type, operating system and browser information
• App version and crash / diagnostic logs
• Session logs, page views and in-app navigation events
• Push notification tokens (e.g., APNs / FCM tokens) used solely to deliver service notifications

3.4 Third-Party Sources

We may receive limited information from third-party services, such as payment processors and authentication providers, only to the extent needed to provide the requested service.

4. Purposes of Processing and Legal Bases

We process personal data for the following purposes and legal bases:

1. Provision of services and contract performance: account creation, client management, meal plans, appointment scheduling and payment processing. (Contract performance)
2. Health monitoring and care: tracking clients' physical data and producing diet/nutrition reports. (Explicit consent / necessary for health care purposes)
3. Notifications and communications: account notices, appointment reminders, security alerts and marketing communications where you have explicitly consented. (Contract, legitimate interest or consent)
4. Payments and bookkeeping: processing payments and keeping fiscal records. (Contract performance and legal obligations)
5. Service improvement and analytics: usage analytics and performance monitoring using aggregated/anonymized data where possible. (Legitimate interest)
6. Legal compliance: meeting regulatory, tax and accounting obligations. (Legal obligation)
7. Personalization: tailoring the user experience and nutritional recommendations within the app. (Legitimate interest or consent)

5. Processing of Sensitive / Health Data (Guideline 5.1.3)

Sensitive and health-related data are processed only to the extent strictly necessary and are subject to the following additional safeguards:

• Health data is collected only after obtaining your explicit, informed consent.
• You may withdraw your consent at any time via the app settings or by contacting us; withdrawal will not affect the lawfulness of prior processing.
• Health data is never sold, licensed, or rented to any third party.
• Health data is never used for advertising, behavioural tracking, or any purpose beyond the direct provision of nutrition/diet services.
• Access to health data is strictly limited to authorized personnel (your assigned dietitian) and is protected by role-based access controls.
• If you delete your account, all associated health data is permanently erased within 30 days unless a longer retention period is required by law.

6. Data Sharing and Disclosure (Guideline 5.1.2)

We are transparent about how and with whom we share your data. We may share personal data only in the following circumstances:

• Service providers (data processors): hosting, email delivery, payment processors, crash analytics and backup providers. All processors are bound by data processing agreements and may only process your data under our instruction.
• The nutritionist/dietitian assigned to you: your health and contact data is shared with the professional managing your diet plan on the Platform, with your consent.
• Authorities: when required by applicable law, a court order or governmental authority.
• Business transfers: in connection with a merger, sale or acquisition of assets, we will notify users prior to data transfer where required by law.

7. Third-Party SDKs and Analytics

Our mobile application may use third-party SDKs for crash reporting, push notifications and performance monitoring (e.g., Firebase / Google). These SDKs may collect limited technical data (device identifiers, crash logs) in accordance with their own privacy policies. We configure all third-party SDKs to collect the minimum data required and disable advertising-related features where available. Links to relevant third-party policies:

• Google / Firebase Privacy Policy

We do not integrate advertising SDKs that track users across apps or websites without explicit consent.

8. International Transfers

Your personal data may be transferred to service providers located outside Turkey (e.g., cloud hosting, CDN). Before any such transfer, we ensure appropriate safeguards such as standard contractual clauses, security assessments and compliance with applicable data protection laws (including KVKK).

9. Data Retention

• Account and client records: retained for the duration of the service and as required by legal obligations (e.g., tax law).
• Health and diet data: retained while your account is active; deleted within 30 days of account deletion unless a longer retention period is legally mandated.
• Payment and invoice records: retained according to applicable accounting law retention periods.
• Marketing data: retained while you maintain consent or until you withdraw it.
• Technical logs: retained for a limited time for security and troubleshooting; anonymized or deleted as soon as no longer needed.

10. Cookies and Tracking

We use cookies and similar technologies for session management, security and preference storage. We may use analytics cookies to understand how users navigate our Services. You can control cookies through browser settings or application preferences. Disabling certain cookies may limit some features of the Services. We do not use tracking technologies that target you with advertisements across other apps or websites.

11. Data Security

We implement technical and organizational measures to protect personal data, including:

• TLS/HTTPS encryption in transit
• Encryption or one-way hashing of sensitive stored data
• Role-based access controls and least-privilege principles
• Regular security reviews and backups

No system can be guaranteed 100% secure. If you suspect a security issue or data breach, please contact us immediately at ismailtsn9981@icloud.com.

12. Your Rights and Data Controls (Guideline 5.1.2)

Under applicable data protection laws (KVKK / GDPR equivalents) you have the following rights, which you can exercise at any time:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion / Erasure: Request deletion of your personal data and account. You may delete your account directly from within the app or by emailing us. All data will be erased within 30 days.
• Data Portability: Request your data in a machine-readable format.
• Objection / Restriction: Object to or request restriction of processing in certain circumstances.
• Withdraw Consent: Withdraw consent for any processing activity based on consent. Withdrawal does not affect prior lawful processing.
• Opt-out of Marketing: Unsubscribe from marketing communications at any time via the unsubscribe link in emails or app notification settings.

To exercise any of these rights, contact us at the details below. We will respond within the legally required timeframe (30 days under KVKK).

13. Data Breach Notification

In the event of a personal data breach, we will assess the risk and notify affected individuals and relevant authorities (KVKK Board) as required by applicable law, within 72 hours where possible.

14. Third-Party Links and Integrations

Our Services may include links and integrations with third-party services. Those services have their own privacy practices; we recommend reviewing their policies before sharing personal data with them. We are not responsible for third-party data practices.

15. Minors

Our Services are primarily intended for users aged 18 and above. If a minor under 18 uses the Services, parental or legal guardian consent must be obtained before any personal data, especially health data, is collected. If we learn that we have collected data from a minor without appropriate consent, we will delete it promptly.

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will publish changes on our website and provide prominent notice for material changes via email or in-app notifications at least 14 days before they take effect. Each version will include an effective date.

17. Contact and Complaints

If you have questions, requests or complaints about this Privacy Policy or our data practices, please contact:

You also have the right to lodge a complaint with the relevant supervisory authority (Kişisel Verileri Koruma Kurumu – KVKK, www.kvkk.gov.tr).