1. Data controller
| Legal name | the AURA platform operator (when the incorporation of the legal entity is completed, the legal name, address, MERSİS/tax number, KEP address and VERBİS information will be added to this section) |
| Contact (data subject requests · security reports · objections) | In-platform request form: /kvkk-basvuru (the e-mail channel will be added to this section when the mailbox is opened) |
| Representative for patients in the European Union (GDPR Article 27) | (to be designated before launch and added to this section) |
The AURA telehealth platform and Doctorium are operated by the same legal entity; there is a single data controller. If the Health Tourism Agency is incorporated as a separate legal entity, transfers to it will be shown in a separate row in Section 7.1.
2. What AURA is and in which relationship your data is processed
AURA is a multilingual digital health platform that connects the patient with a doctor in the appropriate specialty and coordinates remote consultation, second opinion, health tourism planning and post-operative follow-up. There are four ways to begin: Talk to a doctor (preliminary assessment + remote consultation), Second Opinion (a written specialist opinion on an existing diagnosis/treatment plan), Health Tourism (treatment and travel planning) and Free Care (free consultation with volunteer doctors). These are accompanied by post-operative follow-up, secure sharing of your health records with third parties, and applications to the Ethics Board.
AURA does not diagnose or treat. Medical assessment, diagnosis, treatment and prescription decisions belong to licensed doctors; AURA organises your information, suggests the appropriate specialty and coordinates the consultation and the process. No AI-assisted step produces a medical decision. AURA is not an emergency service; in a life-threatening situation call 112 (or the emergency number of the country you are in) (Document A03, Section 4).
The Platform is open to persons who are 18 years of age or older.
3. Personal data processed
3.1 Account and contact
| Category | Data |
|---|---|
| Registration | Full name, e-mail address, an irreversible digest of your password (the password itself is never stored). If you sign in with Google or Apple, only the identity identifier and e-mail are obtained from the provider |
| Profile | Country, preferred language, mobile phone (encrypted), contact preference (in-app · SMS · e-mail), health history summary (encrypted; Section 3.2) |
| Account security | Digests of e-mail verification and password reset links (valid 24 hours / 1 hour; deleted once used) |
| Age declaration | Your declaration of date of birth at registration confirming that you are 18 or older — not stored, not recorded; checked only at the gate |
3.2 Health data — special categories of personal data
| Category | Data | Note |
|---|---|---|
| Preliminary assessment (triage) | Your complaint, its duration, your answers to specialty-specific questions, urgency level, and the suggested specialty with its rationale | The complaint and rationale are stored encrypted; AI-assisted preliminary assessment is subject to your separate explicit consent (Section 10) |
| Health history summary | Chronic conditions, regular medication, smoking, previous major surgery | Profile memory; pre-fills your next case |
| Medical documents | Reports, test results, prescriptions and imaging files you upload (including DICOM) | Encrypted before upload to storage; the storage provider sees only the encrypted form. DICOM files reach the specialist pool only after identifying tags are removed and text burned into the image is masked |
| Remote consultation | Video and audio are not recorded. The live caption/translation text (transcript) generated during the consultation and the doctor's consultation note (SOAP) are stored encrypted | Simultaneous interpretation is subject to your separate explicit consent (Section 10) |
| Clinical results | Discharge summary/report, laboratory results (LOINC), diagnosis code (ICD-10), recommended procedures | Encrypted |
| Post-operative follow-up | Daily check-in answers, your note, recovery photos you upload | Encrypted; when follow-up ends, clinical staff access closes and the record remains with you only |
| Second Opinion file | Your existing diagnosis/treatment plan, your documents, the specialist opinion | Encrypted; anonymous preview in the specialist pool |
| Insurance health declaration | Declaration of chronic condition, regular medication, smoking, major surgery (health tourism package only) | Encrypted, fixed to the case; staff, doctors and the agency do not see the raw declaration, only the risk multiplier. Separate consent is obtained (Document A04-d) |
| Ethics Board application | Subject of complaint, description, evidence, rationale | Encrypted; the Board does not see your identity |
| Free Care application | Patient name (you or a relative), country, complaint, duration | (!) If you apply on behalf of a relative, you must enter their data with their knowledge and consent and tick the declaration box on the form (Document A02, Section 3.4) |
3.3 Travel, package and booking data (health tourism track)
Your preferred treatment date range, hotel/interpreter/insurance level preferences, hospital choice, estimated package price and booking status. No payment card or bank details are collected — payment, escrow and insurance flows are currently a simulation; no actual charges are taken and no policy is issued.
3.4 Consent records
Every approval/consent: scope, version, digest (hash) of the text you approved, date-time, IP address and browser information; the records are kept in a tamper-evident chain and time-stamped. You can view your own record at /onam/kanit.
3.5 Transaction security
Login records, IP address, browser/device information, and a record of every meaningful access to your health records (who, when, which record) — in a chain that cannot be deleted or altered afterwards; you can see it at /erisim-kaydi.
3.6 Cookies and local storage
→ Cookie and Local Storage Policy (Document A05) (session and appearance cookies only; no analytics/advertising cookies).
3.7 Data that is not processed
- Copies of identity documents, Turkish ID number or passport are not requested (an optional identifier is processed only if you enter it yourself and only for matching clinical records).
- Payment/bank details are not collected (Section 3.3).
- Location data (GPS) is not collected; only the country you declare.
- Biometric data is not processed (video consultations are not analysed for face recognition).
- Genetic data, criminal convictions, membership of associations/unions/political parties and beliefs are not requested; if you write them in free text, they are processed only in their clinical context.
4. Purposes of processing
- Creating, verifying and managing your account; age (18+) check
- Preliminary assessment of your complaint and routing to the appropriate specialty (the AI-assisted part is subject to your explicit consent)
- Doctor matching, appointments and conducting the remote consultation; preparation of the doctor's consultation note and report
- Simultaneous interpretation of the consultation (subject to your explicit consent) and translation of your documents
- Forwarding your Second Opinion file to the specialist and presenting the opinion to you
- Matching your Free Care application with a volunteer doctor
- Health tourism planning: treatment/package preview, hospital and travel coordination, insurance risk assessment (the health declaration is subject to your separate consent)
- Post-operative follow-up: daily check-ins, forwarding warning signs to the doctor
- Sharing your health records with third parties on your instruction (link, duration, password and scope are your choice)
- Anonymous review of your Ethics Board application
- Delivery of notifications (in-app · browser push · the channel you choose)
- Information security, prevention of misuse, access control, responding to legal requests and fulfilling statutory obligations
- Aggregated, de-identified measurement of service quality (no person-level analytics)
5. Legal bases
5.1 KVKK (Türkiye — Personal Data Protection Law No. 6698)
| Purpose | Legal basis |
|---|---|
| Account, verification, security, notifications (1, 11, 12) | Article 5(2)(c) conclusion and performance of a contract · Article 5(2)(ç) legal obligation · Article 5(2)(f) legitimate interest (security) |
| Processing of health data (2, 3, 5, 6, 7, 8, 10) | Article 6 — explicit consent (declaration in Section 14). Processing carried out by your doctor, under a duty of confidentiality, for the purposes of medical diagnosis, treatment and care services additionally falls under Article 6(3). Withdrawing your consent does not end the retention of clinical records created during the performance of the service, which are kept with access closed for the statutory retention period under Article 7 (Section 8) |
| AI-assisted preliminary assessment and document translation (2, 4) | Article 6 — separate explicit consent (AI_TRIAGE, Document A04-b) |
| Simultaneous interpretation (4) | Article 6 — separate explicit consent (AI_INTERPRET, Document A04-c) |
| Insurance health declaration (7) | Article 6 — separate explicit consent (Document A04-d) |
| Sharing link (9) | Your instruction — in the nature of explicit consent under Article 5(1); you create and revoke the link |
| Transfers abroad (Section 7) | Article 9 — currently your explicit consent; once the operating legal entity is incorporated, provider agreements/undertakings (Document 18) |
| De-identified quality measurement (13) | Not personal data (aggregated) |
Your consent is freely given; however, by the nature of a health service, no consultation, second opinion or follow-up can be provided without processing your health data. AI-assisted preliminary assessment is the first step of a case: if you do not give this consent, a case cannot be created and you will have chosen not to receive the service. Consent for interpretation is asked only if the languages of the consultation differ, and you may continue without interpretation. You may withdraw your consent later — processing carried out until then remains lawful.
5.2 GDPR (patients resident in the European Union)
If you are resident in the European Union, the General Data Protection Regulation also applies: account and service operations under Article 6(1)(b) (contract) and 6(1)(f) (legitimate interest — security); health data under Article 9(2)(a) — explicit consent; transfers outside the EU under Article 44 et seq. (Section 7.3: European Commission standard contractual clauses — provider agreements to be signed by the legal entity). Your rights are set out in Section 9; you may lodge a complaint with the data protection authority of your own country.
6. Method of collection
Data is collected electronically through registration and profile forms, the preliminary assessment form, document uploads, remote consultations (live caption/translation stream), notes and reports entered by the doctor, daily follow-up forms, sharing and complaint screens, Google/Apple sign-in providers and automatic system records (login/access logs). Clinical records entered by your doctor (consultation note, discharge summary, laboratory results, diagnosis code) are also your health data.
7. Transfers
7.1 Recipients (platform roles and third parties)
| Recipient | What they see | Limit |
|---|---|---|
| The doctor assigned to you (specialty doctor, on-duty/on-call doctor, volunteer doctor, second-opinion specialist) | The clinical content of your case | Only a verified doctor who has been assigned to or has accepted your case; access is case-based and written to the chain. Before assignment, a de-identified preview in the specialist pool (name and identifiers masked) |
| Coordinator (operations) | Process, logistics and booking information | Not the clinical record |
| Health Tourism Agency (currently an in-platform role; Document A13 if it becomes a separate legal entity) | Name, country, language, phone, contact preference, hospital, treatment duration range, insurance risk multiplier | Does NOT see the raw health declaration, medical documents or clinical record |
| Partner Doctor (referring doctor abroad) | The question forwarded to them | No access to the patient database; personal names are masked |
| Ethics Board | Your application and an anonymous case summary | Does not see your identity |
| Recipients of sharing links (persons/institutions you choose) | The categories you choose (discharge summary · consultation note · laboratory · radiology) | Duration, password and download restriction are yours; every access is recorded; you may revoke the link at any time |
| Hospital / health facility | (currently: none — bookings are simulated) | This row will be updated and the version increased when real bookings begin |
| Insurance company | (currently: none — no policy is issued) | Same |
| Authorised public institutions and bodies | Where and to the extent required by law | — |
7.2 Service providers (data processors)
Server and database infrastructure is located within the European Union (Frankfurt). The following providers act as data processors:
| Provider | Purpose | Data transferred | Location |
|---|---|---|---|
| Vercel | Hosting, application delivery | Application traffic (in transit), server logs | Processing in the EU (Frankfurt); company in the USA |
| Neon | Database | All categories — health data and identity fields encrypted | EU (Frankfurt); company in the USA |
| Vercel Blob | Document and image storage | Medical documents — encrypted before upload; the provider sees only the encrypted form | Provider infrastructure |
| Anthropic (Claude) | Preliminary assessment, consultation note summary, discharge summary, recovery photo analysis, clinical and document translation | Clinical content (complaint, document text, notes) — your name is not sent (replaced with a placeholder); only with your explicit consent | USA |
| Google (Gemini Live) | Simultaneous interpretation of the consultation | Consultation audio streams live; no session state is retained; only with your explicit consent | USA |
| Ably | Consultation signalling | Connection set-up messages — no health data or transcript is sent | Global |
| Cloudflare / Metered | Video relay (when a direct connection cannot be established) | Only encrypted media traffic; content cannot be viewed | Global |
| Google · Apple | Sign-in with account (if you choose) | Identity identifier, e-mail | USA |
| Upstash | Abuse protection (rate limiting) | IP address counters — no health data | Provider infrastructure |
| Browser push services (Google, Apple, Mozilla) | Notification delivery | Notification title — no name or health information embedded | Global |
| Resend | E-mail delivery — e-mail verification, password recovery and (if you chose the e-mail channel) process notifications | E-mail address and message content; no name or health information is embedded in messages | USA |
| SMS provider | SMS notifications (if you chose the channel) | (not active today; name and location will be added to this table when activated) | — |
7.3 Transfers abroad
Some providers are legal entities headquartered in the USA; the fact that the infrastructure is in the EU does not by itself remove the transfer-abroad assessment. Limited cases in which data actually leaves the EU: AI processing (Anthropic, Google — only with your explicit consent), e-mail delivery (Resend), video relay traffic (encrypted), sign-in providers and push services. Legal basis for transfer: currently your explicit consent under KVKK Article 9; once the operating legal entity is incorporated, written undertakings / standard contractual clauses to be signed with providers (including the GDPR Article 46 standard contractual clauses) — Document 18.
8. Retention periods
| Data | Period |
|---|---|
| Account and profile data | For the duration of membership; deleted immediately when you delete your account. An account that has never opened a case and has not been logged into for three years is deleted after notice 30 days in advance |
| Clinical records (preliminary assessment, documents, consultation note and transcript, discharge summary, laboratory, follow-up, second opinion, complaint, booking) | When you delete your account, access is closed — no one, including doctors, coordinators, administrators and yourself, can open them — and they are automatically destroyed 20 years after the moment of deletion. The retention period under Turkish law also applies to patients resident abroad |
| Sharing links and recipient access records | Until the expiry you set or your revocation; all links are revoked on account deletion |
| Notifications, push subscriptions | Deleted immediately on account deletion |
| Insurance health declaration | Together with the clinical record of the case it belongs to |
| Age declaration (date of birth) | Not stored |
| E-mail verification / password reset link digests | 24 hours / 1 hour; deleted immediately once used |
| Consent records | For the retention period of the clinical record they relate to (proof); 10 years if there is no clinical record. On account deletion, IP and device information are cleared and the record remains as a de-identified verification link |
| Access and transaction security records | Chain rows are not deleted; IP and device fields are cleared after 2 years |
| Data subject request register | 3 years |
| Session cookie | 7 days (Document A05) |
This table summarises the Section 3 table of the Retention and Destruction Policy (Telehealth) (Document A06); in case of difference, that policy prevails.
9. Your rights
KVKK Article 11: to learn whether your personal data is processed, to request information, to learn the purpose of processing and whether it is used in line with that purpose, to know the third parties to whom it is transferred, to request rectification, to request erasure or destruction, to request that rectification/erasure be notified to recipients, to object to a result arising against you from analysis exclusively by automated systems, and to claim compensation for damage. GDPR (patients resident in the EU): additionally the rights to restriction of processing, data portability (the Platform offers export of your clinical records in the FHIR standard), withdrawal of consent, and complaint to a supervisory authority.
Channel and procedure → Data Subject Request Procedure (Document A07). You can view your consents at /onam/kanit; you can delete your account and personal data directly from the My Account page (two layers: personal data is actually deleted, clinical records are closed to access — Section 8).
10. Artificial intelligence and automated processing
Preliminary assessment: the AI analyses your complaint only to suggest the appropriate specialty and rank urgency; it does not produce a diagnosis, treatment or medical decision. The specialty suggestion can be changed by the doctor and operations. Simultaneous interpretation: the consultation audio is translated live; no recording is kept. Consultation note and discharge summary: the AI prepares a draft, the doctor approves it and the responsibility is the doctor's. Recovery photo: the AI forwards possible warning signs to the doctor; the decision is the doctor's. None of these operations produces an automated decision with legal effect or similarly significant effect on you (KVKK Article 11(g) · GDPR Article 22): access to the service is not automatically refused, and no price is set automatically on the basis of your personal data (in the health tourism package the insurance risk multiplier is calculated from your own declaration and is an estimate; the binding premium is set by the insurance company).
Each AI step is subject to separate explicit consent; no step starts without consent (the form does not open, no microphone permission is requested). Texts: Document A04.
11. Video and audio
Remote consultations are not recorded. Video and audio are transmitted encrypted from browser to browser; the relay server that takes over when a direct connection cannot be established carries only encrypted traffic. If simultaneous interpretation is on, the consultation audio streams live to the interpretation provider and no session state is retained; the generated caption/translation text is kept encrypted as part of your clinical record.
12. Children
The Platform does not provide services to persons under 18; a declaration of date of birth is taken at registration and is not stored. A legal representative applying in their own name for the treatment of a patient under 18 is not accepted. If you enter information on behalf of a relative in a Free Care application, the application cannot be submitted unless the box declaring that you have obtained their knowledge and consent (and that you are their legal representative if they are a minor) is ticked.
13. Changes
This notice is updated when there is a material change in processing activities. In the event of a material change the version number is increased and your renewed consent is obtained; earlier consents continue to be kept in the record chain together with the digest (hash) of the text to which they were given. The Turkish text is binding; the English translation is the second canonical text, and presentations in other languages are for information only.
14. Explicit consent declaration (separate checkbox on screen)
I have read and understood the privacy notice above. I give my explicit consent to the processing by AURA of my special categories of personal data, including my health data, for the purposes listed in Section 4; to their transfer to the doctors, platform roles and service providers set out in Section 7; and, within that scope, to their transfer abroad. I know that separate consent will be requested for AI-assisted preliminary assessment, simultaneous interpretation and the insurance health declaration. I know that I may withdraw my consent at any time.
(This declaration is part of the text you approve; the approval button is enabled only when the box is ticked.)