Data controller: Dode Yazılım (Grafta). Contact: iletisim@dodeyazilim.com
How we collect it: your data is collected electronically through this web form, as you enter it.
Data processed: clinic name, city, country, contact person, email, phone, website, monthly patient range, your message, and a pseudonymised digest derived from your IP address to prevent abuse. The digest is deleted after 24 hours. Your IP address itself is not stored in our database; it may appear in our service providers' technical request logs. During the security check, Cloudflare Turnstile collects technical signals from your browser (for example, browser and device characteristics); Cloudflare processes them and they are not written to our database.
Purpose and legal basis: to review your application, contact you and, if it's a fit, set up your clinic's panel account. Data about the clinic is processed because it is directly related to entering into a contract with the clinic (KVKK Art. 5(2)(c), GDPR Art. 6(1)(b)). The name and contact details of the person submitting the application are processed on the basis of our legitimate interest in reviewing the clinic's application and contacting it (KVKK Art. 5(2)(f), GDPR Art. 6(1)(f)). Protecting the form from spam and abuse also relies on our legitimate interest (KVKK Art. 5(2)(f), GDPR Art. 6(1)(f)).
International transfers: your application is processed on the systems of these service providers: Supabase (database; servers in Australia, Sydney; the server functions that handle the application run on Supabase's global network), Cloudflare (serving the site and form security, Turnstile; global network), Resend (emailing the application to our team; USA) and Google (Gmail; keeping the notification email in our team's inbox; USA; the email reaches this inbox through Cloudflare Email Routing). These systems are located outside Türkiye, which means the data in your application is transferred abroad. Send any questions or objections about this to iletisim@dodeyazilim.com.
Retention: rejected applications are deleted from our database 6 months after the decision, approved applications 12 months after the decision, and undecided applications 12 months after they were submitted. If your application is approved, your clinic and panel account details (clinic name, city, country, email) are kept separately from the application for as long as the account exists. When your application arrives, a notification email is also sent to our team; the copy in our inbox is not deleted automatically on this schedule, and is deleted manually when you ask for deletion.
Your rights: to exercise your rights under KVKK Art. 11 and the GDPR (for example, learning whether your data is processed, requesting information, rectification, erasure, objection), write to iletisim@dodeyazilim.com. When you ask for deletion, we delete your application record and the copy of the notification email. You can also complain to a supervisory authority: in Türkiye the Personal Data Protection Authority, in the EU the authority where you live or work. Details: privacy policy.
Notice version: kvkk-2026-09