Privacy Policy

Fizyo Takip Effective Date: 19 July 2026

The Fizyo Takip application (the "Application") is developed and operated by Mehmet Akif Kara ("Data Controller", "Developer", "we").

This Privacy Policy explains which personal data is processed when you use the Application, for which purposes it is processed, which legal grounds it relies on, with whom it may be shared, how long it is retained, and the rights you have under Turkish Personal Data Protection Law No. 6698 ("KVKK").

This text constitutes an information notice prepared within the scope of Article 10 of the KVKK and the Communiqué on the Principles and Procedures to be Followed in Fulfilling the Obligation to Inform.

We recommend that you read this Privacy Policy carefully before using the Application.

1. Definitions

The following terms used in this Privacy Policy have the meanings indicated:

Application: The Fizyo Takip mobile application, which enables physiotherapists to follow up their clients, carry out assessments, create exercise programmes and communicate with their clients.
Physiotherapist User: The physiotherapist or relevant healthcare professional who uses the Application within the scope of their professional activities.
Client User: The natural person who uses the client mode of the Application and can connect with a Physiotherapist User.
Personal Data: Any information relating to an identified or identifiable natural person.
Special Categories of Personal Data (Health Data): Data regarded as special categories of personal data under the KVKK; any information relating to a person's physical or mental health, and data processed in the context of the provision of healthcare services.
Data Controller: The person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system. Within the scope of this policy, the Data Controller is Mehmet Akif Kara.
Device: The smartphone or tablet on which the Application is run.

2. Personal Data Processed

In order to provide the services offered by the Application, the following personal data may be processed depending on how you use it.

2.1. Account and Identity Information

The following information may be processed so that you can create an account and manage it:

First and last name
E-mail address
Authentication method (e-mail/password, Sign in with Google or Sign in with Apple)
Profile photo (optional)

For Client Users, the following may additionally be processed:

Age
Date of birth
Gender
Phone number
Height
Weight

For the registration of users under the age of 18, the following may also be recorded in order to fulfil legal obligations:

Name of the parent or legal guardian
Parent/legal guardian consent information
Date of consent

2.2. Health Data (Special Categories of Personal Data)

Physiotherapist Users may record health data belonging to their clients in the Application within the scope of their professional activities. In this context, the following data may be processed:

Identity and Contact Information

First and last name
Age
Gender
Phone number
E-mail address

Clinical Information

Clinical diagnoses
Past illnesses
Systemic diseases
Surgical history
Allergies
Medication used
Personal and family medical history

Physical Measurements

Height
Weight
Waist, hip, neck and similar circumference measurements
Blood pressure
Oxygen saturation (SpO₂)
Resting heart rate

Clinical Assessments

Pain assessments (VAS, NPRS, etc.)
Red flag assessments
Functional assessment results
Treatment goals
Session notes
Observations and assessments relating to treatment

Exercise Programmes

The Application contains ready-made exercise videos. Physiotherapist Users may additionally upload:

their own exercise videos,
images,
descriptions,

and may create personalised exercise programmes from these and assign them to their clients.

In this context, the following may be processed:

uploaded media files,
created exercise programmes,
completed exercise records,
exercise progress information,
reminder records.

The Physiotherapist User is entirely responsible for the lawfulness of the content they upload to the system (including personal data, copyright and other relevant legislation). The Developer hosts this content solely as a technical infrastructure provider.

Photograph and Video Records

Within the scope of the treatment process, the following may be stored as part of the client record:

Photographs
Videos
Assessment images

Digital Assessment Tools

The Application may include the following digital assessment tools:

Postural Analysis
Digital Goniometer (Manual)
AI Goniometer from Photo
Live AI Goniometer
Gait Analysis
Single Leg Squat Analysis
Single Leg Hop Test
Squat Jump Test
Dynamic Knee Flexion Analysis

During the use of these tools, the following may be processed:

photographs,
videos,
camera images,
angle measurements,
analysis results.

Important Notice

The pose detection, anatomical landmark identification and image processing operations used in these analyses are performed entirely on the user's device. Photographs or videos captured for analysis purposes are not sent to any artificial intelligence server.

Photographs, videos and analysis results that the user chooses to save may be stored on a secure cloud infrastructure as part of the client record.

AI-assisted analyses are merely supportive assessment tools for the physiotherapist. These analyses do not on their own replace medical diagnosis, treatment recommendations or clinical decisions. The final assessment and treatment decision belongs to the relevant healthcare professional.

2.3. Messaging Data

The following data may be processed in the context of messages exchanged within the Application between a physiotherapist and a client:

Text messages
Photographs
Videos
Voice messages
File attachments

This data is protected during transmission with secure communication protocols (HTTPS/TLS) and is stored so that it is accessible only by authorised users.

2.4. Appointment and Calendar Data

The following information may be processed in order to provide appointment services:

Created appointments
Appointment requests
Appointment dates and times
Availability information
Physiotherapist–client connection requests
Reminder records

2.5. AI Chat Assistant

When you use the AI chat assistant offered within the Application, the following:

the messages you write,
the chat history created,
the responses given by the artificial intelligence

may be transmitted to the OpenAI service via our secure servers in order to generate a response.

It is recommended that personal data, health data or identity information belonging to clients is not entered into the AI assistant.

When the voice input feature is used, speech recognition is carried out via services provided by the device's operating system.

Old chat records are automatically deleted after a certain period.

2.6. Subscription and Payment Information

The Application offers Free, Pro and Premium subscription plans. Subscription purchase, renewal and cancellation transactions are carried out directly through the Apple App Store or the Google Play Store.

In this context, the following information may be processed:

Subscription plan type
Subscription start and end date
Trial period information
Product ID
Transaction ID
Subscription status
Anonymous user identifier (App User ID)

The RevenueCat service is used in order to verify and manage subscriptions.

Important Notice

Credit card numbers, CVV/CVC codes, bank account details or similar payment data are never collected, stored or processed by us. All payment transactions are carried out solely through the secure payment infrastructures of Apple and Google.

2.7. Technical and Device Data

The following technical information may be processed so that the Application can operate securely and reliably.

Notification Data

In order to send notifications, the following may be processed:

Firebase Cloud Messaging (FCM) device token

When you log out of your account or the notification service is disabled, newly created notification tokens may be updated or deleted.

Crash and Error Logs

Firebase Crashlytics is used in order to improve the reliability of the Application. In this context, the following technical information may be processed:

Application version
Operating system version
Device model
Crash time
Error logs
Technical diagnostic information

These records are used solely for the purpose of detecting and resolving application errors.

Usage Analytics

Firebase Analytics is used in order to develop the Application. In this context, the following anonymous or statistical usage data may be processed:

Screens viewed
Features used
Session counts
Interaction counts
Application version
Device type
Operating system
Subscription plan type

Client identity information, health data, message content, photographs, videos and analysis results are not sent to Firebase Analytics.

Analytics data is evaluated only in aggregate and statistical form for the purposes of improving service quality, measuring performance and developing new features.

Location Data

The Fizyo Takip application does not collect, track or process location data.

2.8. Legal Records

In order to fulfil our obligations under the KVKK and to satisfy our legal burden of proof, the following may be recorded:

type of document accepted
document version
date of acceptance
time of acceptance
IP address
country information derived from the IP address
device and client information (User-Agent)

For users under the age of 18, the following may additionally be retained in order to fulfil legal obligations:

parent or legal guardian consent,
date of consent,
consent record.

These records are used solely for the purposes of fulfilling legal obligations, resolving disputes and, where necessary, satisfying the burden of proof.

3. Purposes and Legal Grounds for Processing Personal Data

Your personal data is processed on the basis of the personal data processing conditions set out in Articles 5 and 6 of Personal Data Protection Law No. 6698 ("KVKK"), for the purposes of providing and improving the Application, ensuring its security and fulfilling obligations arising from applicable legislation.

Your personal data may be processed for the following purposes:

Creating an account and managing the user account

Creating the user account
Carrying out authentication processes
Ensuring account security
Managing the user profile

Legal Ground: Processing being necessary for the conclusion or performance of a contract (KVKK Art. 5/2-c).

Keeping digital records for the delivery of physiotherapy services

Creating client records
Recording clinical assessments
Creating exercise programmes
Following up the treatment process
Keeping session records
Generating reports

Legal Ground: Processing being necessary for the conclusion or performance of a contract (KVKK Art. 5/2-c).

With regard to health data: Special categories of personal data are processed within the framework of the conditions provided for in the relevant legislation. The Physiotherapist User is responsible for ensuring that the necessary legal basis (for example explicit consent or other data processing conditions provided for in the relevant legislation) is in place before recording their client's health data in the Application.

Enabling communication between physiotherapist and client

Messaging service
File sharing
Sending voice messages
Delivering notifications

Legal Ground: Processing being necessary for the conclusion or performance of a contract (KVKK Art. 5/2-c).

Providing appointment and calendar services

Creating appointments
Sending reminder notifications
Calendar management

Legal Ground: Processing being necessary for the conclusion or performance of a contract (KVKK Art. 5/2-c).

Managing subscriptions

Verifying purchase transactions
Checking subscription status
Providing access to premium features

Legal Ground: Processing being necessary for the conclusion or performance of a contract (KVKK Art. 5/2-c) and the data controller's fulfilment of its legal obligations (KVKK Art. 5/2-ç).

Providing the AI chat assistant service

Messages sent to the AI chat assistant may be processed in order to generate a response for the user and may be transmitted to the OpenAI service for this purpose.

Users are expected not to enter clients' identity information, health data or other special categories of personal data into the AI chat assistant.

Legal Ground: Processing being necessary for the conclusion or performance of a contract (KVKK Art. 5/2-c).

Ensuring the security and performance of the Application

Technical data may be processed for the following purposes:

Detecting errors
Examining crash logs
Performing performance analyses
Remedying security vulnerabilities
Improving service quality

Legal Ground: The legitimate interest of the data controller (KVKK Art. 5/2-f).

Usage analytics and product development

Anonymous or statistical usage data may be processed for the purposes of:

improving the user experience,
planning new features,
measuring performance,
improving the application.

Client identity information, health data and message content are not sent to analytics systems.

Legal Ground: The legitimate interest of the data controller (KVKK Art. 5/2-f).

Advertising services

Advertisements may be shown to users on the free subscription plan. In order to serve advertisements, the advertising provider may process certain technical identifiers under its own policies.

Clients' health data is never used for advertising purposes and is not shared with advertising providers.

Legal Ground: The legitimate interest of the data controller and, where necessary, the explicit consent of the user.

Fulfilment of legal obligations

Personal data may be processed for the following purposes:

fulfilling obligations arising from legislation,
responding to requests from official authorities,
resolving disputes,
protecting legal rights,
satisfying the burden of proof.

Legal Ground: The data controller's fulfilment of its legal obligations (KVKK Art. 5/2-ç) and the legitimate interest of the data controller (KVKK Art. 5/2-f).

Important notice regarding health data

Physiotherapist Users are responsible for fulfilling the necessary obligations under the applicable KVKK, relevant health legislation and professional ethical rules when recording their clients' personal data and health data in the Application.

The Developer provides the Application as a technical infrastructure service. The Application does not on its own provide healthcare services, make medical diagnoses, recommend treatment or replace the clinical assessment of a healthcare professional.

4. Where Data Is Stored

Your personal data is stored on reliable cloud infrastructures so that the service can be provided and the data can be kept securely. The infrastructures used and the types of data stored are set out below.

Google Firebase (Authentication): User account and authentication information — Login processes and account security
Google Firebase (Cloud Firestore): Account information, client records, health data, appointments, message records, subscription information, legal records — The Application's core database service
Cloudflare R2: Photographs, videos, audio recordings, file attachments, exercise videos, profile images and other media files — Secure storage of media files
Firebase Cloud Messaging (FCM): Notification tokens (FCM Token) — Sending push notifications
Firebase Crashlytics: Technical error logs — Detecting application errors
Firebase Analytics: Anonymous usage statistics — Improving the service and performance analysis

Access to media files is provided only after the necessary authorisation, using time-limited and secure access links (signed URLs).

Server-side access is restricted by authentication and authorisation mechanisms. Users can only reach data they are authorised to access.

5. Third-Party Services

The following third-party service providers are used in order to deliver the Application. These service providers process only the data necessary for the service they provide and are subject to their own privacy policies.

Firebase Authentication — Google LLC — User authentication
Firebase Firestore — Google LLC — Database service
Firebase Cloud Functions — Google LLC — Server-side operations
Firebase Cloud Messaging — Google LLC — Push notifications
Firebase Crashlytics — Google LLC — Crash reports
Firebase Analytics — Google LLC — Anonymous usage analytics
Cloudflare R2 — Cloudflare, Inc. — Media storage
RevenueCat — RevenueCat, Inc. — Subscription management
OpenAI API — OpenAI — AI chat assistant
Google AdMob — Google LLC — Advertising on the free plan
Apple App Store — Apple Inc. — App distribution and payments
Google Play Store — Google LLC — App distribution and payments
Google Sign-In — Google LLC — Optional login method
Sign in with Apple — Apple Inc. — Optional login method

Relevant Privacy Policies

Google Firebase: https://firebase.google.com/support/privacy
Cloudflare: https://www.cloudflare.com/privacypolicy/
RevenueCat: https://www.revenuecat.com/privacy
OpenAI: https://openai.com/policies/privacy-policy
Google AdMob: https://support.google.com/admob/answer/6128543
Apple: https://www.apple.com/legal/privacy/
Google: https://policies.google.com/privacy

Advertisements may be shown via Google AdMob to users on the free subscription plan. In order to serve advertisements, Google AdMob may process the device advertising identifier or similar technical identifiers under its own privacy policy.

Clients' personal data, health data, message content, photographs or treatment records are not used for advertising purposes and are not shared with advertising providers.

Transfer of Data Abroad

The servers of some service providers used in the Application may be located outside Türkiye. For this reason, depending on the nature of the service used, your personal data may be processed or stored on servers abroad.

In cases requiring transfer of data abroad, we act in accordance with the applicable provisions of the KVKK. Where explicit consent is required, such consent is obtained separately, or reliance is placed on the other data transfer conditions provided for in the relevant legislation.

Except in cases permitted by applicable legislation, your personal data is not sold, rented or shared with third parties for marketing purposes.

6. Device Permissions

The Application may access the following device features only if you use the relevant feature and grant the necessary permission.

Camera: Taking treatment photographs and videos, posture analysis, use of AI-assisted assessment tools
Photo Gallery: Adding photographs and videos to client records or messages
Microphone: Sending voice messages and using the voice input feature
Speech Recognition: Voice input to the AI chat assistant
Notifications: Sending appointment, message, exercise reminder and system notifications

The Application accesses your device's camera, microphone, photo gallery or other system features only while the relevant function is in use.

You may withdraw the permissions you have granted at any time from your device's operating system settings. Removing permissions only causes the relevant feature to stop working; other features of the application may continue to be used to the extent possible.

The Fizyo Takip application does not access or process your location, contacts, SMS messages, call logs or calendar data.

7. Data Retention Periods

Your personal data is retained only for as long as required by the purposes of processing and in accordance with applicable legislation.

Account Data

Information relating to your account is retained for as long as your account remains active.

Account Deletion

When you delete your account from within the application:

your account is deactivated,
your data is kept in a restorable state for 30 days.

If you log in again within this period, you may cancel your account deletion request.

At the end of the 30-day period, the following are permanently and irreversibly deleted through automated processes:

your account information,
your client records,
your messages,
your media files,
your health data.

Client Records

Client records deleted by a Physiotherapist User are likewise permanently deleted after the 30-day waiting period.

The deletion covers:

database records,
photographs,
videos,
audio recordings,
file attachments.

AI Chats

AI chat histories are automatically deleted after a certain period.

Unused Accounts

Client accounts that are never used, and the data linked to them, may be automatically deleted by the system if not logged into or used for 180 days (6 months).

Analytics Data

Anonymous usage data collected by Firebase Analytics is retained for a maximum of 14 months and is automatically deleted at the end of this period in accordance with the relevant service provider's data retention policies.

Subscription and Accounting Records

Records relating to subscription and payment verification may be retained for as long as required by applicable financial and legal obligations.

Uninstalling the Application

Removing the Application from your device does not automatically delete the cloud data linked to your account. If you want your data to be deleted entirely, you must use the "Delete Account" feature within the application.

8. Data Security

Appropriate technical and administrative measures are applied in order to protect the confidentiality, integrity and security of your personal data. In this context:

All data transmission is encrypted with HTTPS/TLS.
User access is restricted by authentication and authorisation rules.
Access to media files is provided only through time-limited secure links (Signed URLs).
Security mechanisms are applied on the server side to prevent unauthorised access.
Security updates are carried out regularly.
Reliable cloud service providers are used in the application infrastructure.

Image Analyses

The pose detection and image processing operations used in posture analysis, AI-assisted goniometry and other image-based analyses are carried out on the device to the extent possible.

Images captured for the purpose of these analyses are not sent to external artificial intelligence services during the analysis.

User Responsibility

Users are themselves responsible for:

ensuring the security of their devices,
using a strong screen lock,
protecting the confidentiality of their account information,
not sharing their accounts with unauthorised persons.

Important Notice About Security

No method of data transmission over the internet or electronic storage is completely secure. For this reason, although reasonable technical and administrative security measures are applied to protect your personal data, absolute security cannot be guaranteed.

9. Children's Privacy

Fizyo Takip has been developed for use by physiotherapists and their clients.

For users under the age of 18 to create a client account, the consent of a parent or legal guardian must be obtained during registration. An account cannot be created without the necessary consent.

In this context, the following may be recorded in order to fulfil legal obligations and, where necessary, to satisfy the burden of proof:

the name of the parent or legal guardian,
consent information,
date of consent.

Physiotherapist Users are themselves responsible for obtaining and, where necessary, documenting the required parental or legal guardian consents under applicable legislation before recording the health data of clients under the age of 18 in the Application.

If a parent or legal guardian believes that their child's personal data has been processed without the necessary consent, they may contact us using the contact details set out below. The request will be assessed and the necessary actions will be taken within a reasonable period.

10. Your Rights Under the KVKK

Pursuant to Article 11 of Personal Data Protection Law No. 6698, you have the following rights:

To learn whether your personal data is being processed,
To request information if it has been processed,
To learn the purpose of processing and whether the data is used in accordance with that purpose,
To know the third parties to whom your personal data is transferred domestically or abroad,
To request the correction of personal data that has been processed incompletely or incorrectly,
To request the deletion or destruction of personal data within the framework of the conditions set out in the KVKK,
To request that any correction or deletion be notified to the third parties to whom the data was transferred,
To object to an outcome to your detriment arising from the analysis of data exclusively by automated systems,
To claim compensation if you suffer damage due to unlawful processing of your personal data.

You may submit your requests relating to these rights via the contact address set out below. Applications are assessed and concluded within the periods provided for in applicable legislation.

Thanks to the features offered within the Application, you may also perform certain actions directly yourself, such as:

account deletion,
client record deletion,
chat deletion.

11. Cookies and Similar Technologies

Fizyo Takip is a mobile application and does not use classic cookie technology as used in internet browsers.

However, third-party software development kits (SDKs) such as Firebase, RevenueCat and AdMob may use device identifiers or similar technical identifiers under their own privacy policies in order to provide their services.

12. Third-Party Links

The Application may contain links directing users to third-party websites, support pages or privacy policies.

The Data Controller is not responsible for the content, security practices or privacy policies of websites accessed through these links.

Users are advised to review separately the privacy policies of the third-party websites they visit.

13. Transfer of the Business

In the event of the full or partial transfer, merger or restructuring of the Fizyo Takip application, its business or related assets, your personal data may be transferred in accordance with applicable legislation.

In such a case:

users' rights under this Privacy Policy continue to be protected,
the acquiring party is expected to process personal data at a level of protection at least equal to that set out in this policy,
users are informed by appropriate means where necessary.

14. Changes to This Privacy Policy

This Privacy Policy may be updated from time to time in line with applicable legislation, technical requirements or changes in the services offered.

Significant changes are announced to users within the application, on our website or through other communication channels deemed appropriate.

Where required by legislation, separate consent may be obtained for the relevant changes.

The current Privacy Policy is always published within the application and on our official website. The most current version of the policy enters into force on the date it is published.

15. Data Controller and Contact

Data Controller

Mehmet Akif Kara

E-mail: akiffkaraakif217@gmail.com

You may submit any questions, requests and applications regarding the processing of your personal data to us via the e-mail address above.

Applications are assessed and concluded within the statutory periods under the KVKK and the relevant legislation.

This Privacy Policy has been prepared for the purpose of fulfilling the obligation to inform under Personal Data Protection Law No. 6698. With regard to personal data processing activities requiring explicit consent, your explicit consent will be obtained separately where necessary. The current version of the Privacy Policy will always be accessible within the application and on our official website.