Notice on the processing of personal data

1. Identity of the data controller

Your personal data is processed by Oomi Clinic acting as data controller under the KVKK. You can always reach us at hello@oomiclinic.com or via oomiclinic.com.

The data controller's full legal name, address, and VERBİS (Data Controllers' Registry Information System) registration status will be added to this notice before launch.

• Data controller / brand: Oomi Clinic
• Contact: hello@oomiclinic.com — oomiclinic.com
• [Full legal name and address — to be added before launch]
• [VERBİS registration number — if applicable]
• [Data Controller Representative / contact person — to be added if applicable]

2. Categories of personal data processed

To provide our services, we process the categories of personal data set out below. Health data is special-category personal data within the meaning of Article 6 of the KVKK and is processed only on the basis of your explicit consent.

Which data is processed depends on the product you use (the website waitlist/contact form or the Oomi Diet mobile app) and on the permissions you grant.

• Identity and account data: email address, authentication token (stored securely on your device).
• Contact data: email, optional name, area of interest, and optional message you share in the website waitlist / contact form.
• Customer transaction data: subscription status (purchases occur through the App Store / Google Play; Oomi does not store card details).
• Special-category health data (KVKK Art. 6): height, weight and weight tracking, goals, nutrition/meal and water logs, GLP-1 medication/dose information, lab results, mood, and the onboarding clinical questionnaire (medical conditions, diabetes, eating-disorder screening, etc.).
• Health-platform data (if you allow it): step count and active calories via Apple HealthKit / Android Health Connect. This data is not used for advertising.
• Camera and image data: meal, barcode, or document scan photos (expo-camera).
• Audio data: voice recordings/commands for the voice-input feature (RECORD_AUDIO, expo-speech-recognition).
• Notification data: push notification token (APNs/FCM).
• Device and technical data: basic device identifiers, crash/error logs (if any).

3. Purposes of processing personal data

We process your personal data only for the following specific, explicit, and legitimate purposes:

• To provide personalized nutrition and health coaching, generate plans, and personalize your recommendations.
• To track your progress and provide you with feedback.
• To send notifications and reminders.
• To respond to website waitlist and contact requests and to inform you about the launch.
• To ensure the security, continuity, and technical operation of the service and to fix errors.
• To fulfill our legal obligations.

4. Legal grounds for processing

Your personal data is processed on the legal grounds set out in Article 5 of the KVKK: necessity for the conclusion or performance of a contract, fulfillment of our legal obligations, and our legitimate interests, provided that your fundamental rights and freedoms are not harmed.

Your special-category health data (height, weight, nutrition and meal logs, GLP-1 information, lab results, mood, clinical questionnaire, etc.) is processed under Article 6 of the KVKK solely on the basis of your explicit consent. Separate explicit consent is also obtained under Article 9 of the KVKK for transferring this data abroad to be processed with artificial intelligence. You may withdraw your explicit consent at any time.

• Conclusion/performance of a contract (KVKK Art. 5/2-c): creating your account and providing the service.
• Legal obligation (KVKK Art. 5/2-ç): retention and reporting obligations arising from legislation.
• Legitimate interest (KVKK Art. 5/2-f): securing and improving the service.
• Explicit consent (KVKK Art. 6 and Art. 9): processing of special-category health data and its transfer abroad.

5. Parties to whom personal data is transferred and the purpose of transfer

We share your personal data, under the necessary agreements, with the service providers (data processors) listed below that we use to deliver our service. We do not share or sell your data with third parties for marketing purposes.

For AI content generation and entity extraction, your data is processed on the OpenAI L.L.C. (USA) infrastructure. Direct identifiers are removed before submission (PII sanitization). This transfer to the USA is a cross-border transfer within the meaning of Article 9 of the KVKK and is carried out on the basis of your explicit consent and appropriate safeguards.

Step and active-calorie data obtained from health platforms (Apple HealthKit / Android Health Connect) is not used or transferred for advertising purposes.

• OpenAI L.L.C. (USA) — AI processing for coaching generation and entity extraction (cross-border transfer, explicit consent + appropriate safeguards).
• Cloudflare (R2) — storage of images.
• Supabase — storage of website waitlist / contact form data.
• APNs / FCM (Apple / Google) — delivery of push notifications.
• Hosting provider — hosting of the application and data.
• Authorized public institutions and agencies — only where legally required.

6. Method of collecting personal data

Your personal data is collected through the channels below and, to a large extent, by automatic or partially automatic means.

Data is entered directly by you while using the service, or obtained from connected systems within the scope of the permissions you grant.

• Account, health, and usage data you enter through the Oomi Diet mobile app.
• The waitlist and contact form on the oomiclinic.com website.
• The Apple HealthKit / Android Health Connect integration, if you permit it.
• Technical data collected automatically from your device (device identifiers, crash/error logs).
• Image and audio data you provide within the scope of camera and microphone permissions.

7. Your rights as a data subject (KVKK Art. 11)

Under Article 11 of the KVKK, by applying to Oomi Clinic as the data controller, you have the following rights regarding your personal data:

• To learn whether your personal data is being processed.
• To request information if it has been processed.
• To learn the purpose of processing and whether it is used in line with that purpose.
• To know the third parties to whom it is transferred at home or abroad.
• To request correction if it has been processed incompletely or inaccurately.
• To request its erasure or destruction within the framework of the KVKK and related legislation.
• To request that correction, erasure, or destruction be notified to the third parties to whom the data was transferred.
• To object to a result against you arising solely from automated analysis of the processed data.
• To request the portability of your data (its transfer to another data controller).
• To withdraw, at any time, the explicit consent you have given.
• To request compensation for damages you suffer due to unlawful processing.

8. Exercising your rights and application procedure

To exercise the rights above, you may submit your request in writing — in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller — together with information establishing your identity, or by email to hello@oomiclinic.com.

You can also reach the privacy notice, your consent history, and the account-deletion option from the Settings > Privacy / KVKK section within the Oomi Diet app.

Upon a data-deletion request, your account and associated personal/health records and images are deleted; records subject to legal retention obligations (such as invoice/payment records) are kept for the period prescribed by the relevant legislation. Your request is finalized as soon as possible and in any case within 30 days, depending on its nature.

• Application by email: hello@oomiclinic.com
• In-app: Settings > Privacy / KVKK (notice, consent history, account deletion).
• Response time: within 30 days at the latest.
• In a medical emergency, contact 112 (emergency services), not Oomi. Oomi is not a medical device; it does not diagnose, prescribe treatment/medication, and does not replace medical advice.