Controller and scope
This notice is addressed, in accordance with Article 10 of Turkish Law No. 6698 on the Protection of Personal Data (KVKK), to users who hold an account on the app.memorisclinical.com portal. The controller of the personal data relating to your account is Memoris Clinical ("Memoris"). For clinical content you upload or process through your account, the controller is the institution that invited you; Memoris is only a processor for that content.
Personal data processed
Identity and contact: first name, last name, email address. Institutional details: institution, facility, role and the person who invited you. Account and security data: sign-in and sign-out times, IP address, session details, failed sign-in attempts. Action records: which job you started, viewed, approved or deleted and when. Usage metrics: volume data such as number of jobs and duration.
Purposes of processing
Opening and managing your account; authorizing you within the role and facility scope set by your institution; keeping the account secure and detecting unauthorized access; keeping an action record for your institution's audit and accountability needs; tracking quotas and usage; answering support requests; meeting legal obligations.
Legal bases
Your data is processed under KVKK Art. 5/2 on the following bases: performance of a contract (c), compliance with a legal obligation (ç), establishing, exercising or protecting a right (e), and legitimate interests, provided they do not harm your fundamental rights and freedoms (f). No processing relies on your explicit consent.
How data is collected
Your data is collected electronically, from the information you enter through the invitation link, sign-in and profile forms, and from records generated automatically by the portal servers.
Transfers
Your account details and action records can be seen by the administrators of the institution that invited you. Data is held on the servers of Memoris's hosting and infrastructure sub-processors, Netcup GmbH (Germany) and Cloudflare (EU region); the resulting transfer abroad (to the European Union) is made under KVKK Art. 9 on the basis of the standard contract announced by the Personal Data Protection Board (KVKK Art. 9/4-b). Your account data is never sent to language model or speech recognition providers. Where the law requires it, data may be shared with competent public authorities.
Retention
Your account data is kept while your account is active and for 90 days after it is closed. Security logs are kept for 12 months. Action records follow the retention period set by your institution. At the end of the period the data is deleted, destroyed or anonymized.
Your rights and how to apply
Under KVKK Art. 11 you have the right to learn whether your personal data is processed, to request information if it is, to learn the purpose of processing and whether the data is used accordingly, to know the third parties in Türkiye or abroad to whom it is transferred, to request correction of incomplete or inaccurate data, to request deletion or destruction, to request that corrections and deletions be notified to third-party recipients, to object to a result that affects you and was produced solely by automated analysis, and to claim compensation for damage caused by unlawful processing.
You can submit your request, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, to privacy@memorisclinical.com or in writing to Istanbul, Türkiye. Requests are concluded free of charge within 30 days at the latest.