Scope and controller
This policy covers the personal data that Memoris Clinical (Memoris Clinical, Istanbul, Türkiye; "Memoris") processes as a controller in its own right: visitors to memorisclinical.com, people who request a demo or contact us, and holders of an account on the app.memorisclinical.com portal. Clinical content that institutions upload to the service is outside the scope of this policy; for that content Memoris is a processor, and the conditions are set out in the Data Processing Statement.
Personal data we process
Website: server and security logs such as IP address, request time, requested page and browser information, plus the language preference kept in your browser.
Demo and contact requests: name, email address, institution, job title and the content of your message.
Portal account: name, email address, institution and facility, role, the person who invited you, sign-in and sign-out times, IP address, session details and an audit trail of actions taken with the account.
Usage metrics: volume data such as product, number of jobs, pages and duration. These metrics contain no clinical content.
Purposes and legal bases
Setting up and providing the service, managing accounts and tracking quotas: performance of a contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)).
Security, prevention of misuse and keeping an audit trail: legitimate interests (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)).
Assessing and answering demo and contact requests: steps prior to entering into a contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)).
Meeting legal obligations and responding to requests from competent authorities: KVKK Art. 5/2-ç; GDPR Art. 6(1)(c).
Your data is not profiled for marketing and is not sold to third parties.
How data is collected
Data is collected electronically: information you enter on the website and in the portal, invitation links and sign-in forms, and records generated automatically by our servers.
Recipients and sub-processors
Hosting and storage are provided by Netcup GmbH (Germany); network, DNS, object storage, bot protection and email delivery by Cloudflare (EU region). Account, security and usage data is never sent to language model or speech recognition providers. Your portal account details and action history can be seen by the administrators of the institution that invited you. Where the law requires it, data may be disclosed to competent authorities.
International transfers
Data that Memoris processes for itself is stored in the European Union (Germany). For data subjects located in Türkiye, the transfer to the EU is made under KVKK Art. 9 on the basis of the standard contract announced by the Personal Data Protection Board (KVKK Art. 9/4-b). For data subjects located in the EU, data is not transferred outside the EU.
Retention
Portal account data is kept while the account is active and for 90 days after it is closed; security and access logs for 12 months; demo and contact requests for 12 months after the request has been handled. Where the law requires a longer period, that period applies. Usage metrics are kept in aggregated form, separated from the individual. When a period ends, the data is deleted, destroyed or anonymized.
Security
Data is protected with TLS in transit and server-side encryption at rest. Accounts are invitation-only; every request is authorized server-side by institution, facility, product and action. Access and deletion events are written to an audit log. Operational interfaces are reachable only by a small number of authenticated staff. The technical and organizational measures are described in detail in the Data Processing Statement.
Cookies
The website and the portal use strictly necessary cookies only: the portal session cookie and the language preference. There are no analytics, advertising or third-party tracking cookies. Details are in the Cookie Notice.
Your rights
Under KVKK Art. 11 you have the right to learn whether your personal data is processed, to request information if it is, to learn the purpose of processing and whether the data is used accordingly, to know the third parties to whom it is transferred, to request correction of incomplete or inaccurate data, to request deletion or destruction, to request that corrections and deletions be notified to recipients, to object to a result that affects you and was produced solely by automated analysis, and to claim compensation for damage caused by unlawful processing. Data subjects in the EU can exercise their rights of access, rectification, erasure, restriction, portability and objection under GDPR Art. 15–22.
Requests are sent to privacy@memorisclinical.com and answered free of charge within 30 days at the latest. You also have the right to lodge a complaint with the Turkish Personal Data Protection Board and, where applicable, with your EU supervisory authority.
Children
The service is available only to professionals invited by healthcare institutions and is not directed at anyone under 18.
Changes
When this policy is updated, the new version and its "last updated" date are published on this page. Changes that materially affect your rights or how data is used are announced by email to portal users and institution administrators.