Privacy Policy

RhinoMe Application — Dr. Mehmet Erdil ENT Clinic

This Privacy Policy explains how Dr. Mehmet Erdil ("we," "us," or "our") collects, uses, stores, and protects your personal information when you use the RhinoMe mobile application ("the App") and related services. We are committed to protecting your privacy and handling your data responsibly.

By using the App, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the App.

Important — what this app is and is not:

RhinoMe is a consultation booking and information tool. The video meeting with Dr. Erdil is a pre-surgery consultation; the actual surgery is performed in person at the clinic in Istanbul. The App is not a telemedicine, diagnostic, or remote-treatment service.

The App does not collect, store, or transmit your medical history, allergies, medications, prior-surgery details, facial photos, or any clinical records. Clinical information is gathered directly by the clinic team (separately from this App) during your consultation session.

When you book a consultation, the App collects a handwritten consent signature image only to document that you reviewed and accepted the video consultation information and consent form.

1. Data Controller

The data controller responsible for your personal data is:

Dr. Mehmet Erdil
ENT Specialist
Ataköy 7-8-9-10. Kısım Mahallesi, Çobançeşme E-5 Yan Yol Caddesi No:20-1/3
B-Blok 7. Kat No:153, Bakırköy, Istanbul, Turkey
Email: info@drerdil.com
Phone: +90 538 200 92 86

2. Information We Collect

2.1 Information You Provide

Data Type	Examples	Purpose
Account Information	First name, last name, email address, phone number, date of birth, gender, country, city, occupation	Account creation, identification on appointments, sending the Zoom invitation, KVKK-compliant phone verification
Appointment Booking Data	Selected consultation date and time, selected surgery date (if applicable), appointment status	Scheduling and managing your consultation and surgery
Consent Signature	Handwritten consent signature image	Documenting your acceptance of the video consultation information and consent form
Payment Records	Transaction reference (PayTR order ID), amount, currency, payment status. Card details are processed entirely by PayTR's secure iframe and are never seen, stored, or transmitted by the App or our servers.	Processing your consultation fee and reconciling your booking

2.2 Information Collected Automatically

Data Type	Examples	Purpose
Device Information	Device model, operating system, app version	App functionality and troubleshooting
Push Notification Token	An anonymous device push-notification token assigned by your device's operating system	Sending appointment reminders and status notifications
Internal Identifier	Supabase auth user ID (UUID)	Linking your account to your bookings on our backend

2.3 Information We Do NOT Collect

We do not collect medical history, chronic conditions, allergies, current medications, or prior-surgery details through the App
We do not collect facial photographs, body photographs, or any other image of you
We do not collect a profile avatar or any other photo or video
We do not use your consent signature image for biometric identification or identity verification
We do not collect your precise or coarse location (the in-app map shows the clinic's location only)
We do not access your contacts, calendar (writing only when you choose to add an appointment to your phone calendar), microphone, or other apps
We do not collect biometric data (fingerprints, face scans for identification)
We do not store credit card or bank account details (payment processing is handled entirely by PayTR)
We do not use third-party advertising SDKs and do not collect advertising identifiers (no IDFA)
We do not track your activity across other companies' apps or websites

2.4 Where Clinical Information Is Collected (For Your Awareness)

Information about your medical history, allergies, current medications, prior nasal procedures, breathing, smoking, and so on — together with any pre-operative facial photographs — is collected by the clinic team outside this App (for example, via WhatsApp messages with the clinic secretary or in person at the clinic). That information is processed under a separate clinical record system that is not part of this App and is not connected to your in-app account beyond the same patient identity. If you wish to know more about how the clinic stores and protects clinical records, please contact info@drerdil.com.

3. How We Use Your Information

We use your personal information solely for the following purposes:

Coordinating Consultation Appointments: To let you select a consultation date and time, to send you the Zoom meeting link for your consultation, and to keep you informed of status changes.
Coordinating Surgery Scheduling: If you decide to proceed with surgery, to let you select a surgery date and to display deposit instructions for the bank transfer.
Payment Processing: To process the consultation fee through our payment processor (PayTR) and to record the resulting transaction reference.
Communication: To send you appointment reminders and status notifications via push notifications, and to respond to your inquiries.
App Improvement: To investigate technical issues you report.
Legal Compliance: To comply with applicable financial record-keeping requirements (e.g., tax law) and other legal obligations.

  We will NEVER:
  Sell your personal data to third parties
Use your data for advertising or marketing by third parties
Share your data with anyone outside the recipients listed in Section 5
Use your data for any purpose unrelated to coordinating your consultation booking

4. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA) and similar jurisdictions, we process your data based on the following legal grounds:

Legal Basis	Applies To
Contract Performance (Art. 6(1)(b) GDPR)	Coordinating your consultation, sending the Zoom invitation, processing payments
Consent (Art. 6(1)(a) GDPR)	Sending push notifications (you may revoke this at any time in iOS Settings)
Legal Obligation (Art. 6(1)(c) GDPR)	Tax / financial reporting requirements for payment records
Legitimate Interest (Art. 6(1)(f) GDPR)	App security, fraud prevention

5. Data Sharing

Your data is stored on infrastructure operated directly by us (see Section 6) and is not handed over to any cloud database provider. We share limited data with the following third-party service providers, and only to the extent necessary to deliver the service you requested:

Recipient	Data Shared	Purpose
PayTR	Card details are entered directly into PayTR's iframe; we never see them. We share with PayTR only the merchant order ID and the amount.	Card payment processing
Zoom	Your name and email address (so the meeting invitation reaches you)	Hosting the video consultation meeting
Hospital / Surgical Facility	Your name and surgery date (only if you proceed with surgery)	Coordinating your surgery and hospital stay

We do not share your data with any other third parties. We do not use third-party analytics, advertising networks, or data brokers.

6. Data Storage & Security

6.1 Where Your Data Is Stored

Your data is stored on dedicated infrastructure operated directly by us in Türkiye. We do not store your personal data on Firebase, Google Cloud, Supabase Inc., AWS, Azure, or any other public cloud database provider.

6.2 Security Measures

All data in transit between your device and our servers is encrypted using transport-layer security (TLS).
Sensitive personal data fields are encrypted at rest using industry-standard encryption.
Account access is protected by a clinic-issued code, your phone number, and a one-time SMS code (OTP). Your email address is requested after sign-in so the clinic can contact you about appointments; it is not used as a password login.
Administrative access to back-end systems is restricted to Dr. Mehmet Erdil and a small number of authorized clinic staff and is not reachable from the public internet.
Each user account can access only its own data; cross-account access is prevented at the database layer.
Our systems are reviewed periodically by independent security professionals.

For security reasons we do not publish further details about specific software, hosting providers, network configuration, or encryption parameters. If you are a data-protection authority or a legal representative requesting additional technical detail, please contact us at info@drerdil.com.

6.3 Data Retention

Data Type	Retention Period
Account information (name, email, phone, etc.)	Until account deletion is requested; removed on deletion
Appointment records	Until account deletion is requested; historical records are anonymized on deletion
Consent signature image	Until account deletion is requested
Payment transaction records	10 years (Turkish tax / financial regulation compliance) — retained even after account deletion, in pseudonymized form
Push notification tokens	Until you revoke push permission or delete your account

7. Your Rights

Depending on your jurisdiction, you have the following rights regarding your personal data:

Right of Access: Request a copy of all personal data we hold about you.
Right to Rectification: Request correction of inaccurate or incomplete data (you can also edit most fields directly in Profile).
Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data, subject to legal retention requirements (see Section 6.3).
Right to Restriction: Request that we limit how we process your data.
Right to Data Portability: Receive your data in a structured, machine-readable format.
Right to Withdraw Consent: Withdraw your consent at any time (this does not affect the lawfulness of processing before withdrawal).
Right to Object: Object to processing based on legitimate interests.
Right to Lodge a Complaint: File a complaint with your local data protection authority (in Turkey: KVKK Authority, kvkk.gov.tr).

To exercise any of these rights, contact us at info@drerdil.com. We will respond within 30 days.

8. Account Deletion

You can delete your account at any time through the App (Profile → Delete Account) or by contacting us at info@drerdil.com.

Upon account deletion:

Your account access and app profile are permanently removed
Your personal identifiers are removed from historical appointment records, which are kept only in anonymized form where needed for legal, accounting, audit, or dispute-resolution purposes
Your consent signature image is deleted
Your push notification tokens are revoked
Payment transaction records are retained in pseudonymized form for 10 years as required by Turkish tax regulations

9. Children's Privacy

The App may not be used by anyone under the age of 18 under any circumstances, including with the consent or supervision of a parent or guardian. We do not knowingly collect personal information from children. Parents and guardians may not create accounts on behalf of minors. If we discover that an account has been created for or is being used by a person under 18, we will close the account and permanently delete all associated personal data.

10. International Data Transfers

Your data is stored on our infrastructure in Türkiye. If you are located outside Türkiye, your data is transferred to and processed in Türkiye when you use the App. Limited categories of data are also processed by the third parties listed in Section 5 (PayTR in Türkiye; Zoom internationally). We rely on Standard Contractual Clauses (SCCs) and equivalent safeguards for transfers outside the EEA where applicable.

11. Medical Disclaimer

RhinoMe is a consultation booking and information tool. It does not provide medical advice, diagnosis, or treatment, and it is not a telemedicine or remote-care service. The educational content in the App (articles, gallery) is for informational purposes only and does not replace professional medical advice. All medical decisions are made by Dr. Mehmet Erdil during the consultation and during in-person evaluation at the clinic. Always consult with your doctor before making medical decisions.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy in the App and updating the "Last Updated" date below. Continued use of the App after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have any questions about this Privacy Policy, your personal data, or wish to exercise your rights, please contact us:

Dr. Mehmet Erdil
Email: info@drerdil.com
Phone: +90 538 200 92 86
Address: Ataköy 7-8-9-10. Kısım Mahallesi, Çobançeşme E-5 Yan Yol Caddesi No:20-1/3, B-Blok 7. Kat No:153, Bakırköy, Istanbul, Turkey

Last Updated: May 3, 2026