Legal

Cookie Policy

Which cookies and similar technologies the Odyonom website and app use and how you can manage them.

Last updated: 26 October 2026

This text is a pre-publication version and is not yet in force. Its effective date will be announced on this page.

This English version is provided for convenience. In case of conflict, the Turkish version prevails.

1. What are cookies?

Cookies are small text files that a website you visit saves in your browser. This policy covers not only cookies but also your browser's local storage area (including the temporary area cleared when you close the page).

2. Which cookies do we use?

Only cookies that are strictly necessary for the service to work and stay secure are used in the Odyonom app and on odyonom.com. We do not use advertising, retargeting or cookies that track you on other websites.

2.1. App (app.odyonom.com and tenant subdomains)

Name · type · purpose · duration · provider:

  • __Host-odyo_session · strictly necessary, first party · keeps you signed in and verifies that requests come from you · 7 days, renewed as you use the app, deleted when you sign out · Odyonom
  • __Host-odyo.dont_remember · strictly necessary, first party · ends the session when the browser is closed if "Remember me" is not selected · browser session · Odyonom
  • __Host-odyo.two_factor · strictly necessary, first party · keeps the sign-in flow going until the two-step verification step is completed · short-lived (minutes) · Odyonom
  • __Host-odyo.trust_device · strictly necessary, first party · recognises the device if "trust this device" was selected in two-step verification · 30 days · Odyonom
  • __Host-odyo.* (passkey and administrator session) · strictly necessary, first party · security check when signing in with a passkey (password-free sign-in key); separating the platform administrator session · short-lived or session length · Odyonom
  • hCaptcha · strictly necessary (security), third party · bot protection at sign-in, password reset and invitation acceptance · period set by hCaptcha · hCaptcha

Odyonom cookies are sent only over encrypted connections and only to the domain that set them; programs running on the page cannot read them.

Local storage key · purpose · duration:

  • dashboard-layout, dashboard-gadget-settings · remembers your home page layout and card settings on this device · until you delete them
  • Table column, list and calendar view preferences · remembers your interface preferences on this device · until you delete them

No personal data or patient data is kept in local storage.

2.2. Website (odyonom.com)

Name · type · purpose · duration · provider:

  • __cf_bm · strictly necessary (security), on the first-party domain · distinguishes malicious bot traffic · 30 minutes · Cloudflare
  • cf_clearance (only if a security challenge is shown) · strictly necessary (security) · remembers that you passed the security check · duration set in Cloudflare (default 30 minutes) · Cloudflare

The website uses no analytics or marketing cookies.

3. Legal basis

Strictly necessary cookies rely on Article 5(2)(c) (establishment and performance of a contract) and 5(2)(f) (legitimate interest) of the Law, to provide the service you request and keep it secure. Your consent is not requested for these cookies. Third-party security cookies (hCaptcha, Cloudflare) are processed by providers abroad; this transfer is explained in the Privacy Policy.

4. How can you manage cookies?

You can delete or block cookies in your browser settings. If you block strictly necessary cookies, you cannot sign in to the app. To delete your preferences in local storage, you can clear your browser's site data.

5. Changes

If a new type of cookie is added, this policy is updated. If a cookie that is not strictly necessary is added, your consent is requested before it is used.

6. Contact

Virtual Riddle Teknoloji A.Ş. · Maslak Mah., AOS 55. Sok. 42 Maslak B Blok, No: 4/542, Sarıyer, İstanbul · Tel: +90 212 963 03 63 · [email protected]. For your rights regarding your personal data, see section 8 of the Privacy Policy.

Version: CRZ-1.1 · Effective: to be announced (planned: 29 October 2026)