Privacy Policy

Odyonom is a cloud-based management software for hearing care centres, provided by Virtual Riddle Teknoloji A.Ş. ("Odyonom", "we"). Address: Maslak Mah., AOS 55. Sok. 42 Maslak B Blok, No: 4/542, Sarıyer, İstanbul · Tel: +90 212 963 03 63 · E-mail: [email protected]

• odyonom.com visitors and people who request a demo or contact us: the data controller is Odyonom.
• App users' account, sign-in and security data; the representative and billing details of subscribing businesses: the data controller is Odyonom.
• Data of patients and staff of subscribing hearing centres ("Tenant") entered into the app: the data controller is the Tenant. Odyonom is the data processor: we process this data on the Tenant's instructions and under the data processing agreement.

If you are a patient of a hearing centre, please contact that centre about your data. We forward requests we receive to the centre without delay.

• Name, surname, e-mail and phone (if any): creating the account, sign-in, notifications and support.
• Password hash, two-step verification and passkey (password-free sign-in key) details, session, device and IP logs: account and platform security.
• The subscribing business's trade name, tax details, billing address and payment records: subscription, billing and e-Invoice.
• Records of document acceptance (version, time, IP): proof of the legal relationship.
• Your consent to commercial messages (if given): product and campaign announcements.

The legal grounds, retention periods and rights relating to app users are set out in the user privacy notice, which is shown on the app's sign-up and invitation screens.

Your card details do not reach us; payment is made on iyzico's payment page.

Health data. Tenants enter their patients' hearing tests, device and prescription details into the app. This is special category personal data. We process it only on behalf of the Tenant; we do not use it for our own purposes such as advertising, profiling or training artificial intelligence models, and we do not sell or share it.

• IP address, browser and request details (server and content delivery network logs) · purpose: providing the website securely and preventing attacks · legal ground (Article 5(2) of the Law): (f) legitimate interest · retention: the provider's log retention period, at most 1 year
• Demo request by e-mail: name, surname, business name, number of branches, e-mail, phone, your note. The request reaches us by e-mail only; it is not stored on the website, in a database or in an issue-tracking tool · purpose: answering your request, preparing a demo or offer · legal ground: (c) steps prior to entering into a contract; (f) · retention: in our mailbox, 1 year after the request is closed
• Consent to commercial messages (if given) · purpose: product and campaign announcements · legal ground: only with your consent (Law No. 6563, Article 6) · retention: until consent is withdrawn; records of consent and refusal 3 years

For cookies, see the Cookie Policy. We do not use advertising or retargeting cookies on the website. We do not use your demo request for marketing without your consent to commercial messages.

The full notice for website visitors (purposes, legal grounds, transfers and your rights) is the separate KVKK Notice.

We share data only with the providers needed to deliver the service. Provider · service · location:

• ClickHouse Cloud · database, backups and analytics · Germany (EU; AWS eu-central-1, Frankfurt)
• Cloudflare · domain management, hosting the website and app pages, connection encryption and content delivery · servers worldwide
• Render · application server and scheduled jobs; forwarding demo requests by e-mail · Germany (EU), Frankfurt
• Amazon Web Services (Amazon SES only) · verification, invitation and notification e-mails; forwarding demo requests to us · United States (AWS us-east-1)
• hCaptcha · bot protection for sign-in, password reset, invitation acceptance and the demo form · United States
• iyzico · subscription billing · Türkiye
• Paraşüt and the Revenue Administration (GİB) · e-Invoice and e-Archive · Türkiye
• SMS provider · SMS notifications enabled by the Tenant · Türkiye
• Meta (WhatsApp) · notifications enabled by the Tenant and sent through WhatsApp's business messaging service (no health information) · abroad, including the United States
• Google (Google Workspace) · our company mailbox where e-mails you send us and demo requests are kept · abroad, including the United States (Google Workspace data centres)
• Telegram · internal notifications only to an account the staff member links themselves (no patient data) · outside the EU
• Competent public authorities and courts · legal obligation · Türkiye

The up-to-date and complete list is in the sub-processor list. We notify Tenants 30 days before adding a new provider to the list.

Most data is hosted in the European Union (Germany). E-mails are sent through servers in the United States (AWS us-east-1); e-mails you send us and demo requests are kept in Google Workspace data centres abroad, including the United States. As the Personal Data Protection Board has not issued an adequacy decision for these countries, these transfers are made under the standard contracts published by the Board under Article 9(4)(c) of the Law.

• All connections are encrypted; data is also kept encrypted where it is stored.
• Turkish ID and social security numbers are additionally encrypted at application level.
• Each Tenant's data is separated from the others by row-level security in the database.
• Access is limited by role and branch permissions. Two-step verification and passkeys are supported.
• Sensitive actions are written to the audit log. Backups are taken regularly.
• If a data breach occurs, we inform the Tenant without delay; for data we control, we notify the people concerned and the Board under Article 12(5) of the Law.

We keep data for as long as the processing purpose requires and the law prescribes. Retention periods are set out in our retention and destruction policy.

• Website server and content delivery network logs (IP, request): the provider's log retention period, at most 1 year
• Demo requests: in our mailbox, 1 year after the request is closed
• Records of consent to and refusal of commercial messages: 3 years
• App account: while the account is open; accounts inactive for 2 years after all memberships end are deleted
• Security and sign-in logs: 2 years
• Subscription and invoice records: 10 years (Turkish Commercial Code Art. 82, Tax Procedure Law Art. 253)
• Records of document acceptance: for the contract term and 10 years after it ends
• Records deleted by users: 30 days in trash, then permanent deletion
• Backups: copies in backups are deleted automatically at the end of the normal backup retention period

When a subscription ends, the Tenant is given 90 days to export its data; the Tenant's data is then deleted.

Under Article 11 of Law No. 6698 you have the right to:

• learn whether your personal data is processed;
• if processed, request information about it;
• learn the purpose of processing and whether data is used in line with that purpose;
• know the third parties in Türkiye or abroad to whom data is transferred;
• request correction if it is incomplete or inaccurate;
• request deletion or destruction under Article 7 of the Law;
• request that the correction, deletion or destruction be notified to the third parties to whom data was transferred;
• object to a result against you arising solely from analysis by automated systems;
• claim compensation for damage caused by unlawful processing.

Send your request in writing to Maslak Mah., AOS 55. Sok. 42 Maslak B Blok, No: 4/542, Sarıyer, İstanbul or from an e-mail address you have previously given us and that is registered with us to [email protected]. Requests are answered free of charge within 30 days at the latest (Article 13). If your request is rejected, the answer is insufficient or no answer is given in time, you may complain to the Personal Data Protection Board within 30 days of learning the answer and in any case within 60 days of your request (Article 14).

If you are a patient of a hearing centre, please contact that centre about your data. We forward requests we receive to the centre without delay.

The app is intended for businesses; people under 18 cannot open an account. Data of minor patients is processed by the Tenant with the participation of the legal representative and under the Tenant's privacy notice.

We may update this policy. The current version and effective date are shown on this page. We announce material changes to users in the app.