For professionals practising in Türkiye
KVKK and the processor agreement
Türkiye sits outside the European Union, and Law no. 6698 on the Protection of Personal Data (KVKK) is a separate regime with its own rules. If you keep records about your clients in Vitena, you are the data controller and Vitena is your data processor. This page covers the agreement between us, how health data is treated, and what it means that the data is stored abroad.
Facts that do not change by country — where the servers are, the subprocessor list, export and deletion — are on the data protection overview. Practising in the EU instead? See GDPR.
Who is the controller, who is the processor
You decide which clients you record, what you write about them and how long you keep it, which makes you the data controller under art. 3 KVKK. Vitena processes that data only on your instructions and does not use it for its own purposes, sell it, or use it to train AI models — which makes it a data processor. The responsibility the law assigns stays with you; our job is to give you the tools and the agreement that let you meet it.
There is one exception. For your public profile in the directory, and for the details a person enters when booking with you before they are your client, Vitena is a controller in its own right — that is the marketplace side of the product. Everything inside your workspace is on the processor side.
The data processor agreement
Art. 12 KVKK makes the controller and the processor jointly responsible for the obligations on data security, which in practice requires a written agreement between you. Vitena offers one: the subject matter and duration of processing, the categories of data and data subjects, the confidentiality obligation, the technical and organisational measures taken, subprocessor rules, assistance with data subject applications, return or deletion of the data at the end of the contract, and audit rights.
How to request it: email info@vitena.care with the name under which you practise, and we will come back to you about the agreement. There is no charge, and it applies on the free plan too.
Special categories of personal data (art. 6)
Most of what you record — health information, diagnoses, measurements, treatment history — is special-category personal data under art. 6 KVKK and carries heavier protection. Health data may be processed without the data subject's explicit consent by persons under a duty of confidentiality or by authorised institutions; establishing which case applies to your practice is yours to do as controller.
Vitena's role is to make that defensible: a separate database schema per practice, role-based access so an assistant cannot see clinical notes, an audit trail on consent records, and — where written consent is required — versioned informed consent with an electronic signature.
The duty to inform (art. 10)
Informing your clients about who processes their data and for what purpose is your obligation — Vitena does not assume it on your behalf. What we do give you is the place to discharge it: the texts shown in the client portal and in the consent flow are yours, you can define your own information notice as a consent template, send it with the booking, and keep the signed version inside the record.
Your data is stored abroad
Let us be plain: your data is not in Türkiye. Client records, notes, files and consent records are stored inside the European Union, in the AWS Frankfurt region (eu-central-1). Under art. 9 KVKK that is a transfer abroad, and establishing its legal basis is yours to do as controller — usually an undertaking or standard contract, or the data subject's explicit consent. The processor agreement we provide supports that side of it.
The company's seat and the location of the data are two different things: Vitena is operated by Ahmet Çakıl, a business registered in Türkiye (Kartal tepe mh. Kılıçaslan cd. 11/22 Merkez, Karabük 78100, Türkiye), which is who invoices you. The servers are in the EU. Both are true at the same time.
What we do not claim
- VERBİS: whether you are required to register depends on your employee count and annual balance-sheet total. That is a controller's assessment; we cannot make it for you and will not tell you that it "does not apply".
- This is not legal advice. We do not write your information notice or your explicit-consent texts; the templates are yours.
- There is no e-SMM or e-invoice integration. Vitena records the payments you collect; it does not issue the receipt.
Questions and requests
Agreement requests, subprocessor objections and KVKK questions all go to the same address: info@vitena.care. Related pages: the subprocessor list and hosting, security and privacy, and the privacy policy.