KVKK Information Notice
Information under article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK).
Version v09 · Last updated: 29.10.2026
1. Controller
BVS DOCTORS LTD — registered in England and Wales, company no. 16987192, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. Requests: privacy@bvsly.com
Contact point in Turkey (requests can also be sent here): BVS Doctors Sağlık ve Turizm İthalat İhracat Limited Şirketi (BVS Doctors Health & Tourism Import Export Ltd.) — Mimar Sinan Mah. Ziya Gökalp Blv. Mimarın Medikal No: 28/1 İç Kapı No: 2, 35220 Konak/İzmir, Türkiye · registered e-mail (KEP) bvsdoctors@hs06.kep.tr
2. Data, purposes, legal grounds, retention
| Data | Purpose | Legal ground | Retention |
|---|---|---|---|
| Link or page visit: IP address, user agent, device type, country and city estimated from the IP, referring page, date and time, QR flag | Redirecting; aggregate statistics for the owner (they never see your IP or anything identifying you); preventing abuse | Legitimate interests (UK GDPR art. 6(1)(f)) | The statistics record never keeps the IP, only an irreversible hash; city and full referrer are removed after 30 days. The full record is kept in a restricted security archive for 2 years, then the IP and browser data are deleted. |
| Account: email, language, plan, last sign-in; with Google or Apple sign-in, that account's email (may be an Apple hide-my-email address) | Providing your account | Contract (art. 6(1)(b)) | While the account is open. 7 days after Delete my account, personal fields are anonymised and files deleted; short codes are never reassigned. |
| Sign-in code record: email, code hash, IP hash, attempts | Secure sign-in; preventing code guessing | Contract · legitimate interests | Codes are valid for 10 minutes; records are anonymised after 30 days. |
| Trial link without an account: destination, token derived from the IP | Applying the daily limit | Legitimate interests | The link closes after 7 days; the token is anonymised 30 days after closing. |
| Notebooks and pages: content, editor emails, the Google email of private-notebook viewers, phone number for notebook SMS sign-in | Sharing and access control | Contract | While the notebook or page exists; codes are valid for 10 minutes. |
| Personal page photo | Publishing; inappropriate-content check (see section 5) | Contract · legitimate interests | While the page exists; rejected photos are not stored. |
| Transfer: files, names, sizes, recipient emails, download record (IP hash, country, time) | Delivering files and notifications, preventing abuse | Contract · legitimate interests | Files uploaded from outside are deleted after 7 days; files sent by the account holder stop being downloadable after 30 days and are deleted on day 90; the IP hash in download records is deleted after 12 months. |
| Payments: name, email, billing address, tax ID if given, plan and amount (card details stay with Stripe) | Taking payment, invoicing, tax and accounting | Contract · legal obligation (art. 6(1)(c)) | Accounting records 6 years. |
| Help window: your messages, the assistant's replies, page address, language, a daily-changing irreversible token; your email if you pass the question to the team | Support | Legitimate interests · your request for hand-off | Deleted automatically after 30 days. Card-number-like sequences are removed before saving or sending to the model. |
| Link reports and emails you send us | Reviewing and replying | Legitimate interests | 2 years. |
3. How we collect it
Server logs (automatically) and the forms you fill in (sign-in, Transfer, reports, payment, help).
4. Recipients
The infrastructure providers listed in section 4 of bvsly.com/privacy and public authorities where legally required. Some providers are abroad (EU, UK, US, Switzerland); transfers are limited to what the service needs.
5. Your rights (KVKK art. 11)
- to learn whether your personal data is processed and, if so, to request information,
- to learn the purpose of processing and whether data is used accordingly,
- to know the third parties in Turkey or abroad to whom it is transferred,
- to request correction of incomplete or inaccurate data, and deletion or destruction where the conditions are met, and to have this notified to recipients,
- to object to a result against you arising solely from automated analysis,
- to claim compensation for damage caused by unlawful processing.
6. Requests
privacy@bvsly.com (from your registered email), KEP bvsdoctors@hs06.kep.tr or in writing; free of charge, within 30 days. You may complain to the Turkish Personal Data Protection Board.