CORENTA — DATA RETENTION AND DISPOSAL POLICY

This translation is provided for information only; the Turkish text is legally binding.

Deletion of a client without an account: The Clinic admin's Delete action counts as a request; the record is immediately removed from the active list and, after 30 days, the identity/contact information and the client's health fields (blood type, allergies, chronic conditions, medications) are deleted/cleared (see 5.0). The general account deletion description below is not to be interpreted, within this specific scope, as an obligation to permanently delete the client row. Health history, measurement, session note and financial records remain subject to their own retention provisions.

Effective / last updated: October 19, 2026 Version: 1.9 Data controller / publisher: Mertcan Demir — sole proprietorship under the trade name "Teta Studio"

Change log

• 1.9 — October 19, 2026: The "Türkiye only" statement in Section 14 was replaced with global availability; retention periods are unchanged.
• 1.8 — October 19, 2026: Publication version; effective date October 19, 2026. A row for clinic group messages and for message copies set aside for team review (No. 12) was added to Section 4; the Section 7 periodic disposal list was extended accordingly; the empty MERSİS and KEP information was removed from table 1.3.
• 1.7 — October 11, 2026: Based on the October 11, 2026 compliance review (F01, F02, F08, F11, F13, F19, F21): the statement in §11 that "Supabase/Frankfurt is not a cross-border transfer" was removed and the cross-border transfer section was written in line with the post-2024 version of Article 9 of Law No. 6698 on the Protection of Personal Data (KVKK) (the standard contracts have not yet been signed); the term "anonymous" for health/clinical/financial records was corrected to restricted retention with the link to the person severed (the free text of session notes is not changed); the legal ground for the consent evidence row was corrected to Art. 5/2-e (the incorrect reference to Art. 20/2 was removed); the early access form row was updated in line with the separation of the privacy notice and commercial message consent; a 6-month periodic disposal principle was added for categories without automatic disposal; the identity information was corrected to a sole proprietorship; the VERBİS (Data Controllers' Registry Information System) section was written according to the 2025 decisions of the Personal Data Protection Board (Kurul).
• 1.6 — October 10, 2026: Expo (Expo Push Notification Service) was removed from the sub-processor/processor records; push notifications are delivered only through Apple (APNs) and Google (FCM); Expo/EAS is only an app build tool and does not process end-user data.
• 1.5 — October 10, 2026: The wording on the choice of Google Analytics was removed; it was clarified that no third-party analytics is used, and the push processors were clarified.
• 1.4 — October 4, 2026: The current text was fixed as the approved version. Only the following were incorporated in this version: account deletion (access is cut off immediately, personal data is deleted/anonymized, payment records requiring legal retention are kept without identity; no undo period); deletion of client health fields at the end of 30 days; 7-day period for orphaned receipts; client contact details remaining hidden in support mode; anonymous server-side measurement; service emails and Google Workspace; push processors; support address; market (Türkiye).
• 1.3 — July 7, 2026 (August 4, 2026 update): previous version.

Important Note on the Capacity of Data Controller / Data Processor: This Data Retention and Disposal Policy (the "Policy") sets out how long personal data processed within the scope of the Corenta software service (the "Service" or the "App"), developed and operated by Mertcan Demir, who carries on business as a sole proprietorship under the trade name "Teta Studio" ("Corenta", "Teta Studio", the "Company"), will be kept, the criteria on which these periods are based, and by which methods this data will be deleted, destroyed or anonymized when the retention period expires or the reason for processing ceases to exist.

This Policy has been prepared within the framework of Personal Data Protection Law No. 6698 ("KVKK"), the Regulation on the Deletion, Destruction or Anonymization of Personal Data (the "Regulation") and other related legislation, and is an integral part of Corenta's personal data processing inventory. This Policy should be read together with the related Privacy Notice/Privacy Policy, in which the purposes and legal grounds of data processing are explained in detail; this document governs only retention periods and disposal procedures and is not intended on its own to fully satisfy the obligation to inform under KVKK Art. 10.

1. Purpose and Scope

1.1. Purpose

The purpose of this Policy is to explain the criteria for determining the maximum period necessary for the purpose for which personal data processed by Corenta is processed, the application of the periods provided for in the legislation, and the procedures and principles for the deletion, destruction or anonymization of personal data whose retention period has expired. This Policy has been prepared on the basis of the provisions of KVKK Art. 5, Art. 6, Art. 7, Art. 10, Art. 11 and Art. 12 and the relevant articles of the Regulation.

1.2. Scope and Role Allocation — Important Warning

This Policy covers two separate areas in which Corenta processes data in two different capacities; this distinction is applied consistently throughout the Policy and directly affects how the retention periods table is interpreted:

(a) Corporate Website Context (corenta.app — early access/demo request form): With respect to the personal data sent through the early access application form by potential business customers interested in the product, Corenta/Teta Studio acts directly in the capacity of Data Controller under KVKK Art. 3.

(b) SaaS Product Context (app.corenta.app): With respect to the personal data belonging to their own clients ("Data Subject Client") that clinical Pilates, physiotherapy, reformer, wellness/massage and yoga centers using the Corenta platform by subscription ("Tenant", "Business" or "Clinic") enter into the platform (contact information, health history, session notes, appointment/package data, etc.), the Clinic is the Data Controller under KVKK Art. 3; Corenta/Teta Studio provides technical infrastructure services only in the capacity of Data Processor, in line with the Clinic's instructions. The obligation to inform clients, obtaining explicit consent and the final retention/disposal decision regarding client data are the Clinic's legal responsibility. Corenta technically facilitates the fulfillment of these obligations within the product (consent record mechanism consent_logs, mobile KVKK consent screen kvkk.tsx, audit trails), but does not take over or assume the Clinic's KVKK compliance obligation. The retention periods explained in this Policy for this context show how long Corenta actually keeps this data in its infrastructure in its capacity as data processor; the final disposal decision and period may be shaped by the Clinic's instructions and the legislation to which it is subject.

This Policy also covers, in terms of general principles, the retention/disposal processes for personal data of Corenta's employees, business partners and suppliers; however, the main focus of the Policy is the customer/client data defined in subparagraphs (a) and (b) above.

1.3. Data Controller / Data Processor Information

1.4. Underlying Legislation

• Personal Data Protection Law No. 6698,
• Regulation on the Deletion, Destruction or Anonymization of Personal Data (Official Gazette dated 28.10.2017, No. 30224),
• Guide on the Deletion, Destruction or Anonymization of Personal Data and decisions of the Personal Data Protection Board (the "Board"),
• Turkish Commercial Code No. 6102 (retention of commercial books and documents),
• Tax Procedure Law No. 213 (retention of financial records),
• Other related sectoral legislation (including, to the extent applicable, legislation on the provision of health services).

2. Definitions

3. Criteria for Determining Retention and Disposal Periods (KVKK Art. 5, Art. 6)

3.1. Reasons Requiring Retention

Within Corenta, personal data is kept only for the period expressly provided for in the relevant legislation or for the period necessary for the purpose for which it is processed. The following criteria are taken as a basis in determining the retention period:

1. Is there a legal retention obligation? (E.g. minimum retention periods for financial records under the Turkish Commercial Code and the Tax Procedure Law.)
2. For what purpose was the data processed, and is this purpose still valid? (KVKK Art. 5/2 — principle of purpose limitation.)
3. Is it necessary for the establishment/performance of a contract? (E.g. appointment and package data while the subscription/service relationship continues.)
4. Is it necessary for the establishment, exercise or protection of a right (as evidence in a possible legal dispute)? (Taking into account the general limitation periods of the Code of Obligations.)
5. Is there explicit consent from the data subject, and does this consent remain valid?
6. Does Corenta or the Clinic have a legitimate interest? (E.g. security logs, detection of fraud/misuse.)
7. Is the data in the special category (health) data category? In this case, stricter access restrictions and justification apply under KVKK Art. 6; the retention period is never extended beyond the purpose.

If none of the above criteria requires retention for a particular item of personal data, the data is deleted, destroyed or anonymized immediately.

3.2. Reasons Requiring Disposal

Personal data is deleted, destroyed or anonymized at the request of the data subject or ex officio by Corenta/the Clinic in the following cases:

a) Amendment or repeal of the legislative provisions on which its processing is based, b) Disappearance of the purpose requiring its processing or retention, c) Withdrawal of consent by the data subject in cases of processing based on explicit consent, d) A deletion/destruction request by the data subject within the framework of the rights under KVKK Art. 11 and acceptance of this request (account deletion request), e) Expiry of the retention period of the personal data and there being no remaining legal reason requiring retention, f) The contract never having been concluded, being invalid, being terminated or being rescinded, g) Final completion of the account deletion request within the process set out in Article 5 of this Policy.

4. Table of Data Categories, Retention Periods and Disposal Methods

The table below shows the main categories of personal data processed in the Corenta infrastructure, the retention period, the reason and the disposal method to be applied at the end of the period. Unless expressly stated otherwise, the general rule is: "For as long as the related account/record is active + 30 days from the processing of the account deletion request." The table should be read together with the account deletion flow explained in Section 5. For some categories, the step at the end of 30 days in this flow is not DELETE (permanent deletion) but anonymization — this distinction is expressly stated in the relevant rows and in Section 6.2.

<div style="overflow-x:auto">

</div>

Note 1: In the table above, the expression "for as long as the account/tenant is active" refers to the period during which the relevant Clinic's Corenta subscription continues and the client record has not been deleted by the Clinic. When the Clinic will delete data belonging to its own client is determined within the framework of the Clinic's own KVKK policy (in its capacity as Data Controller) and its relationship with the client; Corenta provides the technical means for this process.

Note 2: The 2-year period in Row 7 (Audit Trail Records) and the 5-year period in Row 8 (Consent Records) are fixed retention periods determined by Corenta (unlike the Turkish Commercial Code/Tax Procedure Law period in Row 6, they are not based directly on a statutory provision; they are self-imposed binding commitments determined within the framework of legitimate interest and the burden of proof under KVKK Art. 5/2-f). An automatic end-of-retention deletion mechanism for these periods is not currently running in the system — when the period expires, deletion/anonymization is carried out manually, and this Policy will be updated when automation is put in place. The expression "at most 2 years" in Row 9 (Early Access Form Data) is of a different scope and, as explained in its own row, expresses a separate legal upper limit.

5. Account Deletion Process — End-to-End Operation

To technically satisfy data subjects' deletion requests under KVKK Art. 11, Corenta applies a two-stage deletion architecture that balances the user experience against data security/legal evidence needs: an immediate soft delete (soft-delete) followed by permanent deletion at the end of 30 days.

5.0. Amendment of October 4, 2026 — this article prevails where it conflicts with 5.1–5.7

Account deletion (as of October 4, 2026): When a deletion request is confirmed, access to the account is cut off immediately (sessions are terminated, sign-in is not possible); personal data is deleted or anonymized (name, email, phone, image and client identity/contact information and health fields — blood type, allergies, chronic conditions, medications — are cleared); payment and earnings records requiring legal retention are not deleted; they are kept with the link to the person severed and with restricted access. There is no period for undoing the request; permanent deletion of the authentication record and files is completed in the existing thirty-day background process.

Deletion of a client record and health fields (as of October 4, 2026): When a client record without an account is deleted by the business, the record is immediately removed from the active list; at the end of 30 days, the client's health fields (blood type, allergies, chronic conditions, medications) are also deleted/cleared together with the identity and contact information. The retention rules for health history forms, measurements and session notes are not affected by this provision.

Receipt files (as of October 4, 2026): Receipt files not linked to a payment (orphaned) are automatically deleted after 7 days; a receipt linked to a payment is not deleted by any role.

Client contact details in support mode (as of October 4, 2026): In a Corenta support (super-admin) session, the client's email and phone information is not shown to support staff; support staff can see only a limited identity summary (name, account status, active status, creation date).

Permission to write health fields (as of October 4, 2026): The client's health fields (blood type, allergies, chronic conditions, medications) can be written only by the client themself and their assigned specialist; the business owner/admin cannot write to these fields (they can edit the emergency contact and identity fields).

Pseudonymous product measurement: To improve the product, aggregate usage events may be measured only on the server side, with a clinic pseudonymous identifier; this measurement does not include IP addresses, health data or source/advertising tracking. The clinic pseudonymous identifier is pseudonymous in nature (it is not anonymous). The feature is currently turned off.

5.1. Stage 1 — Immediate Soft Delete (Soft-Delete)

As soon as the user confirms the account deletion request from within the app, the system carries out the following operations simultaneously and instantly:

1. The user's profile record is made inactive by filling in the deleted_at field; the account becomes inaccessible/invisible for normal use and cannot be used to sign in.
2. Pending (not yet held) appointments belonging to the user are canceled automatically.
3. Assignments in which the user appears as specialist/resource (client-specialist matches, program assignments) are removed.
4. All consents belonging to the user are withdrawn (processed by filling in the revoked_at field in the consent_logs records).

At this stage the data has not been physically deleted but has been made inaccessible for normal processing and display purposes. This constitutes the first step of the deletion process in the nature of "making inaccessible" within the meaning of KVKK Art. 7 and the Regulation.

5.2. Stage 2 — Permanent Deletion (After 30 Days)

30 (thirty) days after the soft delete, a scheduled task (cron job) running automatically on the system carries out the following operations irreversibly:

1. The user's authentication record (auth.users) is deleted permanently and irreversibly.
2. The database records associated with the user are processed differently by category: records that carry no independent business/evidentiary value (e.g. notifications) are permanently deleted (DELETE/cascade); health data (anamnesis_forms, session_notes, measurements) and clinical/financial records (payments, attendance, consent_logs) are not deleted; the link to the person is severed — the link to the person is severed at the database level, some free-text fields are cleared, and the record remains with restricted access as the tenant's record with the link to the person severed (not considered anonymous, since the free text of session notes is not changed) (see Section 4 Rows 2–5, 8, 10 and Section 6.2).
3. This operation is triggered automatically only in the system's privileged (service-role protected) background process; no user or Business admin, including administrative staff, can start this process manually, trigger it early or stop it through normal product interfaces — this is a deliberate security design to prevent premature/delayed deletion by mistake or through misuse. (This assurance covers the normal user and admin interfaces of the product; technical operations processes that may have direct database access at the system's privileged infrastructure level are outside the scope of this assurance and are subject to separate internal access controls.)

Purpose of the 30-day background process (as of October 4, 2026): Since access to the account is cut off immediately upon the deletion request, this period does not provide an undo/withdrawal option; it is used to complete the permanent deletion of the authentication record and files and for any review of possible misuse. This period is a reasonable and limited period consistent with the principle of proportionality under KVKK Art. 5. Inquiries about the status of a deletion request can be made to hello@corenta.app.

5.3. Exception: Data Subject to a Legal Retention Obligation

The 30-day permanent deletion process above does not cover the records specified in Section 4, Table Row No. 6 (Subscription/Transaction Metadata) that are subject to a legal retention obligation under the Turkish Commercial Code/Tax Procedure Law. Even if the account is permanently deleted, these records are kept separately until the relevant legal retention period expires, separated from the personal data processing purpose and with access limited solely to the purpose of fulfilling the legal obligation. Likewise, audit trail records (audit_logs) and the minimum evidentiary core of consent records (see Section 4, Rows 7–8) may continue to be kept outside this 30-day period, for a separate and limited purpose, on grounds of legitimate interest/legal proof. It is expressly stated in Section 4 Note 2 that the periods within the scope of this exception do not correspond to a technical mechanism applied automatically in the system.

5.4. Special Explanation on Stored File Attachments (Important — Transparency)

In accordance with the principle of transparency, it is expressly stated: during the permanent deletion operation, database records (profile, appointment, assignment, consent, etc.) are deleted entirely or (for health/clinical/financial records, see Section 6.2) anonymized; file attachments belonging to the user and kept in a separate storage (Storage) area are handled as follows: the avatar/profile photo, documents/photos attached to the health history form and payment receipt images are automatically (best-effort) deleted from Storage as part of the permanent deletion step — this is a verified behavior actually running in the system at present. If a deletion operation in one bucket fails, this is logged; however, it does not prevent the cleanup of the other buckets or the account's anonymization/permanent deletion steps (best-effort design).

Honest limit: The only file category outside the scope of this automatic process is the identity/diploma verification documents uploaded in the specialist/solo registration process (the specialist-verification-docs bucket). Technically, these documents are linked not to the user but to the verification process of the relevant tenant (the Clinic) and carry no user reference in the database record; for this reason they cannot be automatically included in the existing user account deletion flow. The disposal of this document will be handled separately in the process of the relevant Clinic closing its account/subscription at tenant level (see Section 5.6); until this is completed, exceptional requests are assessed manually via hello@corenta.app.

For this reason, this Policy makes no absolute undertaking that "all data/files belonging to the user are deleted completely and instantly" upon an account deletion request (in particular, for technical residues in backups see Section 6.3, and for the exception above); however, automatic deletion is actually applied with respect to the file categories described above.

5.5. Special Note on Health Data

Special category health data such as health history forms, session notes and measurement records are also subject to the general deletion flow above (soft-delete → 30 days → permanent deletion); however, as explained in Section 4 Rows 2–4 and Section 6.2, in these tables the permanent deletion step is applied by severing the link to the person and partial cleaning — the record is not subjected to DELETE, the link to the person is severed and some free-text fields are cleared; the clinical record (in particular the content of append-only session notes) is kept with restricted access as the tenant's record with the link to the person severed and is not considered anonymous. In addition, because this data category is intertwined with records kept by the Clinic in its capacity as data controller, a client's account/data deletion request may conflict with the Clinic's own legal retention obligations (for example, record-keeping requirements that may arise from legislation on the provision of health services); the method of severing the link to the person and restricted retention aims to balance these two obligations (the client's rights over personal data and the Clinic's record-keeping obligation). In such cases, the final decision-maker is the Clinic in its capacity as data controller; Corenta acts in line with the Clinic's instructions.

5.6. Deletion at Clinic (Tenant) Level

If a Clinic ends its Corenta subscription entirely, the same two-stage architecture (soft-delete → 30 days → permanent deletion) is applied to the tenant data belonging to the Clinic and all client records under this tenant. Since the Clinic is the Data Controller of its own clients, it is obliged to inform its clients within the framework of its own KVKK obligations before ending its subscription; this obligation cannot be transferred to Corenta.

5.7. Relationship with Super-Admin Support Mode (Impersonation)

Account deletion and retention processes operate independently of Corenta's support/impersonation mechanism. Impersonation sessions are time-limited (30 minutes) and read-only by default; access to health data categories (health history, session notes, measurements) requires a separate approval step (health_data_enabled), and write/delete operations on these tables are under no circumstances permitted through impersonation (no exception for impersonation has been granted in the RLS policies). Clarification: The restriction here relates to human-triggered impersonation sessions in which a support staff member signs in and performs actions manually; the automatic (without human intervention) service-role cron process explained in Section 5.2 is a layer separate from this restriction and is not affected by it — the impersonation restriction does not prevent the automatic permanent deletion mechanism in the account deletion flow and should not be confused with it. Consequently, account deletion/disposal processes are carried out only through the automatic mechanisms defined in this Policy.

6. Disposal Methods

Pursuant to Art. 8 et seq. of the Regulation, the deletion/destruction/anonymization methods applied according to the recording media are explained below.

6.1. Deletion

The process of making personal data inaccessible and non-reusable in any way for the relevant users (including app users and staff with admin panel access). At Corenta, this method is applied in the Stage-1 soft-delete process: although the data is not physically removed from the database, it is made completely inaccessible through access permissions and interfaces.

6.2. Destruction (Permanent Deletion)

The process of making personal data inaccessible, irretrievable and non-reusable in any way by anyone. In Corenta's Stage-2 permanent deletion process, this principle is implemented by two different technical methods depending on the data category:

• Authentication record and records carrying no independent business value: The user's authentication record (auth.users) is deleted irreversibly by a direct DELETE in the service-role protected automatic process; related records that carry no business/evidentiary value on their own after the account is deleted (e.g. notifications, notifications — see Section 4 Row 10) are deleted together at the database level by ON DELETE CASCADE.
• Health, clinical and financial records: For anamnesis_forms, session_notes, measurements, payments, attendance and consent_logs, the permanent deletion step is applied, instead of subjecting the record to DELETE, by severing the link to the person and partial cleaning (see Section 6.6): the foreign key columns identifying the person (client_id, specialist_id, user_id, etc.) are irreversibly set to NULL by the ON DELETE SET NULL FK constraint; content columns that may contain explicit identity or free-text PII (health history answers, measurement/payment free-text notes, payment receipt reference, the IP address of the consent record) are cleared or replaced with an anonymous marker by the anonymize_user_relations() function (callable only by the service role, default-deny). Clinical/financial numerical and historical content (date, amount, measurement value, remaining session balance, attended/did-not-attend status, time consent was given/withdrawn), on the other hand, continues to be kept as the tenant's record with the link to the person severed, as required by the Clinic's record-keeping obligation and (for session notes) the append-only principle; since the free text of session notes is not changed, these records are not considered anonymous and are kept with restricted access.

In session notes (session_notes), the append-only constraint does not allow content changes; a narrow, single-purpose exception has been granted only for setting the link columns (client_id, specialist_id) to NULL — the note content itself is never deleted or changed at any stage in this process either.

Limit: There is no screening/cleaning mechanism for in-text personal data that may appear in free-text fields other than the explicit identity columns (e.g. a name mentioned in the body of a session note). For this reason these records are not considered anonymous; they are kept as personal data with restricted access and disposed of at the end of the period.

Since both of the above methods are service-role protected, they cannot be triggered or undone through normal product interfaces.

6.3. Deletion from Backups

Database backups are automatically overwritten/disposed of after a certain period within the normal backup cycle (rotation). Although the permanent deletion operation takes effect immediately in the primary database, it is expressly stated that the data may technically continue to exist in previously taken backups until the standard backup rotation period of the backup provider (Supabase) expires. This is the standard practice under the data processing agreement (DPA) of the relevant sub-processor (Supabase).

6.4. Attachments in the File Storage (Storage) Area

Files uploaded by users, such as avatar images, payment receipts and health history attachments, are kept in a separate storage (Storage) area. See Section 5.4 — the current status of this content in the account deletion process (automatic deletion for avatar/health history attachment/payment receipt, the single exception for specialist-verification-docs) is explained there in detail and transparently.

6.5. Data on Paper

Personal data processed within the scope of Corenta's SaaS product is kept in digital form; processing of personal data on paper is not envisaged. If paper is exceptionally used in the Company's commercial/administrative correspondence, disposal is carried out by blacking out/burning/irreversible shredding with a paper shredder.

6.6. Anonymization

As part of the account permanent deletion process (see Section 6.2), Corenta uses the method of severing the link to the person and partial cleaning for health data and clinical/financial records. Since the free text of session notes is not changed and, in small businesses, date and measurement series may be sufficient to re-identify the person, this method does not in every case meet the anonymization standard below; these records are not considered anonymous, are kept as personal data with restricted access and are disposed of at the end of the period. Apart from this, Corenta may also use data anonymized in such a way that it cannot be associated with an identified or identifiable natural person, for product development, statistical analysis or market research purposes. Anonymization requires the data to be rendered irreversibly incapable of being associated with the person even if combined with other data; masking/pseudonymization carried out without meeting this standard does not count as anonymization and continues to be subject to the personal data processing regime. Anonymized data is considered outside the scope of KVKK and is not subject to the retention period limitations in this Policy.

6.7. Choice of Method

The disposal method to be applied is determined by Corenta and/or the Clinic, taking into account the nature of the data (whether it is special category), the medium in which it is kept (database, file storage, log system, backup system), legal and technical possibilities, and the principles set out in Board decisions and the Regulation. Utmost care is taken in disposal operations for special category personal data (including health data).

7. Periodic Disposal Process

Pursuant to Art. 11 of the Regulation, Corenta is obliged to delete, destroy or anonymize ex officio (without awaiting a request) personal data whose retention period has expired and/or whose purpose of processing has ceased to exist; the periodic disposal interval to be provided for in this context may not exceed 6 (six) months. Within this framework, the following distinction is expressly made between the mechanisms currently actually running and not running in the system:

1. The 30-day permanent deletion process following an account deletion request is scanned periodically (daily) by an automatic scheduled task (cron job), and accounts whose period has expired are processed in bulk. This is a verified automation actually running in the system at present.
2. The retention period provided for audit trail records (audit_logs) is reviewed periodically; however, a deletion mechanism that automatically executes this review is not currently implemented (see Section 4, Row 7).
3. The maximum retention period determined for early access form data (see Section 4, Row 9) is a legal upper-limit reference for the periodic disposal obligation under Art. 11 of the Regulation; however, there is currently no screening/deletion mechanism running automatically in the system corresponding to this period. For this data category, deletion/anonymization is assessed manually and on request until automation is put in place (see Section 4, Note 2). This matter is kept transparent, consistently with the other unverified automation claims (see items 2 and 4).
4. Separate automatic and periodic cleanup of expired/invalid push notification tokens is an improvement planned in the product roadmap; it has not been technically verified that this mechanism is actually running in the system at present (see Section 4, Row 10). When it is verified or put in place, this Policy will be updated.
5. 6-monthly periodic disposal: For the categories in this Section without automatic disposal (audit trail, consent evidence with the link to the person severed, early access form data, specialist verification documents, group message moderation copies), Corenta applies periodic disposal every 6 months and draws up a disposal record for each cycle. There are not yet scheduled jobs automating these cycles; the cycles are carried out manually.

The periodic disposal process, independently of the periods specified in this Policy, does not prevent an individual deletion/destruction request by the data subject under KVKK Art. 11; the data subject may make a deletion request even if the retention period has not expired, if the legal basis for the relevant processing activity has ceased to exist (e.g. withdrawal of consent). For categories for which automation has not yet been implemented as well, the data subject's individual request, when sent via hello@corenta.app, is assessed and concluded manually.

8. Rights of the Data Subject and Application Procedure (KVKK Art. 11)

8.1. Rights under KVKK Article 11

Under KVKK Art. 11, data subjects have the following rights:

1. To learn whether their personal data is processed,
2. To request information if their personal data has been processed,
3. To learn the purpose of processing personal data and whether it is used in accordance with its purpose,
4. To know the third parties in Türkiye or abroad to whom personal data is transferred,
5. To request correction of personal data if it has been processed incompletely or incorrectly,
6. To request deletion or destruction of personal data within the framework of KVKK Art. 7,
7. To request that the actions carried out under subparagraphs (5) and (6) above be notified to the third parties to whom personal data has been transferred,
8. To object to a result to their detriment arising from the analysis of the processed data exclusively through automated systems,
9. To claim compensation for damage if they suffer damage due to the unlawful processing of personal data.

8.2. Honest Summary of the Current Technical Implementation

The following matters are presented as an honest and realistic summary of the current technical implementation:

• Deletion request (account deletion): Can be requested directly from the relevant settings menu within the mobile app; this request is fulfilled automatically by the two-stage (immediate soft-delete → 30 days → permanent deletion) process explained in Section 5 (Art. 11/6).
• Request for information / data portability: Fulfilled by providing the data subject, within a reasonable time, with the data within their own tenant scope in a structured, machine-readable format (the export_user_data function; tenant scope has been verified). The delivery mechanism of this process (features such as file format, delivery method, signed download link) is being continuously developed; no undertaking is given under this Policy regarding a specific delivery time or a specific file/access format (Art. 11/1-2).
• Information on transfers to third parties (Art. 11/4): Information on the domestic/foreign third parties/sub-processors to whom personal data is transferred is provided in the table in Section 11 (Sub-processors and Data Localization) of this Policy.
• Correction request (Art. 11/5): Can technically be carried out manually through the Clinic's admin panel; there is no separate, automated "correction request" workflow. In the SaaS product context, correction requests relating to client data should be directed primarily to the relevant Clinic; Corenta provides technical support in its capacity as Data Processor in line with the Clinic's instructions.
• Notification to third parties (Art. 11/7): A request for deletion/correction operations to be notified to the third parties to whom data was transferred is assessed when sent through the channels specified in the application procedure; this process is currently carried out manually, not automatically.
• Objection to automated decisions/profiling (Art. 11/8): There is no automated decision-making or profiling activity in the system that produces a result to the detriment of the data subject through the analysis of the processed data exclusively by automated systems; therefore, there is currently no need for a separate objection mechanism actually operated in respect of this item.
• Applications are concluded free of charge within 30 days at the latest under KVKK Art. 13 (if the operation requires an additional cost, the fee in the tariff determined by the Board may be charged).

8.3. Application Procedure

Requests relating to the above rights may be sent to Corenta:

• To the email address hello@corenta.app,
• Through the relevant in-app settings/support screens,
• Or by the other methods provided for by KVKK.

Important note regarding client data: If you are a client of a Clinic and wish to make a request regarding your data, you must first apply to the relevant Clinic (the Data Controller), since the Clinic is the final decision-maker and addressee with respect to client data. In its capacity as data processor, Corenta provides the necessary technical tools (data viewing, export and deletion functions) in line with the Clinic's instructions.

9. Roles and Responsibilities

10. Security Measures (During the Retention Period)

Personal data is protected during the retention period by the following technical and administrative measures (KVKK Art. 12):

• In the multi-tenant architecture, the default-deny principle is applied through the tenant_id requirement in every table and Row Level Security policies (37/37 tables, 86 policies); data leakage between tenants is technically prevented in this way.
• Access to tables containing health data is limited only to the relevant client, the assigned specialist and the tenant admin; access control is applied at the database level (RLS). Session notes cannot be changed/deleted after submission (append-only); no user (including the admin) has been granted deletion rights for health history forms.
• The super-admin support mode (impersonation) is time-limited (30 minutes) and read-only by default; write operations and health data access are subject to separate steps requiring additional approval; write access to health data tables is not opened in any impersonation scenario. (This restriction relates to human-triggered impersonation sessions; automatic service-role cron processes are a separate layer — see Section 5.7.)
• End-to-end encryption (TLS) is used in data transmission; in the mobile app, session tokens are stored encrypted in the device's secure hardware-backed key store (Keychain/Keystore).
• Technical measures have been taken to limit the taking of screenshots on sensitive screens.
• Two-factor authentication (2FA/MFA) is mandatory for super-admin accounts.
• Cryptographic signature verification of notifications (webhooks) relating to payment transactions is provided for in the architecture and is being applied; work towards fully completing the related configuration/key management in all environments (including prod) is ongoing.
• These security measures are continuously reviewed and improved; however, no technical measure guarantees absolute security, and no absolute security undertaking is given under this Policy.

11. Sub-processors and Data Localization

During the retention period, personal data is processed or hosted through the following sub-processors/service providers. The agreements with these providers provide for obligations to process the data only for the purpose of performing the specified service; this relationship refers not to retention periods but to the technical environment in which the data is hosted — the implementation of the disposal decision is also carried out technically at these providers. The table below also constitutes the fulfillment of the right "to know the third parties to whom data is transferred" under KVKK Art. 11/4:

In addition:

• Email infrastructure: Service emails are sent through Google Workspace (Google); authentication emails are triggered by Supabase Auth. Promotional emails are sent only subject to separate consent and İYS (the Turkish Message Management System) registration. Push notifications are delivered through Apple (APNs) and Google (FCM).
• Analytics tool: No third-party analytics tool (e.g. Google Analytics) is used. In-app product usage measurement is currently not active; if it is activated, the measurement is written to a first-party table kept in Corenta's own database (Supabase, Frankfurt/Germany), contains no health data or free text, and this Policy will be updated before it is activated; when it is activated, the retention period of the measurement records will be specified in this Policy.
• Error monitoring: No third-party error monitoring tool is used; client errors are recorded in Corenta's own database.
• There is no infrastructure for payment directly by credit card over the web; payments are made only through Apple/Google in-app purchase (IAP) mechanisms; the final invoice/receipt is issued by Apple/Google (see Section 4, Row 6).

Data sharing with the above sub-processors is carried out only to the extent necessary for the provision of the relevant service and within the framework of KVKK Art. 8/Art. 9. Cross-border transfer: All of the providers above process data outside Türkiye; hosting in Germany is also a cross-border transfer within the meaning of KVKK. Because these transfers are regular and continuous, they are not based on explicit consent; they will be based on the standard contracts announced by the Board under Art. 9/4-c. As of the date of this text, the standard contracts have not yet been signed and have not been notified to the Board; each contract will be notified to the Board within 5 business days of signature and this table will be updated with the dates. There is no adequacy decision announced by the Board for these countries (last checked: October 11, 2026). This list may be updated depending on changes in service providers; the current list can be followed from the Privacy Policy and/or the relevant information screen within the Corenta product.

12. VERBİS Registration

As of the date of this document, Teta Studio has no VERBİS registration. The registration obligation is being assessed according to the criteria in Board Decisions No. 2025/1572 (exemption threshold for data controllers whose main activity is the processing of special category data: 10 employees per year and a balance sheet of TRY 10 million) and No. 2025/2393 (number-of-employees criterion for those not keeping books on a balance sheet basis). Since Teta Studio processes clinic health data not as data controller but as data processor, the assessment with respect to its own data controller activities (Parts A and C) is made according to these criteria. When the written assessment note and confirmation by the Authority (ALO 198) are completed, this section will be updated with the date and reasons; if registration is required, it will be made before continuing the activity.

Role-based clarification: The obligation to register with VERBİS is being assessed for the corporate website context (corenta.app early access form), in which Corenta acts in the capacity of Data Controller, and its status is explained above. In the SaaS product context (app.corenta.app), since the Data Controller for client data is the Clinic, whether there is an obligation to register with VERBİS must be assessed separately and independently according to each Clinic's own criteria (number of employees, annual data processing volume, field of activity, the Board's exemption decisions, etc.); this assessment and any registration obligation belong to the Clinic and cannot be transferred to Corenta.

13. Updating the Policy

This Policy may be updated in line with legislative changes, Board decisions, developments to be made in Corenta's technical infrastructure (for example, the addition of in-text PII screening of the free-text content of session notes referred to in Section 4 Row 3 and Section 6.2, the linking of specialist verification documents (specialist-verification-docs) referred to in Section 5.4/Section 4 Row 11 to the tenant closure process, the verification/introduction of push token cleanup referred to in Section 4 Row 10 and Section 7 item 4, the establishment of an automatic screening mechanism for early access form data referred to in Section 7 item 3, the development of the data portability process referred to in Section 8.2, the completion of the legal bases for cross-border transfer in Section 11, a change in the sub-processor list) or changes in business processes. The current version is published on Corenta's relevant platforms (corporate website and/or in-app), and the current version prevails with respect to provisions that conflict with the previous version. In the event of significant changes, users/Clinics are additionally informed to the extent applicable.

14. Contact

For your questions about this Policy or the retention/disposal of personal data:

Email: hello@corenta.app Data controller: Mertcan Demir — sole proprietorship under the trade name "Teta Studio" Support: support@corenta.app Service area: Corenta is offered globally through the App Store and Google Play, in the countries where those stores operate. The periods in this Policy apply to users in every country; where the mandatory law of a country requires earlier erasure or a longer retention obligation, that rule applies.

Last updated: October 19, 2026 Version 1.9 · October 19, 2026