CORENTA — PRIVACY NOTICE UNDER THE PERSONAL DATA PROTECTION LAW

This translation is provided for information only; the Turkish text is legally binding.

Three-Part Privacy Notice According to the Capacity of Data Controller / Data Processor

Version: 2.3 · Effective / last updated: October 19, 2026 Data controller / publisher (Parts A and C): Mertcan Demir — sole proprietorship under the trade name "Teta Studio"

Change log

• 2.3 — October 19, 2026: Global scope incorporated: the "Türkiye only" statement in G.4 was replaced with availability in more than one country through the app stores and a reference to the GDPR Statement for the EU/EEA. Processing activities and legal grounds are unchanged.
• 2.2 — October 19, 2026: Publication version; effective date October 19, 2026. The empty MERSİS and KEP information was removed from the A.1 identity table. The B.8/a group message retention period was linked to the Data Retention and Disposal Policy.
• 2.1 — October 18, 2026: The features added on October 18, 2026 were incorporated: clinic groups, in-studio challenges, client badges and loyalty card, weekly tasks and monthly report card (Part B); studio league and city challenges, the specialist's portable profile card, studio-to-studio invitation code, the Founding Studio program, Corenta Lab, Discover v2 (short video, trial class, sponsored placement), the repeat-trial flag, device binding and "My Sessions", partial store refunds and Apple's request for usage information (Part C). How health data is handled in groups, the league, challenges and the profile card was written in a separate section (B.3-A). G.1 was corrected: the three rules that produce an automated result affecting a person (invitation misuse check, hiding of a group message after three reports, league exclusion) were stated explicitly. Mobile permissions were corrected according to the code (camera permission is not requested). Features that are switched off (share verification, demand signal, Boost guarantee, device attestation, Turnstile, Sentry) were not written into this text; a separate text update is required before they are switched on.
• 2.0 — October 11, 2026: Based on the October 11, 2026 compliance review (F01, F02, F04, F05, F07, F08, F11, F13, F14, F19, F22, F26): the cross-border transfer sections were rewritten in line with the post-2024 version of Article 9 of Law No. 6698 on the Protection of Personal Data (KVKK) (Supabase/Frankfurt included, this is a cross-border transfer; the standard contracts have not yet been signed); the privacy notice and explicit consent were separated (the privacy notice is not a "consent" but an "I have read and understood" acknowledgment; the mandatory consent box in the early access form was removed); health data consent was written as optional; a new Part C — Corenta Account and Platform Notice was added for the activities for which Teta Studio is the data controller; the identity information was corrected to a sole proprietorship; the VERBİS (Data Controllers' Registry Information System) assessment was written according to the 2025 decisions of the Personal Data Protection Board (Kurul); breach notification to the clinic was corrected to 24 hours at the latest; the wording on "anonymous" retention was corrected to restricted retention with the link to the person severed; file attachment deletion and the export link were aligned with a single wording verified against the code; incorrect statutory references were corrected.
• 1.6 — October 10, 2026: Expo (Expo Push Notification Service) was removed from the sub-processor/processor records; push notifications are delivered only through Apple (APNs) and Google (FCM); Expo/EAS is only an app build tool and does not process end-user data.
• 1.5 — October 10, 2026: The wording on the choice of Google Analytics was removed; it was clarified that no third-party analytics is used, and the push processors were clarified.
• 1.4 — October 4, 2026: The current text was fixed as the approved version. Only the following were incorporated in this version: Teta Studio trade name mark; market (Türkiye); account deletion (access is cut off immediately, personal data is deleted/anonymized, payment records requiring legal retention are kept without identity); deletion of client health fields at the end of 30 days; 7-day period for orphaned receipts; client contact details remaining hidden in support mode; anonymous server-side measurement; service emails and Google Workspace; push processors; support address (support@corenta.app); permission to write health fields.
• 1.3 — August 4, 2026: Sections B.6 and B.8/a were made consistent with the retention and disposal policy.

0. About This Text — Scope and Reading Guide

This Privacy Notice under the Personal Data Protection Law (the "Privacy Notice") has been prepared, pursuant to Article 10 of Personal Data Protection Law No. 6698 ("KVKK" or the "Law") and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform, in order to inform data subjects about the processing of personal data in the context of the software (SaaS) product named Corenta ("Corenta", the "Product" or the "Platform"), developed and operated by Mertcan Demir, who carries on business as a sole proprietorship under the trade name "Teta Studio" ("Teta Studio", "we"), and of the corenta.app website on which this product is promoted.

Corenta is a multi-tenant, mobile-first software platform (Software-as-a-Service) for boutique health and wellness businesses such as clinical Pilates, physiotherapy, reformer, wellness/massage and yoga centers, providing appointment management, package/session tracking, client health history and session notes, and earnings and financial transaction tracking.

0.1 Definitions

0.2 Two Separate Contexts — Why It Matters

In the Corenta ecosystem, personal data is processed in three different contexts and in two different capacities: Part A (promotional website; Teta Studio is the data controller), Part B (the clinic's records; Teta Studio is the data processor) and Part C (Corenta account, subscription, service emails, Discover/reviews, cross-studio growth features — league, invitation, Founding Studio, Corenta Lab, portable profile card —, account and device security and product measurement; Teta Studio is the data controller). A clear understanding of this distinction is essential for the correct interpretation of the Privacy Notice, and the two contexts must under no circumstances be confused:

The health data of a clinic client created in the Corenta app and the data of a business owner who fills in the early access form on the corenta.app website are subject to entirely different legal regimes. The following parts are structured according to this distinction.

PART A — CORPORATE WEBSITE AND EARLY ACCESS FORM (corenta.app)

This part applies to natural persons who visit the corenta.app website, interact with the website and/or fill in the early access application form. In this context, Teta Studio acts in the capacity of Data Controller under KVKK Art. 3/ı and itself determines the purposes and means of processing personal data.

A.1. Identity of the Data Controller

A.2. Categories of Personal Data Processed

The following categories of personal data may be processed when you visit the corenta.app website, fill in the early access form, submit a contact form or request a demo/sales meeting:

(*) Explanation regarding the cookie note: As of the date of publication of this text, there is no active cookie banner/management interface or third-party cookie infrastructure on the corenta.app website; the IP address/device/browser information referred to in the row above is processed to a limited extent, only within the scope of basic server logs and form security, without using any active cookie technology. Although a cookie consent category (cookies) has been technically defined in the system infrastructure, this category is not currently actually used. If cookies come to be used, this Privacy Notice and a separate Cookie Policy will be updated and the necessary consent mechanisms will be put in place. No special category personal data is processed in this context.

This data is obtained only through the data subject filling in the form or making contact of their own free will, or automatically as required by the technical operation of the website (such as IP).

A.3. Purposes and Legal Grounds for Processing Personal Data

The table below shows each processing purpose together with which of the legal grounds listed in KVKK Art. 5/2 it is based on:

Important: Marketing communication under item 7 is based only on the consent that the data subject has given separately and explicitly for this purpose; this consent is not a mandatory condition of the early access application and can be withdrawn at any time (see A.8).

A.4. Method of Collecting Personal Data

Personal data is collected electronically through the filling in of the early access/contact forms on the corenta.app website, direct communication by email, demo/sales meetings and automatically by the technical infrastructure of the website (IP address, etc.).

A.5. Transfer of Personal Data

Your personal data may be shared with suppliers providing hosting, form collection, email delivery, analytics, security and similar technical services, limited to the purpose of providing these services and within the conditions provided for in Articles 8 and 9 of KVKK. This sharing is done only to the extent necessary for the provision of the relevant service and limited to that purpose.

Technical infrastructure providers known/in use in this context:

Note — infrastructure where form data is stored: As of the date this text was prepared, it has not been technically confirmed whether early access/contact form data is ultimately kept only in Framer's own form infrastructure or is also transferred to Corenta's Supabase-based database (see Part B, B.5 — Supabase, Frankfurt/Germany). As this matter is confirmed, this table will be updated, if necessary by adding a Supabase row; in any event, your form data is processed only for the purposes described in this Part A and in compliance with KVKK.

Apart from this sharing, your personal data is not sold, rented or transferred to third parties for marketing purposes. Cases of legal obligation (court decision, request from an authorized public body, etc.) are an exception to this rule.

Cross-border transfer: Framer and Google Workspace process data outside Türkiye; this is a cross-border transfer within the meaning of Law No. 6698. Because these transfers are regular and continuous, they are not based on explicit consent; they will be based on one of the processing conditions in Article 5 of KVKK and, under Art. 9/4-c, on the standard contracts announced by the Personal Data Protection Board. As of the date of this text, the standard contracts have not yet been signed with the providers and have not been notified to the Board. Each contract will be notified to the Board within 5 business days of its signature date, and this section will be updated with the list of providers and dates. There is no adequacy decision announced by the Board for these countries (last checked: October 11, 2026).

A.6. Retention Period

Your personal data is kept for the period required by the relevant processing purpose and, in any event, subject to the limitation periods provided for in the relevant legislation:

• Early access applications: At most 2 years from the evaluation of the application and the conclusion of the communication process; if no contact is made or the process is concluded within this period, it is deleted/anonymized sooner. Transparency note: As of the date this Notice was prepared, there is no screening/deletion mechanism running automatically in the system corresponding to this maximum period; the period is a legal upper limit, and deletion/anonymization is currently carried out manually/on request.
• Communication records: Until the purpose of the communication ends.
• Analytics/technical log data: For the default/permitted retention period of the tool/infrastructure used.
• Records of legal disputes and obligations: For the minimum period provided for by the relevant legislation.

When the retention period expires, personal data is deleted, destroyed or anonymized in accordance with KVKK Art. 7 and the Regulation on the Deletion, Destruction or Anonymization of Personal Data. For the detailed table of periods and disposal methods, see veri-saklama-imha-politikasi.md (Section 4, Row 9).

A.7. Information and Commercial Message Consent in the Early Access Form

The processing of your application is not based on consent but on the legal grounds in A.3. For this reason, there is no consent box for the privacy notice in the form; the privacy notice and consent are kept separate.

Information (no consent box): The following text and a link to this Privacy Notice are shown immediately above the submit button:

"Your information is processed to evaluate your application and to contact you (KVKK Art. 5/2-c, f). Details: Privacy Notice."

Optional commercial message consent (separate box, NOT CHECKED by default):

"I consent to Teta Studio sending Corenta announcements and campaigns by email."

Not giving commercial message consent does not affect the evaluation of the application. Teta Studio does not send promotional emails without registering with the Message Management System (İYS); after registration, consents are uploaded to İYS within 3 business days. Consent can be withdrawn through the opt-out link in every message.

A.8. Rights of the Data Subject (KVKK Art. 11) and Method of Application

Under Article 11 of KVKK, every data subject whose personal data is processed has the following rights, by applying to the Data Controller:

a) To learn whether personal data is processed, b) To request information if their personal data has been processed, c) To learn the purpose of processing personal data and whether it is used in accordance with its purpose, ç) To know the third parties in Türkiye or abroad to whom personal data is transferred, d) To request correction of personal data if it has been processed incompletely or incorrectly, e) To request deletion or destruction of personal data within the framework of the conditions provided for in KVKK Art. 7, f) To request that the actions carried out under subparagraphs (d) and (e) be notified to the third parties to whom personal data has been transferred, g) To object to a result to their detriment arising from the analysis of the processed data exclusively through automated systems, ğ) To claim compensation for damage if they suffer damage due to the unlawful processing of personal data.

In addition, for processing based on consent (commercial electronic messages), the consent given can be withdrawn at any time and without giving reasons, independently of the general rights under KVKK Art. 11. Withdrawal of consent does not affect the lawfulness of the processing before the withdrawal.

Method of Application: To exercise the above rights, you can send your requests in writing to hello@corenta.app, together with the information necessary to establish your identity, in the manner provided for in Article 13 of KVKK and the Communiqué on the Procedures and Principles of Application to the Data Controller. Your applications are concluded free of charge, depending on their nature, within 30 (thirty) days at the latest, using methods that do not require an additional cost; if the action requires an additional cost, the fee in the tariff determined by the Personal Data Protection Board may be charged.

PART B — USE OF THE CORENTA SaaS PRODUCT BY CLINICS

This part applies to clinic staff (admin, specialist/instructor, reception, etc.) who use Corenta through a clinical Pilates, physiotherapy, reformer, wellness/massage or yoga center (the "Clinic") and to the clients/patients of these clinics.

B.1. Legal Basis of the Role Allocation — Please Read Carefully

The Clinic that purchases Corenta and puts it into use has the capacity of "Data Controller" under KVKK Art. 3/ı with respect to the personal data of its own clients/patients and its own staff. The KVKK obligation to inform clients/patients and staff and, where necessary, to obtain explicit consents (in particular the special category data consent relating to the processing of health data) is primarily and ultimately the Clinic's responsibility.

Teta Studio (Corenta) is only a Data Processor under KVKK Art. 3/ğ. Teta Studio processes this data in line with the Clinic's instructions and on the Clinic's behalf, solely by providing the technical infrastructure of the Platform; it does not determine an independent processing purpose of its own and does not process this data for its own commercial purposes (advertising, sale to third parties, etc.) outside the Clinic's instructions. Processing that Teta Studio carries out for its own purposes (clinic user account, subscription, service emails, Discover/review invitation and reviews, security and pseudonymous product measurement) is the subject not of this Part B but of Part C; in these activities Teta Studio is the data controller.

The Corenta product offers tools that technically facilitate the Clinic's fulfillment of these obligations (consent screen in the mobile app, versioned consent records, withdrawal mechanism, etc. — see B.2). The existence of these tools does not mean that the Clinic has transferred to Teta Studio the legal obligations arising from its capacity as Data Controller or that Teta Studio has assumed these obligations.

The data processor relationship between the Clinic and Teta Studio is governed by a separate Data Processing Agreement (DPA); this agreement details the categories of data to be processed, the purposes of processing, the security measures, the use of sub-processors and the parties' obligations under KVKK Art. 12.

This Part B does not replace, and is not a substitute for, the privacy notice that the Clinic will provide to its own clients/staff. The purpose of this part is to explain transparently which data Teta Studio processes on the Platform for which purpose in its capacity as Data Processor, and to offer a framework that the Clinic can refer to when preparing its own privacy notice. If the Clinic does not consider the common/central privacy notice screen and the optional consent screens offered by Corenta within the mobile app (see B.2) sufficient, it may separately carry out an additional/separate information process for its own Clients and staff with its own means (written text, email, face-to-face information, etc.); this falls within the Clinic's own legal responsibility.

B.2. In-Platform Privacy Notice and Consent Mechanism (For Information Purposes)

In the Corenta mobile app, at the first-use (onboarding) stage, there is a screen (kvkk.tsx) prepared by Teta Studio and offered in common to the clients/users of all clinics. In line with the Board's Principle Decision No. 2026/347, the privacy notice and consent are shown in separate steps:

The records are kept in versioned form in the consent_logs table. Technical note: the display of the privacy notice is currently recorded in this table with the type kvkk; this record is not a consent but an acknowledgment that the privacy notice was shown and read. The operating system's single notification permission is used for the delivery of both transactional and campaign notifications; campaign notifications should be sent only if consent 2b has been given.

This screen and these texts are not differentiated per Clinic and are offered as a common version across the Platform; clinic identity information (trade name, address, application contact) is currently not added to the text automatically. When the version of the privacy notice changes, the user is asked at the next sign-in to indicate that they have read the new text (this is not a consent either). Health data consent and campaign consent can be withdrawn at any time (tracked with the revoked_at field); withdrawal of health data consent does not affect appointment and account use.

If the Clinic, as a health professional bound by confidentiality (e.g. a physiotherapist), processes health data for treatment purposes on the basis of KVKK Art. 6/3-e, a privacy notice alone may be sufficient instead of the explicit consent screen; other businesses (e.g. a Pilates/wellness studio) may process health data only on the basis of optional explicit consent under Art. 6/3-a. Which legal ground is relied on and whether the content of the privacy notice suits its own activity are the Clinic's responsibility.

B.3. Categories of Data Processed by Teta Studio in Its Capacity as Data Processor

As required by the technical operation of the Platform, the following categories of data are processed in line with the Clinic's instructions:

Permission to write health fields (as of October 4, 2026): The client's health fields (blood type, allergies, chronic conditions, medications) can be written only by the client themself and their assigned specialist; the business owner/admin cannot write to these fields (they can edit the emergency contact and identity fields).

Pseudonymous product measurement: Teta Studio is the data controller in this activity and the details are in Part C. Measurement is carried out with a clinic pseudonymous identifier; this identifier is pseudonymous in nature (it is not anonymous). The feature is currently turned off.

Receipt files (as of October 4, 2026): Receipt files not linked to a payment (orphaned) are automatically deleted after 7 days; a receipt linked to a payment is not deleted by any role.

Clarification on mobile permissions (as of October 18, 2026): At the operating system level, the Corenta mobile app requests only notification permission (asked in context) and, on iOS, photo library access (at the moment a profile photo, health history attachment, payment receipt, announcement image or studio video is chosen); if the app lock is on, the device's Face ID/fingerprint verification is used on the device, and biometric data is not transmitted to Corenta. On Android, the camera and microphone permissions have been deliberately removed from the app manifest. The app does not request camera, microphone, location, contacts, calendar permission or HealthKit/health sensor access. The Discover map does not use the device location; it searches only by the province/district or map area chosen by the user.

Special category personal data (health information) may be processed under KVKK Art. 6 only with explicit consent or in the exceptional cases provided for by law (carried out by persons under an obligation of confidentiality, such as the protection of public health, preventive medicine, medical diagnosis/treatment, and the planning and financing of health services). In the Corenta ecosystem, this data is entered by the Clinic's authorized health/wellness specialists according to the legal ground relied on by the Clinic (optional explicit consent under Art. 6/3-a or Art. 6/3-e); Teta Studio hosts/processes this data only in line with the Clinic's instructions and protects it with enhanced security measures (see B.6).

Retention period and destruction method — cross-reference: For each of the categories above, the retention period and the method applied after an account deletion request (permanent deletion or anonymization) are summarized in B.8/a and explained with a detailed table and reasons in veri-saklama-imha-politikasi.md (Sections 4–6). In particular for the rows Health Information, Transaction/Financial Information and Privacy Notice and Consent Records: at the account permanent deletion stage, these records are not subjected to DELETE; the link to the person is severed and some free-text fields are cleared. Since the free text of session notes is not changed, these records are not considered anonymous in every case; they are kept with restricted access (see B.8/a).

B.3-A. Community and Growth Features — Relationship with Health Data (as of October 18, 2026)

Health data is special category personal data within the meaning of KVKK Art. 6. The following features are not designed to process health data; how health data is handled is written separately for each of them:

In clinics that provide health services, such as physiotherapy, the fact that a client has attended a class or joined a group may indicate that the person is receiving a health service. For this reason, the decision whether to use these features and how to inform its clients rests with the Clinic as data controller. Clinic groups (group_chats) and challenges (leagues) are separate modules and are designed so that they can be switched off per clinic.

B.4. Purposes of Processing and Legal Grounds

The legal grounds in the table below may have two different meanings depending on the nature of the data concerned: (i) the legal ground on which the Clinic (as data controller) relies towards its client/staff, or (ii) the legal ground applicable to Teta Studio's own independent activities (such as platform security, billing, legal obligation). Bearing in mind that Teta Studio does not determine an independent "processing purpose" on its own (see B.1), the row relating to special category data in particular should be read as reflecting the Clinic's legal ground:

B.5. Transfer of Personal Data (Domestic and Cross-Border)

For the Platform to work, personal data is shared with the following sub-processors, to a limited and technically necessary extent:

Other infrastructure notes:

• Email infrastructure: Service emails (trial period, team invitation, support replies) are sent by SMTP through Google Workspace (Google); authentication emails (email verification, password reset) are triggered by Supabase Auth. Promotional emails are sent only subject to separate consent and İYS registration (see Part C). Push notifications are delivered through Apple (APNs) and Google (FCM).
• Analytics tool: No third-party analytics tool (e.g. Google Analytics) is used. In-app product usage measurement is currently not active; if it is activated, the measurement is written to a first-party table kept in Corenta's own database (Supabase, Frankfurt/Germany), contains no health data or free text, and this Notice will be updated before it is activated.
• Error monitoring: No third-party error monitoring tool is used; client errors are recorded in Corenta's own database (Supabase).
• Real-time message delivery and videos (as of October 18, 2026): One-to-one and group messages are delivered only to authorized users via Supabase's real-time delivery service (Realtime); studio videos are kept in Supabase file storage. These fall within the scope of the Supabase row (No. 1); no new sub-processor has been added.
• Payment by credit card over the web: Currently not supported; all subscription payments are carried out only through the Apple/Google in-app purchase (IAP) mechanism.

Cross-border transfer: Your data is processed through service providers located outside Türkiye: Supabase (database, authentication and file storage; data is hosted in Germany/Frankfurt), Vercel (web panel hosting; global infrastructure), Google (Google Workspace email and Firebase Cloud Messaging notifications; global) and Apple (notifications and store; global). Hosting in Germany is also a cross-border transfer within the meaning of Law No. 6698. Because these transfers are regular and continuous, they are not based on explicit consent; they will be based on one of the processing conditions in Articles 5 and 6 of KVKK and, under Art. 9/4-c, on the standard contracts announced by the Personal Data Protection Board. As data processor, Teta Studio will sign the Module 3 (processor to processor) standard contract with each sub-processor and notify it to the Board within 5 business days of the signature date. As of the date of this text, the standard contracts have not yet been signed and have not been notified to the Board; when signature and notification are completed, this section will be updated with the list of providers and dates. There is no adequacy decision announced by the Board for these countries (last checked: October 11, 2026). The Clinic includes these transfers in its own privacy notice.

The sub-processor list above is also kept separately and up to date in the annex to the DPA between the Clinic and Teta Studio; the Clinic is informed of changes to the sub-processor list in the manner provided for in the DPA. Personal data may be transferred to legally authorized public institutions and organizations only in the cases provided for by the relevant legislation and limited to the request; Teta Studio does not in any way sell or rent the personal data it processes to third parties for commercial purposes.

B.6. Security Measures

In its capacity as Data Processor, Teta Studio applies the following technical and administrative measures to ensure the security of the personal data it processes:

• Tenant isolation (multi-tenant isolation): All data tables on the Platform are separated by the tenant_id field and protected on a default-deny basis by comprehensive Row Level Security (RLS) policies; access by one Clinic to another Clinic's data is technically prevented.
• Restriction of access to health data: At the RLS level, health history form, session note and measurement data can be accessed only by the relevant client, the specialist assigned to the client and the authorized clinic admin; session notes that the specialist has marked as "shared with the team" can also be seen by the clinic's other specialists. Staff access is possible while the relevant health module (health history, measurements, session notes) is turned on.
• Immutability (append-only): Submitted session notes (once the submitted_at field is filled in) are protected at the database level so that they cannot be updated or deleted; for health history forms too, no deletion (DELETE) permission is defined for any user role (including the clinic admin). Single and narrow exception: in the account permanent deletion process (see B.8/a), only the privileged (service-role) background process may set to NULL, at the database level, only the columns linking to the person (client_id/specialist_id) without touching the CONTENT of the session note; this does not break the append-only principle — it is a single-purpose transition that only fulfills the obligation to sever the link to the person (anonymization) under KVKK (details: veri-saklama-imha-politikasi.md Section 6.2).
• Super-admin support mode (impersonation) restrictions: The super-admin access mode used for technical support is time-limited (30 minutes) and by default read-only; write operations and access to health data can be opened only through separate steps requiring additional approval (the health_data_enabled flag); no write permission has been granted for health data tables in any impersonation scenario — this restriction is applied without exception in the database policies.
• Transmission security: Data is encrypted in transit with TLS.
• On-device storage: In the mobile app, session tokens are stored encrypted in the device's secure hardware-backed keychain (expo-secure-store based on iOS Keychain / Android Keystore).
• Sensitive screen protection: Screenshots and screen recording are blocked on mobile screens containing health data (iOS screen recording/screenshot block; Android FLAG_SECURE).
• Admin account security: Platform admin (super-admin) accounts require two-factor authentication (MFA, AAL2).
• Payment integrity: A cryptographic signature verification infrastructure is applied for store (Apple/Google) payment notifications (webhooks); the process of fully completing the configuration in this area in the production environment for all providers and of continuously improving it is ongoing.

It is expressly stated that, despite the above measures, no absolute security guarantee can be given for any information system. These measures are continuously reviewed and improved as part of the Data Processor's obligations under KVKK Art. 12. When Teta Studio, in its capacity as data processor, becomes aware of a data breach, it notifies the Clinic without delay and within 24 hours at the latest (Board 2019/10). Notification to the Board and to data subjects is the obligation of the Clinic as data controller. For data for which Teta Studio is the data controller (Parts A and C), Teta Studio makes the notification to the Board within 72 hours.

B.7. Additional Information on Super-Admin Support Mode (Impersonation)

Teta Studio's authorized support staff may temporarily access the Clinic account through a limited and auditable "support mode" in the context of technical support requests from the Clinic. This access:

• Is limited to at most 30 minutes and ends automatically at the end of this period,
• Is by default read-only,
• Write permission and access to health data can be opened through steps that are separate from each other and require additional approval; write access to health data tables is not granted under any circumstances,
• Is logged and subject to an audit trail.

Client contact details in support mode (as of October 4, 2026): In a Corenta support (super-admin) session, the client's email and phone information is not shown to support staff; support staff can see only a limited identity summary (name, account status, active status, creation date).

B.8. Retention Period of Personal Data and Manner of Exercising Data Subject Rights

Personal data is kept for the period necessary for the relevant purpose and for the legal retention periods provided for in the relevant legislation. The rights below are, under KVKK Art. 11, exercised primarily against the Clinic in its capacity as Data Controller. In its capacity as Data Processor, Teta Studio ensures the technical fulfillment of these rights in line with the Clinic's request. The specific mechanisms offered within the Platform are as follows:

a) Right to Deletion: Account deletion (as of October 4, 2026): When a deletion request is confirmed, access to the account is cut off immediately (sessions are terminated, sign-in is not possible); personal data is deleted or anonymized (name, email, phone, image and client identity/contact information and health fields — blood type, allergies, chronic conditions, medications — are cleared); payment and earnings records requiring legal retention are not deleted; they are kept with the link to the person severed and with restricted access. There is no period for undoing the request; permanent deletion of the authentication record and files is completed in the existing thirty-day background process.

Deletion of a client record and health fields (as of October 4, 2026): When a client record without an account is deleted by the business, the record is immediately removed from the active list; at the end of 30 days, the client's health fields (blood type, allergies, chronic conditions, medications) are also deleted/cleared together with the identity and contact information. The retention rules for health history forms, measurements and session notes are not affected by this provision.

Group messages and community records (as of October 18, 2026): A member can delete their own group message at any time; the text of a deleted message is removed from the record. When an account is permanently deleted, the group membership, bound device records and the specialist's profile cards are deleted; challenge participation is linked to the client record and is subject to the same rule as the client record; the text of messages previously sent to a group, however, remains in the group with the sender information removed. A user who wishes to remove their messages can therefore delete them one by one before deleting their account. The text of a message hidden by the team is kept separately for team review. The retention periods for group messages and for this copy are in Section 4, No. 12 of veri-saklama-imha-politikasi.md; the copy is kept for at most 1 year. Group, challenge, badge and loyalty records are not currently included in the "Download My Data" export; requests for information about these records can be made to the Clinic or to hello@corenta.app.

When the user makes an account deletion request from within the app (the delete_my_account function), the system applies a two-stage deletion architecture. The summary below is an honest and technically verified explanation of the method applied according to the data category (permanent deletion or anonymization); for full details and the table, see veri-saklama-imha-politikasi.md (in particular Sections 4–6).

• Stage 1 — time of the request: Access to the account is cut off immediately (there is no undo period); the profile is deactivated, identity and health fields are cleared, pending appointments are canceled, assignments are removed and consents given are withdrawn.
• Stage 2 — permanent processing after 30 days: 30 days after this first stage, an operation takes place that is triggered irreversibly only by a privileged (service-role) background task (cron) and applied by two different methods depending on the data category; this operation cannot be triggered manually/administratively or brought forward/postponed:
• The user's authentication record (auth.users) and records that carry no independent business/evidentiary value (e.g. notifications, notifications) are permanently deleted (DELETE/cascade).
• Health data (health history forms, session notes, measurement records) and clinical/financial records (payments, attendance) ARE NOT SUBJECTED TO DELETE — THEY ARE KEPT IN RESTRICTED FORM WITH THE LINK TO THE PERSON SEVERED: the link to the person (such as client_id/specialist_id) is severed at the database level (ON DELETE SET NULL); some free-text fields (health history answers, measurement/payment notes, refund reason, receipt reference) are cleared or replaced with a marker. The free text of session notes is not changed; since information sufficient to re-identify the person may remain in this text and in information such as date/measurement series, these records are not considered anonymous. The records are kept with restricted access for the duration of the Clinic's record-keeping obligation and are disposed of at the end of that period; the append-only principle for session notes is preserved in this way.
• Consent records (consent_logs) are likewise not subjected to DELETE; the link to the person is severed and the IP address is cleared, but for the purpose of proving that consent was given/withdrawn (with type, version and time information), they are kept for a further 5 years as an evidentiary record with the link to the person severed (KVKK Art. 5/2-e — establishment and protection of a right; the burden of proving explicit consent lies with the data controller).
• File attachments: The user's avatar/profile photo, health history attachment and payment receipt images (the avatars, anamnesis-attachments, user-data-exports, payment-receipts buckets in Storage) are automatically (best-effort) deleted from Storage as part of the permanent deletion step — if deletion in one bucket fails, this is logged but does not prevent the cleanup of the other buckets or the processing of the account. Honest limit: The only file category outside the scope of this automatic process is the identity/diploma verification documents uploaded in the specialist/solo registration process (the specialist-verification-docs bucket) — technically these documents are linked not to the user but to the verification process of the tenant (the Clinic) and are currently not included in the scope of automatic deletion; their disposal will be handled separately in the process of the Clinic closing its account/subscription at tenant level, and until this is completed, exceptional requests are assessed manually via hello@corenta.app.
• None of the above operations can be triggered or stopped manually through normal product interfaces (including by administrative staff) — this is a deliberate security design to prevent premature/delayed deletion by mistake or through misuse.
• For this reason, this Notice makes no absolute undertaking that "when the account is deleted, all data is physically destroyed without exception": while the authentication record and records without independent business value are permanently deleted, health/clinical/financial records and consent records continue to be kept, as required by the Clinic's record-keeping obligation (under KVKK Art. 7/2, retention provisions in other laws are reserved), with the link to the person severed and access restricted (for the periods explained above); these records are not anonymous; for technical residues in backups, see also veri-saklama-imha-politikasi.md Section 6.3.
• Application channels: An account deletion request can be made, as the most reliable method that directly produces a result, through the self-service "delete my account" function within the app; in this case the function is triggered directly by the user and the two-stage process explained above runs automatically (this is not an application/request addressed to Teta Studio, but an automatic system function initiated by the user themself). If the user cannot use the in-app function for any reason, they may alternatively send their request to the Clinic or to hello@corenta.app; in this case the request is evaluated and processed within a reasonable time and, to the extent deemed necessary, the same deletion process is started. This exception is an exception to the general application rule explained in B.9 below ("the Clinic should be applied to first") and arises solely from the fact that the in-app self-service function can be triggered directly by the user.

b) Request for Information / Data Portability: The Platform offers a function (export_user_data) through which the user can export their own data. In line with the multi-tenant structure, this function contains only the data within the relevant user's own tenant scope. The data is provided within a reasonable time in a structured and machine-readable format (JSON). When the file can be prepared, the data is also prepared as a ZIP and provided through a personal (signed) link valid for 7 days; if the ZIP cannot be prepared, only the JSON output is provided.

c) Right to Correction: Updating user information is technically possible from the Clinic admin panel. There is no separate automated, independent "correction request" workflow within the Platform; correction requests may be sent, within the framework of the general rights under KVKK Art. 11, to the Clinic or to Teta Studio via hello@corenta.app.

d) Withdrawal of Consent: The acknowledgment that the privacy notice has been read is not a consent; it does not create a permission to be withdrawn. The user can withdraw health data consent and clinic campaign notification consent at any time through the mobile app. Withdrawal of health data consent does not affect appointment and account use; after withdrawal, no new health data is recorded, and previous records are kept according to the rules in B.8/a.

e) Other Art. 11 Rights: The rights to learn whether data is processed, to learn whether processing is in line with its purpose, to know the third parties to whom it is transferred, to request correction of incomplete/incorrect processing, and to claim compensation for damage due to unlawful processing are exercised primarily against the Clinic; they have the same content as the framework listed in A.8.

B.9. Method of Application

Clinic clients and clinic staff should direct their requests under KVKK primarily to their own Clinic; the Clinic, in its capacity as Data Controller, is obliged to respond to these requests in accordance with the procedure in KVKK Art. 13 and within thirty (30) days at the latest. Exception: In-app self-service mechanisms such as account deletion (see B.8/a) can be used by the user directly and without the need for separate intermediation by the Clinic; for other KVKK Art. 11 requests, the rule is to apply to the Clinic first.

For requests of a technical nature that are intended to be sent directly to Teta Studio (e.g. account deletion or the data export function not working) or for questions about the activities that Teta Studio itself carries out in its capacity as data processor, contact can be made via hello@corenta.app. Teta Studio may forward to the Clinic, under the DPA, applications that reach it and that require the knowledge/instructions of the relevant Clinic.

B.10. Obligations of the Clinic

Every Clinic using Corenta accepts that it has the capacity of Data Controller under KVKK Art. 3/ı and that the following obligations belong exclusively to it:

• Preparing/providing the KVKK Privacy Notice for its own Clients and Users (the ready-made, common privacy notice screen and the optional consent screens in the Corenta mobile app are offered as a technical tool for this purpose, but ensuring that the content suits the Clinic's own activity is the Clinic's responsibility; if the Clinic deems it necessary, it may separately carry out its own additional information process as per B.1),
• Determining the legal ground to be relied on for processing health data (optional explicit consent under Art. 6/3-a or Art. 6/3-e); where explicit consent is required, obtaining it properly and not making it a condition of the service,
• Notifying clients of its own identity information (trade name, address, KVKK application contact) (the common in-app text currently does not contain this information automatically),
• For data controllers whose main activity is the processing of health data, the VERBİS exemption threshold is 10 employees per year and a balance sheet of TRY 10 million (Board 2025/1572); assessing its own VERBİS obligation,
• Responding to data subject applications within the periods provided for in KVKK Art. 13,
• Ensuring data security with respect to its own staff and subcontractors,
• Complying with the obligations provided for in the Data Processing Agreement/Terms of Service between it and Corenta.

Teta Studio does not assume liability arising from the Clinic's failure to fulfill the above obligations.

PART C — CORENTA ACCOUNT AND PLATFORM NOTICE (Teta Studio is the data controller)

This part explains the processing that Teta Studio carries out in its own name and for its own purposes. In these activities, Teta Studio is the data controller under KVKK Art. 3/1-ı. This text is shown when a clinic owner/employee account is opened and when a client uses the Discover/review feature for the first time. The cross-studio features below (league, invitation, Founding Studio, Corenta Lab, Discover v2) appear in this part because they bring more than one clinic together and their purpose is determined by Teta Studio. Information processed in a studio's name is not personal data in the case of businesses that are legal entities; it is explained here because, for studios operating as sole proprietorships and one-person studios, it can be associated with a person.

C.1. Data Controller

Mertcan Demir — sole proprietorship under the trade name "Teta Studio" (identity and contact information: A.1). Applications: hello@corenta.app.

C.2. Processing, Purposes and Legal Grounds

Discover and review invitation: If the clinic turns on the Discover feature, the review invitation is sent on the basis of completed appointment information. Through the Data Processing Agreement, the clinic instructs that this information be transferred to Teta Studio only for the purpose of sending the invitation and publishing the verified review; no invitation is sent at a clinic where Discover is turned off. A published review may publicly show that you have received services from a health/exercise business; please take this into account before publishing.

Pseudonymous measurement: Measurement is carried out with a clinic pseudonymous identifier; this identifier is pseudonymous in nature and in a one-person business it can be associated with a person. It does not include IP addresses, health data or source/advertising tracking. The feature is currently turned off; this text will be updated before it is turned on.

Visibility in community and growth features: The information shown to other users in the league, the Founding Studios list, Corenta Lab and Discover is only what is written in the table above. No client health data is processed in these features (details: B.3-A). No cash rewards or price discounts are given for studio invitations, Founding Studio or Lab; rewards are in-app entitlements such as a 7-day Boost, trial time and credits.

C.3. Recipients and Cross-Border Transfer

Supabase (hosting; Germany/Frankfurt), Vercel (web panel), Google (Google Workspace email, Firebase Cloud Messaging, Google Play) and Apple (APNs, App Store). Transfer to these providers is a cross-border transfer; its basis and current status are explained in the "Cross-border transfer" paragraph in B.5 (for these flows, for which Corenta is the data controller, the Module 2 — controller to processor — standard contract will be used; as of the date of this text, it has not yet been signed).

C.4. Commercial Electronic Messages

Teta Studio sends promotional and campaign emails only if you have given consent separately through an unchecked box. Teta Studio does not send promotional emails without registering with the Message Management System (İYS); after registration, consents are uploaded to İYS within 3 business days. Every promotional message contains the sender's identity, contact information and a free opt-out link. Trial period, team invitation and support emails are service messages; they contain no promotional elements.

C.5. Retention, Rights and Applications

Retention periods are in veri-saklama-imha-politikasi.md. Of the records added on October 18, 2026, repeat-trial digests and league, invitation, Founding Studio and Lab records are kept until the relevant studio account is permanently deleted; device records are kept until the user account is permanently deleted. A separate maximum period has not yet been defined for these records and will be added to the retention policy. You can exercise your rights under KVKK Art. 11 (A.8) by applying to hello@corenta.app; applications are answered free of charge within 30 days at the latest.

COMMON PROVISIONS (Applicable to Both Parts)

G.1. Automated Decision-Making and Profiling

Corenta does not carry out profiling for advertising or marketing purposes. However, as of October 18, 2026, the following rules run automatically and may produce a limited adverse result for the person or studio concerned:

The repeat-trial flag is not an automated decision: a match does not block the trial; it only goes to the platform administrator for review. Under KVKK Art. 11/1-g, your right to object to the occurrence of a result to your detriment through the analysis of the data exclusively by automated systems is reserved.

G.2. Updating the Privacy Notice

This Privacy Notice may be updated in line with legislative changes, decisions of the Personal Data Protection Board, the functional development of the Platform or changes in sub-processors/service providers. The current version will always be accessible at corenta.app/legal/kvkk-aydinlatma-metni and through the in-app document screen. In the SaaS product context (Part B), when the version of the privacy notice changes, the user is asked at the next sign-in to indicate that they have read the new text; this is not a consent but proof of information (see B.2).

G.3. Applicable Legislation and Jurisdiction

This Privacy Notice has been prepared within the framework of Personal Data Protection Law No. 6698 and the related secondary legislation (Regulation on the Deletion, Destruction or Anonymization of Personal Data; Regulation on the Data Controllers' Registry; Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform; Communiqué on the Procedures and Principles of Application to the Data Controller). The law of the Republic of Türkiye applies to the interpretation and application of this text; in disputes, the Personal Data Protection Board and the competent Turkish courts/enforcement offices have jurisdiction.

G.4. Contact

For any questions, requests and applications regarding the processing of personal data:

• Email: hello@corenta.app
• Support: support@corenta.app
• Service area: Corenta is offered globally through the App Store and Google Play, in the countries where those stores operate. This text is the privacy notice under Law No. 6698; for people in the EU/EEA, the GDPR Statement also applies, and the mandatory data protection rules of your country remain unaffected.
• Corporate Website: corenta.app

Effective date / Last updated: October 19, 2026 Version: 2.3 · October 19, 2026. The change log is at the beginning of the document.