Corenta Privacy Policy

This translation is provided for information only; the Turkish text is legally binding.

Version: 3.4 Effective / last updated: October 20, 2026 Publisher: Mertcan Demir — sole proprietorship operating under the trade name "Teta Studio" ("Teta Studio", "we") Language: Turkish

Change log

• 3.4 — October 20, 2026: The error log row in §3 now describes what the app actually records: mobile slowness timings, the screen and action trail attached to an error (health screens excluded), connection type and IP addresses in server logs. No new processing activity was added.
• 3.3 — October 19, 2026: Global scope incorporated: Corenta is offered in more than one country through the app stores (§2); a GDPR section for users in the EU/EEA (§5) and country-specific mandatory rights (§8) were added. Roles and processing activities are unchanged.
• 3.2 — October 19, 2026: Publication version; effective date October 19, 2026. The empty MERSİS and KEP lines were removed from the identity section.
• 3.1 — October 18, 2026: The features added on October 18, 2026 were incorporated: clinic groups, stickers and credits, challenges, badges and loyalty card, studio league, the specialist's portable profile card, studio invitation, Founding Studio, Corenta Lab, Discover v2 (video, trial class, sponsored placement), the repeat-trial flag, device binding, partial store refunds. A new §5-A (community features and health data) was added. §6 was turned into a list of cookies and SDKs. Rules on groups and challenges for minors were added to §10. The privacy commitment sentence was tied to the text. Features that are switched off were not written into this text.
• 3.0 — October 11, 2026: The text was rewritten from scratch based on the October 11, 2026 compliance review (findings F05, F06, F07, F09, F11, F12, F17, F22, F23). Wording in the nature of internal audit notes, such as "UNKNOWN", "must be verified" and "this text makes no representation", was removed and replaced with facts verified against the code. The two roles of Teta Studio (data processor for clinic data, data controller for its own activities) were separated. The identity information was corrected to a sole proprietorship (the wording "legal entity/company" was removed). Cross-border transfer was written in line with the post-2024 version of Article 9 of Law No. 6698 on the Protection of Personal Data (KVKK). The export link, deletion of file attachments, email delivery and security measures were aligned with a single wording across the other legal texts. The wording "anonymous measurement" was corrected to "pseudonymous measurement". The statement "Corenta does not send marketing emails" was replaced with the rule on promotional messages, which are subject to separate consent and registration in İYS (the Turkish Message Management System).
• 2.2 — October 10, 2026: Expo (Expo Push Notification Service) was removed from the sub-processor records.
• 2.1 — October 4, 2026: The trade name wording was updated.
• 2.0 — October 4, 2026: The working text of October 2, 2026 was fixed as a version.
• 1.0 — July 7, 2026: previous published version.

1. Who we are and our two roles

Corenta provides web and mobile software that clinical Pilates, physiotherapy, reformer, wellness/massage and yoga businesses use to manage their appointment, package, client, health history, session and earnings processes. Corenta is operated by Mertcan Demir as a sole proprietorship under the trade name "Teta Studio". A sole proprietorship has no separate legal personality.

At Corenta, personal data is processed in two different roles:

Information about clinic data is provided through the clinic's own privacy notice; the client privacy notice in the app is shown on the clinic's behalf for this purpose. Details of the activities for which Teta Studio is the data controller are set out in Part C — Corenta Account and Platform Notice of the KVKK Privacy Notice.

2. Identity and contact

• Data controller (for Teta Studio's own activities): Mertcan Demir — sole proprietorship under the trade name "Teta Studio"
• Tax ID no.: 2771408706
• Address: Kavaklıdere Mahallesi, Esad Caddesi No:12/1, Çankaya/Ankara 06680
• General contact and KVKK applications: hello@corenta.app
• Support: support@corenta.app
• Service area: Corenta is offered globally through the App Store and Google Play, in the countries where those stores operate. This policy applies to users in every country; the mandatory data protection rules of your country remain unaffected.

If you are a client and your request concerns records kept by your clinic, submit your application to your clinic first (see §8).

3. Data we collect

Corenta does not process card numbers or security codes (CVV). Subscription payments are collected through the Apple App Store and Google Play.

4. Purposes of use and legal grounds

A privacy notice is not a consent. The app shows the privacy notice in a separate step and records the "I have read and understood" acknowledgment. Health data consent and consent to promotional messages are separate and optional. If you do not give health data consent, you can continue to use your account and basic appointment functions; only the health features will be unavailable.

5. Parties we share with and cross-border transfer

Your data is not sold and is not shared for advertising; it is encrypted with TLS in transit and is processed only by the infrastructure providers below that provide the service (details: Sub-processors List). Data at rest (database and file storage) is stored encrypted in the infrastructure of the hosting provider (Supabase). Information shown to other users in groups, the league, Lab and Discover is not a sale or a sharing for advertising; it appears as part of the feature that you or your studio uses, within the limits written in §5-A.

Data may be transferred to authorized public institutions and organizations only in the cases provided for by law and limited to the request.

Messages and group messages are processed by Supabase's real-time delivery service (Realtime), and studio videos in Supabase file storage; no new provider has been added for these. No advertising network or advertising SDK is used for sponsored placement (Boost); sponsored studios are shown in Corenta's own list with a "Sponsored" label, and no user data is transferred to advertisers.

Cross-border transfer: All of the providers above process data outside Türkiye. Hosting in Germany is also a cross-border transfer within the meaning of Law No. 6698. Because these transfers are regular and continuous, they are not based on explicit consent; they will be based on one of the processing conditions in Articles 5 and 6 of the Law and, under Art. 9/4-c, on the standard contracts announced by the Personal Data Protection Board (Kurul). As of the date of this text, the standard contracts have not yet been signed with the providers and have not been notified to the Board. Each contract will be notified to the Board within 5 business days of its signature date, and this section will be updated with the list of providers and dates. There is no adequacy decision announced by the Board for these countries (last checked: October 11, 2026).

Users in the EU/EEA (GDPR): Because Corenta is also offered through the App Store and Google Play to people in the European Union and the European Economic Area, the GDPR (EU 2016/679) applies to processing relating to those people under Art. 3(2)(a). The roles do not change: Teta Studio is a processor for clinic data and a controller for its own activities. The legal bases are performance of a contract (Art. 6(1)(b)), legitimate interests (Art. 6(1)(f)), legal obligation (Art. 6(1)(c)) and separate consent (Art. 6(1)(a)); health data relies on Art. 9(2)(a) or Art. 9(2)(h). The database and files are hosted in the EU (Frankfurt). Transfers to providers outside the EU/EEA (Vercel, Google, Apple) rely on transfer mechanisms under Arts. 45–46 GDPR, such as the providers' EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework. Details and rights: GDPR Statement.

5-A. Community and growth features — health data and visibility

Health data is special category personal data. The following features do not show or share health records (health history, session notes, measurements):

• Clinic groups: Only the group's approved members and the clinic's team see the messages. Your name appears in the form "Ayşe K."; your phone and email are not shown. You give explicit consent to join and can leave whenever you wish. Messages are free text: you are asked not to share your health information (pain, diagnosis, medication, treatment) in the group; health information that is shared can be reported and hidden by the team. The team can hide or delete a message that breaks the rules, and mute a member or remove them from the group; a message reported by three different members is hidden automatically. There is no one-to-one messaging between clients.
• In-studio challenge: Participation is optional. The table shows only your first name, the initial of your surname and the number of sessions you attended; pain, measurements or weight are not used.
• Studio league: Studios appear only under a nickname or code; the studio's real name, city and size, and client and specialist names are not shown. Points are calculated only from weekly task XP.
• The specialist's profile card: It carries only the total number of sessions, the rating verified with at least 5 reviews, and badges; it does not contain client information or health data. Only the specialist sees and shares the card.
• Client badges and loyalty card: Badges are not public. The content of health records is not read when badges are calculated; some badges only look at whether a record exists or how many there are (e.g. that the health history form has been submitted).
• Discover v2: Studio videos are shown publicly after review by Corenta; obtaining the permission of the people who appear in a video is the studio's responsibility. Sponsored placement is always shown with a "Sponsored" label and separately from the organic ranking; studios in the physiotherapy category are not shown as sponsored. If you are registered with a studio, Discover does not show you competing studios. Searches are made by the province/district or map area you choose; your device location is not collected.
• Corenta Lab and Founding Studios: Lab proposals and comments are visible to the other participating studios; the studio name is shown only if you choose. A studio's name appears on the Founding Studios list only if the studio permits it.

When you delete your account, your group membership is deleted; the text of group messages you sent earlier remains in the group with the sender information removed. You can delete your own messages at any time.

6. Cookies, SDKs and similar technologies

• Web admin panel: Essential session cookies are used to keep you signed in. You cannot sign in without these cookies.
• Promotional website (corenta.app): The website's code in this repository keeps your language and appearance preference only in your browser's local storage (localStorage).
• Mobile app: Session tokens are kept in the device's secure key store (secure storage based on iOS Keychain / Android Keystore).
• No third-party analytics, advertising or tracking cookies or scripts are used. If this changes, this text will be updated before any cookie is used, and any required consent will be requested separately.

SDKs and system services in the mobile app (as of October 18, 2026, apps/mobile/package.json):

The mobile app has no advertising, advertising identifier (IDFA/AAID), analytics or tracking SDK; iOS tracking permission is not requested. Connection code for Sentry (EU region) error monitoring is in place but switched off: because no connection address is configured, no data is sent. Before it is switched on, this text and the Sub-processors List will be updated.

7. Retention periods and account deletion

Main retention rules (full table: Data Retention and Disposal Policy):

Account deletion: You can delete your account from within the app. Web deletion request page: corenta.app/account-deletion. When deletion is confirmed, access to your account is cut off immediately. Your name, email, phone, profile image, client identity/contact information and health fields (blood type, allergies, chronic conditions, medications) are cleared. Your authentication record and your files (profile image, health history attachments, export files and payment receipts) are permanently deleted in a thirty-day background process. Specialist verification documents are not within the scope of this automatic deletion; you can submit a request for these documents via hello@corenta.app.

Records that the clinic is obliged to keep (session notes, health history forms, measurements, payment and earnings records) are retained with the link to the person severed at deletion. The free text of session notes is not changed at deletion; for this reason these records are not considered anonymous in every case. These records are kept with restricted access for the duration of the clinic's obligation and are disposed of at the end of that period. Technical residues in backups are deleted at the end of the backup cycle.

8. Your rights and applications

Under Article 11 of Law No. 6698, you have the right to learn whether your personal data is processed, to request information, to learn the purpose of processing, to know the third parties to whom it is transferred, to request correction and deletion, to request that these actions be notified to third parties, to object to a result produced by automated analysis, and to claim compensation for damage.

• Clinic records (appointments, health history, session notes, etc.): Submit your application to your clinic. Such requests that reach Corenta are forwarded to the clinic.
• Records for which Corenta is the data controller: Write to hello@corenta.app.
• Applications are answered free of charge within 30 days at the latest.
• If the law of the country where you are located grants you additional rights (e.g. in the EU/EEA, the rights of access, rectification, erasure, restriction, portability and objection under Arts. 15–22 GDPR), you can also exercise them through the same addresses. Your right to lodge a complaint with the data protection authority in your country remains unaffected.
• The "Download My Data" screen in the app provides your data as JSON and, when the file can be prepared, also as a ZIP through a personal link valid for 7 days. The "Delete My Account" screen lets you exercise the right to deletion directly.

9. Security

Measures verified in code and configuration:

• Each clinic's data is separated by row-level security (RLS) policies; the default rule is to deny access.
• Health data can be seen by the client themself, their assigned specialist and the clinic's authorized admin. Session notes that a specialist has shared with the team can also be seen by the clinic's other specialists. Staff access is possible while the relevant health module is turned on.
• Submitted session notes cannot be changed or deleted.
• Support mode lasts at most 30 minutes and is read-only by default; access to health data requires separate approval; health data cannot be written. Support staff do not see the client's email and phone.
• Data is encrypted in transit with TLS.
• Screenshots and screen recording are blocked on mobile screens that show health data.
• Platform admin accounts require two-factor authentication (MFA).

No absolute security guarantee can be given for any system. In the event of a data breach, Teta Studio notifies the clinic without delay and within 24 hours at the latest for the clinic data for which it is the data processor; for the data for which it is itself the data controller, it notifies the Board within 72 hours.

10. Children

A Corenta account is for persons aged 18 or over. The registration of minor clients and the information/consent process are the clinic's responsibility and must be carried out through a parent or guardian. The app does not yet have a separate parent flow for minor clients.

Additional rule for community features (October 18, 2026): clients whose date of birth is recorded and who are under 18 cannot join challenges or community groups; they can only be added to class groups to which the clinic's team invites them. If no date of birth is recorded, an "I am over 18" declaration is requested to join a challenge; in groups, a client with no recorded date of birth is treated as an adult.

11. Withdrawal of consents and promotional messages

• Health data consent: You can withdraw it at any time from Profile → KVKK/Data; after withdrawal, no new health data is recorded.
• Clinic campaign notifications: You can turn them off from Profile → Notification Settings. Transactional notifications such as appointment confirmation, cancellation and session reminders do not depend on this consent.
• Promotional emails: Corenta sends promotional emails only if you have given separate consent and your consent has been recorded in the Message Management System (İleti Yönetim Sistemi, İYS). You can opt out free of charge through the opt-out link in every promotional message or via hello@corenta.app. Trial period, team invitation and support emails are service messages.
• Operating system permissions (notifications, photos; Face ID/fingerprint if the app lock is on): can be turned off in the device settings. The app does not request camera, microphone, location, contacts or calendar permission.

Pseudonymous product measurement: To improve the product, aggregate usage events may be measured only on the server side, with a clinic pseudonymous identifier. This measurement does not include IP addresses, health data or source/advertising tracking. The clinic pseudonymous identifier is pseudonymous in nature; in a one-person business it can be associated with a person. This feature is currently turned off; this text will be updated before it is turned on.

12. Changes

Each time this policy changes, it is published with a version number, date and change log. For significant changes, a notification is given within the app.

Version 3.4 · October 20, 2026