CORENTA — TERMS OF USE AND SERVICE AGREEMENT

This translation is provided for information only; the Turkish text is legally binding.

Effective / last updated: October 19, 2026 Document Version: 1.9 Publisher: Mertcan Demir — sole proprietorship under the trade name "Teta Studio"

Change log

• 1.9 — October 19, 2026: Global scope incorporated: C.6-A service area (more than one country through the app stores), B.4.1–B.4.2 country prices and taxes, B.4.3 price increases applying only to new subscriptions, B.7.2 and C.10.4 reservation of the mandatory rights of the consumer's country.
• 1.8 — October 19, 2026: Publication version; effective date October 19, 2026. Since the Privacy Policy and the KVKK Privacy Notice have been published, A.4.7, C.1, C.2 and C.11 were cleared of pre-publication wording; the empty MERSİS and KEP information was removed from definition 1.2; B.4.1, 1.7 and Annex-1 were aligned with the current plans (Solo plan added, Clinic+ ₺3.490 per month, annual payment equal to 10 monthly fees); B.5.4 covers the annual cycle.
• 1.7 — October 18, 2026: A new Article B.20 (in-app credits, stickers, studio invitation, Founding Studio, Corenta Lab, league and challenges, clinic groups and moderation, Discover videos, trial class and sponsored content, repeat trials, device limit) was added for the features added on October 18, 2026. The following rules were incorporated: prices include VAT (B.4.2); cancellation of a subscription takes effect immediately and no fee is refunded (B.7.1, B.17.1); a feature offered free of charge remains free (B.4.6). Boost and partial store refunds (B.5.8) were added. B.2.9 mobile permissions were corrected according to the code.
• 1.6 — October 11, 2026: Based on the October 11, 2026 compliance review (F01, F02, F07, F08, F09, F11, F13, F14, F16, F19): the statement that the privacy notice was "read/accepted" was removed from the acceptance sentence in §0 (a privacy notice is not a contractual term and is not subject to consent); the definition in 1.2 was corrected to a sole proprietorship; the consumer criterion in B.7.3 was corrected to "commercial or professional purpose"; the cross-border transfer provisions in B.8.2(d), B.8.4, B.10.1, B.10.5 and B.14.1 were rewritten in line with the post-2024 version of Article 9 of Law No. 6698 on the Protection of Personal Data (KVKK) (the standard contracts have not yet been signed); the breach notification to the clinic in B.9(e) became 24 hours at the latest; the contradictions in B.12.2/B.12.3/B.12.4 were resolved (file attachments are deleted automatically; exports are provided through a link valid for 7 days); the VERBİS (Data Controllers' Registry Information System) wording in B.12.7 was updated; the promotional email rule in B.16.4 and the pseudonymous measurement wording in B.16.5 were corrected; the reference to KVKK Art. 28 was corrected to Art. 7/2.
• 1.5 — October 10, 2026: Expo (Expo Push Notification Service) was removed from the sub-processor/processor records; push notifications are delivered only through Apple (APNs) and Google (FCM); Expo/EAS is only an app build tool and does not process end-user data.
• 1.4 — October 10, 2026: The wording on the choice of Google Analytics was removed; it was clarified that no third-party analytics is used, and the push processors were clarified.
• 1.3 — October 4, 2026: The current text was fixed as the approved version. Only the following were incorporated in this version: publisher (Teta Studio); market (Türkiye); account deletion (access is cut off immediately, personal data is deleted/anonymized, payment records requiring legal retention are kept without identity); deletion of client health fields at the end of 30 days; 7-day period for orphaned receipts; client contact details remaining hidden in support mode; service emails (no marketing email; Google Workspace); support address (support@corenta.app); permission to write health fields; anonymous server-side measurement; push processors.
• 1.2 — July 7, 2026: previous version.

0. ABOUT THIS DOCUMENT — PLEASE READ THIS FIRST

These Terms of Use and Service Agreement (the "Agreement") govern the relationship between Teta Studio ("Teta Studio", the "Company", "Corenta", "we") on the one hand and, on the other hand, the natural or legal person ("User", "you") who visits, registers for, subscribes to or in any way uses the Corenta product (the corenta.app marketing website, the app.corenta.app web admin panel and the related mobile application, together the "Service" or the "Platform").

This document is a single and comprehensive agreement; however, it addresses two different groups of readers, and the relevant parts are divided accordingly:

• PART A — General terms of use applicable to Visitors who visit the corenta.app website, fill in the early access/demo form or make contact only to obtain information.
• PART B — The main SaaS Service Agreement, containing the provisions on the description of the service, fees, the KVKK (Turkish Personal Data Protection Law No. 6698) role allocation, security and liability, applicable to clinical Pilates, physiotherapy, reformer, wellness/massage and yoga centers that use Corenta as subscribers for commercial purposes, to provide services to their own clients, and to users authorized to work at these centers (the "Customer", "Clinic" or "Tenant").
• PART C — Common provisions applicable to both groups, such as intellectual property, confidentiality, force majeure and governing law.

If you only visit the Site or fill in the early access form, Part A and Part C bind you. If you have subscribed to Corenta as a Clinic (or are an authorized user on behalf of a Clinic), Part A, Part B and Part C bind you in their entirety.

By registering for the Service, creating an account, purchasing a subscription, checking the acceptance box or continuing to use the Service in any way, you accept the provisions of this Agreement. Information on the processing of your personal data is provided in the Privacy Policy and the KVKK Privacy Notice; these texts are not contractual terms and are not subject to your consent. If you do not accept any provision of this Agreement, you should not use the Service.

If the Service is used on behalf of a business (clinic, studio, center), the natural person accepting the Agreement represents and warrants that they are authorized to bind that business to this Agreement.

1. DEFINITIONS

1.1. "Corenta" / "Platform" / "Service": Means the multi-tenant, mobile-first, cloud-based software service (SaaS) developed and operated by Teta Studio and offered through app.corenta.app (and also through mobile clients distributed via the relevant mobile app stores), covering appointments, packages/entitlements, health history, client tracking and related management functions. Depending on the context, it also covers the corenta.app marketing website (the "Site").

1.2. "Teta Studio" / "We": Means Mertcan Demir, who operates the Corenta product and carries on business as a sole proprietorship under the trade name "Teta Studio" (Tax ID 2771408706; address: Kavaklıdere Mahallesi, Esad Caddesi No:12/1, Çankaya/Ankara 06680). A sole proprietorship has no separate legal personality. The term "Company" used in this Agreement has the same meaning.

1.3. "Visitor": Means a natural/legal person who visits the Site, fills in the early access/demo form or makes contact through the Site and who is not yet a Clinic Subscriber (see Part A).

1.4. "Clinic" / "Customer" / "Tenant" / "Business Customer": Means a clinical Pilates, physiotherapy, reformer, wellness or yoga center that registers with Corenta as a commercial subscriber and uses the Platform for its own employees (specialist/instructor/reception staff) and clients. Each Clinic is represented within the Platform as an isolated "tenant".

1.5. "User": Means every natural person who accesses the Platform; depending on the context, it may mean (a) a Visitor, (b) an authorized representative managing the Platform on behalf of the Clinic (the "Clinic Admin"), (c) a specialist/instructor/staff member working within the Clinic (a "Specialist User") or (d) the end client to whom the Clinic provides services (a "Client").

1.6. "Client": Means a natural person who is the Clinic's own customer and who books an appointment, purchases a package, fills in a health history form or receives a session service. The Client is not a party to this Agreement; the relationship between the Client and the Clinic is governed by the Clinic's own customer agreement/terms of service.

1.7. "Subscription" / "Plan": Means the right of access to the Platform in return for a periodic fee, according to the plan chosen by the Clinic (Solo, Starter, Pro, Clinic+ or Enterprise).

1.8. "Client Data" / "Customer Data": Means all data entered into the Platform by the Clinic; client records, appointment information, package/entitlement data, health history forms, session notes, measurements and related business data.

1.9. "Health Data" / "Special Category Personal Data": Means all data relating to health status that is regarded as special category personal data under KVKK Art. 6, including Clients' health history forms (anamnesis_forms), session notes (session_notes) and measurement records (measurements).

1.10. "Data Controller" and "Data Processor": Are used in the meaning defined in Article 3 of Personal Data Protection Law No. 6698 ("KVKK"). The allocation of roles is set out in detail in Articles B.8/9.

1.11. "Sub-processor": Means the third-party service providers that Corenta authorizes to process personal data so that it can provide the Service (see Article B.10).

1.12. "Intellectual Property Rights": Means copyrights, patents, trademarks, trade secrets, design rights and all other intellectual and industrial property rights.

PART A — TERMS FOR SITE VISITORS AND EARLY ACCESS APPLICANTS

A.1 Parties and Scope

This Part A governs the relationship between Teta Studio and the natural/legal persons ("Visitor", "you") who visit the corenta.app website (the "Site"), fill in the early access form on the Site, request a demo or contact Corenta through the Site. The Site is hosted as a separate Framer-based project; the Service itself (app.corenta.app and the mobile application) falls within the scope of Part B.

By using the Site, filling in the early access form or contacting us through the Site, you accept this Part A and Part C.

A.2 Nature and Use of Site Content

A.2.1. The information on the Site is intended to promote the Corenta product and to provide general information about the early access application process and the product plan. The product features, screenshots, package scopes, pricing and roadmap information on the Site belong to a product under development and may be changed without prior notice.

A.2.2. All text, images, logos, trademarks, interface designs and software elements on the Site belong to Teta Studio or its licensors and are protected under the relevant intellectual property legislation. The User may view the Site content only for personal/internal information purposes; reproducing, distributing, modifying, communicating to the public or using the content for commercial purposes without Teta Studio's prior written permission is prohibited.

A.2.3. The Site may be updated, changed, or temporarily or permanently taken down by Teta Studio at any time without notice. Teta Studio does not guarantee that the Site will operate uninterrupted or error-free.

A.3 Legal Nature of the Early Access Application

A.3.1. Filling in the early access form does not mean that we grant you a definite right of access to the Corenta product, that a service agreement has been concluded or that access to the product will be provided on a particular date.

A.3.2. Applications are evaluated according to the product development schedule, technical capacity, fit with the target customer profile and other criteria at Corenta's own discretion. Corenta reserves the right to reject any application without giving reasons or to stop/change the early access program at any time.

A.3.3. If you are accepted for early access and actually start using the Corenta product, the provisions of Part B also become applicable to you (or to the Clinic you represent).

A.3.4. Prices, package scopes, feature lists or comparison tables that may be seen on the Site are for information purposes and may change. The current and binding pricing consists only of the plan terms shared with you/accepted by you under Part B when you subscribe to Corenta as a Clinic.

A.4 Data Collected and Purposes of Processing

A.4.1. Through the early access/contact form on the Site, the following may be collected: full name, email address, phone number (optional), business name, city, business type, number of specialists/instructors, the message sent and information on operational problems, as well as IP address, device and browser information.

A.4.2. This data is processed for the purposes of (a) evaluating the early access application, (b) contacting the visitor about the product/demo process, (c) assessing fit with the target customer profile, (d) product development and market research, (e) improving Site security, performance and user experience and (f) fulfilling legal obligations.

A.4.3. Role. In this context, Corenta/Teta Studio itself acts as the Data Controller with respect to the personal data processed; it determines the purposes and means of processing itself (to be read together with Article B.8.1).

A.4.4. Legal Ground. The processing of the data listed in A.4.1 above is carried out, with respect to evaluating the application and contacting you, on the legal grounds of "being directly related to the establishment or performance of a contract" under KVKK Art. 5/2(c) and/or "the legitimate interest of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject" under KVKK Art. 5/2(f), and, with respect to marketing communications, on your explicit consent obtained separately (KVKK Art. 5/1). The processing of IP address/device/browser information for the purposes of Site security and performance is likewise based on the legal ground of legitimate interest.

A.4.5. Consent Mechanism. The mandatory consent box in the early access form reads as follows: "I have read the KVKK Privacy Notice and the Privacy Policy; I accept that the information I share may be processed to evaluate my early access application and to contact me." The form cannot be submitted without this consent. In addition, an entirely optional marketing consent box that is not pre-checked is offered: "I agree to receive Corenta product updates, early access announcements and informational emails." Leaving this box unchecked does not affect the evaluation of the application in any way.

A.4.6. Transfer. Personal data collected through the form may be shared with hosting, form collection, email delivery, analytics, security and similar technical service providers, only to the extent necessary to provide the relevant service.

A.4.7. Detailed information on the processing of personal data is set out in the Corenta Privacy Policy (corenta.app/privacy) and the KVKK Privacy Notice (corenta.app/legal/kvkk-aydinlatma-metni). These texts are informational texts, not contractual terms, and are read together with this Agreement.

A.5 Accuracy of the Information Shared in the Form

You represent that the information you share in the early access form or contact forms is accurate and up to date. If false or misleading information is shared, Corenta may exclude your application from evaluation; Corenta cannot be held liable for damages arising from this.

A.6 Visitor Obligations

When using the Site, you agree:

• To share accurate and up-to-date information;
• Not to infringe the intellectual property, personal data and other rights of third parties;
• Not to engage in any action that may harm the Site, place an excessive load on it or threaten its security (including automated data collection/scraping, vulnerability scanning and attempts at unauthorized access);
• Not to submit forms that constitute spam, fraud or abuse.

In the event of a breach of these obligations, Corenta has the right to restrict your access to the Site and/or to treat your application as invalid.

A.7 Third-Party Links

The Site may contain links to third-party websites. Teta Studio is not responsible for the content, privacy practices or availability of these sites.

A.8 Relationship of Part A to Part B

When a Visitor ceases to be a Site visitor and becomes a Customer subscribing to the Service, the provisions of Part B apply additionally and with priority with respect to them (and the business they represent). In the event of a conflict between Part A and Part B, the specific provision applies according to the relevant context of use (Site visit or use of the Service).

A.9 Contact

Questions about this part may be sent to hello@corenta.app.

PART B — SERVICE AGREEMENT FOR CLINICS SUBSCRIBING TO THE CORENTA SAAS PRODUCT

B.1 Parties and Acceptance

This Part B (the "Service Agreement") is concluded between the clinical Pilates, physiotherapy, reformer, wellness/massage or yoga center business ("Customer", "Clinic" or "Tenant") subscribing to the Corenta product (the mobile application and/or the app.corenta.app web admin panel, the "App") and Teta Studio ("Corenta", the "Provider").

By creating an account in the App, purchasing a subscription or actually using the App, you represent that you are authorized to act on behalf of the Customer and that you accept this Service Agreement on behalf of the Customer, in a manner binding on the Customer. If you are not authorized, you should not use the App.

B.2 Description and Scope of the Service

B.2.1. General functionality. Corenta is a multi-tenant, mobile-first SaaS product that offers Clinics functions such as creating and managing appointments, package sales and deduction of session entitlements, collection of client health history forms, keeping session notes, specialist/staff calendars, measurement/progress tracking, client communication and KVKK consent management, through a single mobile-first application and a web admin panel.

B.2.2. Within the scope of its beachhead (priority) market strategy, Corenta is designed as a solution primarily addressing clinical Pilates and physiotherapy centers and, more generally, boutique health/wellness businesses with 2–10 specialists. This does not mean that the Service will be offered only to businesses with this profile; product prioritization is carried out with this segment in mind.

B.2.3. Booking and Entitlement Logic. For package-based services, a session is deducted from the package purchased by the client at the moment the appointment is created; the actual completion of the session is not awaited. When an appointment is canceled, the return of the deducted session is processed automatically within the Platform's cancellation logic, depending on how long before the appointment time the cancellation is made (early/late cancellation distinction). The specific parameters of this logic may be subject to the Clinic's own Platform settings; the Clinic is responsible for configuring these settings in line with its own commercial policy.

B.2.4. Time Display. On the Platform, all timestamps are stored on the server side in UTC and are shown in the user interface converted to the Türkiye time zone (Europe/Istanbul, UTC+3).

B.2.5. Modular Structure. Some functions of the Service (tenant_modules) may be turned on or off depending on the Plan to which the Clinic subscribes. If a module is turned off, the related screens/functions are not displayed in the App or work in a restricted way; this does not constitute a defect in the Service or incomplete performance, but is merely a result of the scope limitation of the relevant plan. Which modules are included in which Plan is shown on the current plan comparison screen within the Platform.

B.2.6. Special Use Restrictions Relating to Health Data. Access to modules containing health data, such as health history forms, session notes and measurement records, requires an additional approval/authorization step within the Platform (health_data_enabled). These modules are under no circumstances open to write operations, even in the support/impersonation scenarios described in Article B.11.4.

B.2.7. Append-Only Principle. Once a session note has been submitted by a Specialist User (once the submitted_at field has been filled in), it cannot be updated or deleted on the Platform. This is a deliberate design decision aimed at protecting the integrity of Client health records. The effect of this principle on data subject rights is explained separately in Article B.12.1-A.

B.2.8. Notifications. The Platform may send mobile push notifications for appointment reminders and similar purposes. These notifications are delivered through the Apple Push Notification Service (APNs) and/or Firebase Cloud Messaging (FCM) infrastructures.

B.2.9. Mobile Permissions. The App requests only notification permission and, at the moment a file is chosen, access to the iOS photo library (profile photo, health history attachment, payment receipt, announcement image, studio video); if the app lock is on, the device's Face ID/fingerprint verification is used on the device. The App does not request permissions such as camera, microphone, location, contacts, calendar or HealthKit.

B.2.10. Matters Outside the Scope of the Service. Unless expressly agreed otherwise in writing, the following are not within the scope of the Service: (a) accepting payments directly by credit card over the web (the current payment method is only Apple/Google in-app purchase - IAP); (b) accounting/e-invoice integration; (c) health facility licensing/permit processes; (d) the Clinic's medical/clinical responsibility towards its own Clients.

B.2.11. The Service is provided "as is" and "as available". Corenta gives no express or implied warranty that the Service will fully meet the Customer's specific business needs or that it will be uninterrupted, error-free or completely free of security vulnerabilities (see Article B.15).

B.2.12. Corenta keeps the Service in a process of continuous development; it reserves the right to add new features, change existing features or remove certain features. Material changes that significantly alter the core purpose of the subscription will be announced, where possible, a reasonable time in advance through an in-App notification or email; minor improvements and bug fixes may be applied without prior notice.

B.3 Account Creation and User Obligations

B.3.1. To benefit from the Service, the Clinic must create an account (tenant) with accurate, current and complete information. The Clinic Admin represents and warrants that they are authorized to open an account on behalf of the Clinic and to accept this Agreement in a manner binding on the Clinic.

B.3.2. Account Security. The User is solely responsible for the confidentiality of their own account credentials (username, password, session token) and for all transactions carried out through their account. If unauthorized use of the account is suspected, the User must notify Corenta immediately via hello@corenta.app.

B.3.3. Obligation to Provide Accurate Information. The User undertakes that all information entered into the Platform (their own identity information, Clinic information, Client information) is accurate and up to date. Corenta cannot be held liable for damages arising from the entry of false or misleading information.

B.3.4. Age and Capacity. Natural persons using the Platform must be at least 18 years old and have legal capacity to act. If there are minors among its Clients, the Clinic is itself responsible for obtaining the legal representative's approval required for the processing of those persons' data.

B.3.5. Prohibited Uses. The User may not use the Platform for the following purposes or in the following ways:

a) Applying reverse engineering, decompiling or disassembling to the Platform's source code, algorithms or infrastructure; b) Attempting to overcome, circumvent or disable the Platform's security measures; c) Attempting to gain unauthorized access to the data of another Clinic (tenant); d) Using the Platform for a purpose that infringes the rights of third parties or is unlawful, immoral or fraudulent; e) Carrying out unauthorized data collection through the Platform by automated data scraping, bots or similar tools; f) Engaging in actions that disrupt the operation of the Platform, cause it to be overloaded or lead to a service interruption; g) Sublicensing, renting or leasing out the Service, or using it to offer a competing service to third parties through the Platform, without Corenta's prior written approval.

B.3.6. The Clinic is responsible for ensuring that its own employees to whom it grants access to the Platform (Specialist Users) use it in accordance with this Agreement and the applicable legislation. Every transaction carried out by Specialist Users through the Platform is under the Clinic's actual and legal responsibility.

B.4 Plans and Pricing

B.4.1. As of the date this Agreement is concluded, Corenta offers the following Subscription plans:

The Solo, Starter, Pro and Clinic+ plans are also offered with an annual payment option; the annual fee is 10 times the monthly fee. The amounts in the table are prices for Türkiye. In other countries, the Plan price is shown in the relevant store in that country's currency.

B.4.2. Prices are shown in the store of the country of purchase, in that country's currency and inclusive of the VAT or sales tax applicable in that country; in Türkiye, prices are in Turkish lira (₺) and include VAT. The current and binding price is always the amount shown by the relevant store (Apple/Google) at the time of purchase.

B.4.3. Price Changes. Corenta may change Plan prices. A price increase applies only to Customers who start a new Subscription after the date of the change; as long as an existing Subscription renews without interruption, it renews at the price that applied when the Subscription began, and the store's subscription price-increase mechanism is not applied to existing Subscriptions. Price reductions are reflected according to the store's own process. Changes to the scope of a Plan are subject to Articles B.4.4 and B.4.6.

B.4.4. Modular Structure. Which features are included in which Plan is shown, as currently applicable, within the Platform and/or on the Site; the module-Plan mapping may, by the nature of the product development process, be changed with prior notice.

B.4.6. Free Features. A feature offered free of charge in Corenta is not later moved to a paid plan and is not made chargeable. This rule limits the module-Plan changes that may be made under Article B.4.4.

B.4.5. Enterprise Plan. The pricing, service scope and any special SLA (service level agreement) terms under the Enterprise plan are determined by a written quote/supplementary agreement to be negotiated separately between the parties; if such a supplementary agreement exists, it applies together with this Agreement, and in the event of a conflict, the provisions of the written supplementary agreement specific to Enterprise prevail.

B.5 Payment and Billing

B.5.1. Payment Method. As of the date this Agreement is concluded, subscription fees are collected only through the Apple App Store (In-App Purchase) or the Google Play Store (In-App Purchase), using the subscription/billing infrastructure of the relevant store operator. The option of accepting payments directly by credit card over the web does not exist as of the date of this Agreement; if this option is offered in the future, the relevant terms will be announced separately and, if necessary, this Agreement will be updated.

B.5.2. The payment transaction is carried out through the Customer's associated store account (Apple ID / Google Account) using the store operator's own payment infrastructure. Corenta does not directly see, store or process payment card information.

B.5.3. Priority of Store Agreements. Since the subscription is purchased under Apple's or Google's own Store agreements (Apple Media Services Terms / Google Play Terms), the relevant Store's own terms and policies apply with respect to payment collection, automatic renewal, refund processes and payment method management. Corenta has no direct control over the operation of the Store's payment infrastructure.

B.5.4. Automatic Renewal. Unless canceled by the User in the relevant Store settings, subscriptions renew automatically at the end of the selected billing cycle (monthly or annual), and the fee is collected, in accordance with the relevant Store's own policy, shortly before the end of the billing period through the payment method registered in the User's Store account. The exact time window in which collection takes place is a matter determined and managed by the relevant Store, not by Corenta.

B.5.5. Invoice/Receipt. Invoices/receipts are provided through the relevant store's own mechanisms. For corporate invoicing needs, the Customer may contact Corenta via hello@corenta.app; Corenta provides support in this regard on a reasonable-efforts basis but cannot guarantee the outcome beyond what store policies allow.

B.5.6. If payment cannot be collected by the relevant Store for any reason (card declined, account problem, etc.), access to the Service may be restricted, subject to the suspension provisions set out in Article B.13.

B.5.8. Boost and Store Refunds. Boost (a promotion labeled "Sponsored" in Discover) is purchased through an in-app purchase and is limited in time. Corenta does not refund fees. If Apple or Google, under its own policy, refunds a Boost payment in full, the Boost ends; if it refunds it in part, the remaining duration of the Boost is shortened in proportion to the amount refunded. In that case, no cash, credit or other entitlement is given. If Apple requests usage information in connection with a refund request, Corenta sends this information only with the User's consent; without consent, no response is given.

B.5.7. Corenta aims to apply cryptographic signature verification in validating Store-originated payment notifications (webhooks) and is rolling out this mechanism gradually in the production environment; it is not undertaken that this verification mechanism is always fully and continuously active in all production environments. Corenta does not guarantee that the payment infrastructure will work end to end without interruption or error, and it continuously reviews and improves its security practices in this area.

B.6 Trial Period

Corenta may, from time to time and at its own discretion, offer a free trial period ("trial") for certain plans. The existence, length and scope of a trial period are stated on the purchase screen of the relevant Store and/or within the Platform; this Agreement does not guarantee the existence of any trial period. If a trial period is offered, unless expressly stated otherwise, the subscription automatically moves to the paid period at the end of the trial period and collection begins under Article B.5; it is the Customer's own responsibility to cancel the subscription before moving to the paid period.

B.7 Cancellation and Right of Withdrawal

B.7.1. The User may cancel their Subscription at any time from the subscription management screen of the relevant Store. Cancellation takes effect immediately (automatic renewal stops at once) and no fee is refunded; access to the Service continues until the end of the paid period. A refund granted by a Store under its own policy is not Corenta's decision; the subscription record is updated according to the store's notification.

B.7.2. For natural person Users acting as consumers, the provisions on the right of withdrawal under Consumer Protection Law No. 6502 and the Regulation on Distance Contracts in Türkiye, and in other countries the mandatory consumer protection rules of the country of the User's habitual residence that cannot be excluded by contract, are reserved; however, where performance of digital content/services begins immediately with the User's approval, there may be cases in which the right of withdrawal cannot be exercised under the relevant legislation. Due to the in-store purchase model, refund and withdrawal requests are evaluated primarily through the relevant Store's (Apple/Google) own refund policy and process; Corenta is not the store's decision-maker in this process.

B.7.3. The Subscription is purchased for a business or professional activity (for commercial or professional purposes). For this reason, the Customer is not a consumer within the meaning of Art. 3/1-k of Law No. 6502; self-employed professionals (e.g. physiotherapists) also fall within this scope. The Customer represents at registration that it is acting for this purpose. Therefore, consumer law provisions (including the right of withdrawal) do not, as a rule, apply to the Subscription relationship; this does not affect the exceptional consumer transactions referred to in Article B.7.2.

B.7.4. If the Customer wishes to close its account permanently, it may use the account deletion function within the App; in that case, the provisions of Article B.12 and the related Privacy Policy apply.

B.8 The Clinic's Status and Obligations as Data Controller (KVKK Art. 3, Art. 5, Art. 6, Art. 9, Art. 10, Art. 11)

This article is one of the most critical provisions of this Agreement and is applied consistently in all Platform contexts; it should be read carefully.

B.8.1. Basis of the Role Allocation. With respect to the personal data of its own Clients that the Clinic processes through the Platform (identity, contact, appointment, package/payment, health history, session note, measurement, etc.):

a) The Clinic is the Data Controller within the meaning of KVKK Art. 3. The Clinic is the party that determines the purposes and means of processing and has a direct legal relationship with the Clients.

b) Corenta/Teta Studio is the Data Processor within the meaning of KVKK Art. 3. Corenta processes Client Data only in line with the Clinic's instructions, for the purpose of performing the Service and within the limits set out in this Agreement and the Privacy Policy; it does not process it for its own independent purposes.

B.8.2. The Clinic's Obligations as Data Controller. As Data Controller, the Clinic is solely responsible for fulfilling the following obligations itself, and Corenta cannot be held liable for failure to fulfill these obligations:

a) Informing its Clients under KVKK Art. 10 (including preparing/providing the privacy notice); b) Securing the necessary legal grounds under KVKK Art. 5 and Art. 6 (in particular explicit consent for Health Data); c) Documenting and keeping Client consents in accordance with the law; d) Including in its own privacy notice the cross-border transfer described in Article B.10.5 (recipients, countries and basis). Explicit consent from the Client is not required for cross-border transfer and should not be requested; its basis is the standard contracts referred to in Article B.10.5; e) Responding to Clients' requests relating to data subject rights under KVKK Art. 11 within its own processes; f) Managing its own staff's (Specialist Users') access to Health Data in a manner limited to business need and authorized; g) Where necessary, fulfilling the obligation to register with VERBİS (the Data Controllers' Registry Information System); h) Separately ensuring KVKK compliance with respect to processing of Client data outside the Platform (paper records, other software, email, etc.); i) Assessing its own obligations relating to data retention periods when the Client relationship ends.

B.8.3. Technical Facilitation — Not a Transfer of Responsibility. In order to technically facilitate the Clinic's fulfillment of the above obligations, Corenta offers within the Platform a versioned record mechanism (consent_logs; including privacy notice display, optional health data consent, campaign notification consent and push records, with versioning and the option of withdrawal), and the display of the privacy notice in a separate step and optional consent steps on the mobile onboarding screen. The presence of these tools on the Platform does not mean that Corenta assumes the legal obligations arising from the Clinic's status as data controller or guarantees their lawfulness. The Clinic is responsible for the suitability of the content of the privacy notice and consent texts and the manner of their collection for its own activity (including the choice of the legal ground to be relied on for health data).

B.8.4. The Clinic represents and warrants to Corenta that, when entering Client Data into the Platform, it relies on the necessary legal ground, has informed its clients and processes the data lawfully. The Clinic is liable for any administrative fine, claim for compensation, lawsuit and damage arising from this representation being untrue; if Corenta is held liable by a third party or authority for this reason, the Clinic shall indemnify Corenta against such damage (see Article B.14).

B.8.5. The parties may, if they deem it necessary, conclude a separate Data Processing Agreement (DPA) detailing the provisions of this article; if such an agreement exists, it applies with priority with respect to data processing details and is interpreted together with this Agreement.

B.9 Corenta's Obligations as Data Processor

As Data Processor, Corenta:

a) Processes Client Data only for the performance of the Service and in line with the Clinic's instructions; does not use it for its own marketing or other independent purposes; b) Applies the technical and administrative security measures described in Article B.11; c) Discloses the use of sub-processors transparently as described in Article B.10; d) Limits access to records constituting Health Data through the Platform's role-based access controls (only the relevant Client, the assigned Specialist User and the tenant admin; for session notes that the specialist has shared with the team, the clinic's other specialists); e) Upon becoming aware of a data breach, informs the Clinic without delay and within 24 hours at the latest, so that the Clinic can notify the Personal Data Protection Board (Kurul, the "Board") within 72 hours under KVKK Art. 12/5 and the Board's Decision No. 2019/10. Corenta shares, to a reasonable extent, the technical information it has on the nature, scope and possible effects of the breach so that the Clinic can fulfill its own notification obligation. The final notification to the KVKK Board and notifications to data subjects are the obligation of the Clinic as data controller.

B.10 Sub-processors and Data Localization (KVKK Art. 9)

B.10.1. Corenta uses the following sub-processors (third-party service providers) to provide the Service. By accepting this Agreement, the Clinic is deemed to have given, in its capacity as Clinic and as the Clinic's own approval, contractual approval to the transfer to/processing by these sub-processors, limited to the purpose of performing the Service, of (i) the Clinic's own data (such as account, billing and contact information) and (ii) Client Data (general client/business data, excluding Health Data). The basis for cross-border transfer with respect to Client Data and in particular Health Data is set out in Article B.10.5; these transfers are not based on explicit consent.

B.10.2. Email Infrastructure. Service emails are sent through Google Workspace (Google); authentication emails are triggered by Supabase Auth. Corenta sends promotional emails only subject to separate consent and İYS registration (Article B.16.4). Push notifications are delivered through Apple (APNs) and Google (FCM).

B.10.3. Analytics and Error Monitoring. Corenta does not use any third-party analytics or error monitoring service. Client error logs are kept in Corenta's own database. In-app product usage measurement is currently not active. If a third-party analytics or error monitoring tool is introduced, this list and the related Privacy Policy will be updated and announced to Users.

B.10.4. Web Payment Provider. As of the date of this Agreement, no payment provider that collects credit card payments directly over the web (e.g. İyzico, Stripe) has been integrated; payments are collected only through the Apple/Google IAP mechanism specified in Article B.5.

B.10.5. Data Localization and Cross-Border Transfer (KVKK Art. 9). The main storage infrastructure for Client Data (Supabase) is in Frankfurt/Germany; Vercel, Google and Apple also process data outside Türkiye. These are cross-border transfers within the meaning of KVKK Art. 9. As of the date of this Agreement:

a) There is no adequacy decision (Art. 9/1) announced by the Board for these countries (last checked: October 11, 2026);

b) Because these transfers are regular and continuous, they are not based on explicit consent (Art. 9/6 is only for incidental transfers); they will be based on the standard contracts announced by the Board under Art. 9/4-c. As data processor, Corenta signs the Module 3 (processor to processor) standard contract with each sub-processor and notifies it to the Board within 5 business days of signature (Art. 9/5);

c) As of the date of this version, the standard contracts have not yet been signed and have not been notified to the Board. When signature and notification are completed, the Sub-processors List will be updated with the dates and the list of providers. A sub-processor with which a standard contract cannot be signed will not be used to process Client Data.

d) The contractual safeguards offered by Supabase under its own DPA (supabase.com/legal/dpa) (e.g. the EU Standard Contractual Clauses) are an additional contractual layer; they do not replace the standard contract announced by the Board under KVKK Art. 9/4-c.

B.10.6. In the event of a significant change in the sub-processor list (addition of a new sub-processor, change in data localization, etc.), Corenta will notify Clinics a reasonable time in advance within the Platform (e.g. the sub-processor list screen in the admin panel) and/or by email.

B.11 Security Measures (KVKK Art. 12)

B.11.1. Multi-Tenant Isolation. All data tables on the Platform are protected according to the default-deny principle, by making the tenant identifier (tenant_id) field mandatory and through Row Level Security (RLS) policies. In this way, a Clinic's data is technically closed to access by another Clinic.

B.11.2. Special Access Restrictions for Health Data. Special category health data such as health history forms, session notes and measurement records can be accessed, within the framework of RLS policies, only by the relevant Client, the Specialist User assigned to the Client and the Clinic admin; session notes that the specialist has marked as "shared with the team" can also be seen by the clinic's other specialists. Staff access is possible while the relevant health module is turned on. Session notes cannot be updated or deleted after submission (append-only); for health history forms, no user role (including the Clinic admin) has been granted deletion rights. The meaning of these restrictions with respect to the right to deletion/destruction under KVKK Art. 11 is explained separately in Article B.12.1-A.

B.11.3. Transmission Security and On-Device Protection. Data transmission is protected by TLS encryption. In the mobile application, session tokens are stored encrypted in the device's secure hardware store (expo-secure-store based on iOS Keychain / Android Keystore). Technical measures to prevent/hinder taking screenshots have been applied on sensitive screens.

B.11.4. Security Design of Support Mode (Impersonation). The support mode (impersonation) used by Corenta's super-admin/support team: is time-limited (maximum 30 minutes), is read-only by default, and write permission and Health Data access are each gated by separate steps requiring additional approval. No exception for the impersonation scenario has been granted in the RLS policies for the Health Data tables; consequently, write operations to these tables are not possible even in support mode.

B.11.5. Admin Account Security. Corenta's platform admin (super-admin) accounts require two-factor authentication (MFA, AAL2).

B.11.6. Payment Security. Cryptographic signature verification is intended to be applied in validating Store-originated (Apple/Google) in-app purchase notifications (webhooks), and this mechanism is being rolled out gradually in the production environment. Corenta continuously reviews and improves its payment security practices and does not guarantee absolute/uninterrupted protection in this area.

B.11.7. Continuous Improvement; Not an Absolute Guarantee. Corenta continuously reviews and improves its technical and administrative security measures in line with the evolving threat environment and legal requirements. The measures listed in this article should be understood not as an undertaking of absolute/zero risk, but as the "necessary technical and administrative measures to ensure an appropriate level of security" expected under KVKK Art. 12. The Customer accepts that the security of no information system can be absolute; Corenta does not guarantee that unauthorized access, data breaches or similar security incidents can be completely prevented. In addition, the provision of Article B.9(e) remains reserved with respect to Corenta's data breach notification process towards the Clinic.

B.12 Data Subject Rights (KVKK Art. 11) and Account Deletion

B.12.1. Clients (data subjects) direct the rights they have under KVKK Art. 11 (to learn whether their personal data is processed, to request information if it has been processed, to learn the purpose of processing, to know the third parties to whom it is transferred, to request correction if it has been processed incompletely/incorrectly, to request its deletion/destruction, to request that these actions be notified to the third parties to whom it has been transferred, to object to a result to their detriment arising from analysis by automated systems, and to claim compensation if they suffer damage) primarily to the Clinic (in its capacity as Data Controller). The Service technically supports this process with the tools specified in Article B.8.3.

B.12.1-A. Limit of the Right to Deletion/Destruction with Respect to Health Data. The right to request deletion/destruction under KVKK Art. 11/1(d) and (e) is not absolute with respect to health history forms and session notes constituting Health Data. As explained in Articles B.2.7 and B.11.2, session notes cannot be updated or deleted after submission by design of the Platform (append-only principle); for health history forms too, no user role (including the Clinic admin) has been granted deletion rights. This design choice is based on the purposes of protecting the integrity and immutability of the health record, preserving the evidentiary value of the record in the event of a possible medical dispute/audit, and supporting record retention obligations that may arise from legislation on health services (under KVKK Art. 7/2, retention provisions in other laws are reserved). Therefore, if a Client makes a specific "deletion" request for a health history form or session note, this request cannot technically be fulfilled on the Platform; the Clinic is obliged to evaluate such a request within the framework of KVKK Art. 11 and the related exception provisions and to explain this limitation and its reasons to the Client. This limitation does not affect the Client's other rights under KVKK Art. 11 against the Clinic (request for information, correction, objection, etc.).

B.12.2-A. Account deletion: When a deletion request is confirmed, access to the account is cut off immediately (sessions are terminated, sign-in is not possible); personal data is deleted or anonymized (name, email, phone, image and client identity/contact information and health fields — blood type, allergies, chronic conditions, medications — are cleared); payment and earnings records requiring legal retention are not deleted; they are kept with the link to the person severed and with restricted access. There is no period for undoing the request; permanent deletion of the authentication record and files is completed in the existing thirty-day background process. Session notes, health history forms and measurements are kept with the link to the person severed; since the free text of session notes is not changed, these records are not considered anonymous.

B.12.2-B. Deletion of a client record and health fields (as of October 4, 2026): When a client record without an account is deleted by the business, the record is immediately removed from the active list; at the end of 30 days, the client's health fields (blood type, allergies, chronic conditions, medications) are also deleted/cleared together with the identity and contact information. The retention rules for health history forms, measurements and session notes are not affected by this provision.

B.12.2-C. Receipt files (as of October 4, 2026): Receipt files not linked to a payment (orphaned) are automatically deleted after 7 days; a receipt linked to a payment is not deleted by any role.

B.12.2-D. Permission to write health fields (as of October 4, 2026): The client's health fields (blood type, allergies, chronic conditions, medications) can be written only by the client themself and their assigned specialist; the business owner/admin cannot write to these fields (they can edit the emergency contact and identity fields).

B.12.2. Technical Operation of the Right to Deletion (at Account Level). The Platform offers an account deletion mechanism triggered at the user's request (delete_my_account). When this mechanism is triggered: (a) access to the account is cut off immediately, the profile is made inactive, pending appointments are canceled, assignments are removed and consents are withdrawn; (b) after 30 days, the authentication record is permanently deleted by an automated background task (cron) (Article B.12.2-A). This permanent deletion can be triggered only by the system's background task and cannot be undone. This account-level deletion mechanism is separate from the deletion limitation at the level of individual health history forms/session notes described in Article B.12.1-A and does not remove that limitation; even during the permanent deletion of the account, the related Health Data records may have to be handled in accordance with the Platform's append-only/non-deletable design.

B.12.3. File Attachments. Profile images, health history attachments, export files and payment receipts are automatically deleted from storage in the permanent deletion step; if deletion in one area fails, this is logged and does not prevent the cleanup of the other areas. Specialist identity/diploma verification documents are not within the scope of this automatic deletion; they are deleted separately when the tenant is closed or upon request.

B.12.4. Data Portability / Request for Information. The Platform offers a function (export_user_data) that enables the export of Client/User data; this function enables the data to be exported limited to the scope of the relevant tenant. The data is provided in a structured and machine-readable format (JSON); when the file can be prepared, it is also prepared as a ZIP and provided through a personal (signed) link valid for 7 days. If the ZIP cannot be prepared, only the JSON output is provided.

B.12.5. Right to Correction. Correction of Client data is technically possible through the Clinic's admin panel. As of the date of this Agreement, there is no separate, automated "correction request workflow"; correction requests are directed to the Clinic and processed manually by the Clinic; this right is evaluated within the framework of the general rights under KVKK Art. 11. With respect to submitted session notes constituting Health Data, correction is also subject to the append-only limitation in Article B.12.1-A; in such a case, correction may be handled, if necessary, by adding a new record/note rather than by changing the existing record.

B.12.6. Direct Application to Corenta. Where Clients cannot reach the Clinic or receive no response, they may also apply to Corenta, in its capacity as Data Processor, via hello@corenta.app; Corenta forwards such an application to the relevant Clinic and provides technically reasonable support; however, the ultimate legal addressee and decision-maker is the Clinic in its capacity as Data Controller.

B.12.7. VERBİS. As of the date of this text, Teta Studio has no VERBİS registration; with respect to its own data controller activities, the registration obligation is being assessed according to the criteria (number of employees, type of books kept, main activity) in Board Decisions No. 2025/1572 and No. 2025/2393. The Clinic's own obligation is separate; for data controllers whose main activity is the processing of health data, the exemption threshold is 10 employees per year and a balance sheet of TRY 10 million. To the extent that it operates as Data Processor, Corenta separately carries out on its own side the assessment of its own VERBİS registration obligation; this assessment does not affect or replace the VERBİS obligation that the Clinic bears in its own capacity as Data Controller under Article B.8.2(g).

B.13 Availability of the Service, Changes and Interruptions

B.13.1. Corenta makes commercially reasonable efforts to ensure that the Service has reasonable continuity and availability. However, as of the date of this Agreement, no specific, measurable service level agreement (SLA) backed by compensation sanctions is offered for plans other than Enterprise. Special SLA commitments for the Enterprise plan may be determined by a separate written supplementary agreement under Article B.4.5.

B.13.2. Corenta may from time to time carry out planned interruptions for the purpose of maintaining, updating or improving the Platform. Where possible, efforts will be made to notify the User in advance of significant planned interruptions; urgent security patches or critical interventions may be applied without prior notice.

B.13.3. Interruptions to the Service may occur due to interruptions originating from infrastructure providers (including the sub-processors listed in Article B.10), cyberattacks, force majeure events (see Article C.3) or other causes beyond Corenta's reasonable control.

B.13.4. Backups. Corenta applies reasonable technical measures (including database backups) to prevent the loss of Customer Data; however, it is recommended that the Clinic separately back up, in its own name and for its own account, data of critical importance for its own business processes.

B.14 Mutual Indemnification (Hold Harmless)

B.14.1. The Customer accepts, represents and undertakes that it shall indemnify Corenta against, and shall not leave Corenta defenseless in the face of, any third-party claim, administrative fine, lawsuit, damage and expense (including reasonable attorney's fees) arising from breaches of KVKK and related legislation in the process of processing its own Client Data, from its failure to carry out adequate information and (where necessary) consent processes towards its clients (including information on cross-border transfer under Article B.8.2(d)), from a breach of this Agreement or from unauthorized/unlawful use of the App.

B.14.2. Corenta is liable, within the limitations in Article B.15, for damages arising directly from its own fault, from the App operating in clear breach of the agreement or from Corenta's breach of its obligations as Data Processor (Article B.9).

B.14.3. Corenta cannot be held liable for any allegation, claim or damage arising from the results of the service provided by the Clinic to its own Clients (physical injury, health complications, dissatisfaction, etc.); such allegations fall exclusively within the relationship between the Clinic and the Client.

B.15 Limitation of Liability

B.15.1. The Service is provided "as is" and "as available". To the maximum extent permitted by applicable law, Corenta gives no express or implied warranty that the Service will be uninterrupted, error-free or fit for a particular purpose.

B.15.2. Corenta cannot be held liable for service disruptions caused by force majeure, interruptions originating from third-party service providers (sub-processors such as Supabase, Apple, Google, Vercel, Framer) or problems originating from the Customer's own equipment/internet connection.

B.15.3. To the maximum extent permitted by applicable law, Corenta's total liability arising from this Agreement is limited to the total Subscription fees actually paid by the relevant User/Clinic in the twelve (12) months preceding the event giving rise to the liability.

B.15.4. To the maximum extent permitted by applicable law, Corenta cannot be held liable for loss of profit, loss of revenue, loss of business, loss of reputation, loss of data (that may occur despite the backup measures taken under Article B.13.4) or indirect, incidental, special, punitive or consequential damages, even if it has been notified of the possibility of such damages.

B.15.5. These limitations do not apply with respect to damages arising from (a) Corenta's gross negligence or intent, (b) intentional breach of Health Data security or (c) cases of liability whose limitation is not permitted by applicable KVKK/consumer legislation. These limitations also cannot be used to impose on Corenta liability arising from the unlawful processing of Health Data that stems exclusively from the Clinic's status as data controller (see Articles B.8, B.14).

B.15.6. In payment, billing or refund problems originating from the Store (Apple/Google) infrastructure, Corenta's liability is limited to matters within its own reasonable control; Corenta cannot be held liable for the Store's own service interruptions, payment processing errors or policy changes.

B.16 Support Services

B.16.1. Corenta accepts User support requests via support@corenta.app (general contact: hello@corenta.app). Support response times may vary according to Plan level; these differences may be specified within the Platform or in a separate support policy.

B.16.2. The security design of the support access (impersonation) mechanism is set out in Article B.11.4.

B.16.3. Client contact details in support mode (as of October 4, 2026): In a Corenta support (super-admin) session, the client's email and phone information is not shown to support staff; support staff can see only a limited identity summary (name, account status, active status, creation date).

B.16.4. Service emails (as of October 4, 2026): Corenta sends service emails such as trial period emails (started, 3 days before the end, ended), team invitations and support replies. These emails are service messages and do not contain promotional elements. Corenta sends promotional and campaign emails only if consent has been given separately through an unchecked box and after registration in the Message Management System (İleti Yönetim Sistemi, İYS); every promotional message contains a free opt-out link. Emails are sent through Google Workspace (Google). hello@corenta.app is used for general contact and KVKK applications, and support@corenta.app for support.

B.16.5. Pseudonymous product measurement: To improve the product, aggregate usage events may be measured only on the server side, with a clinic pseudonymous identifier; this measurement does not include IP addresses, health data or source/advertising tracking. The clinic pseudonymous identifier is pseudonymous in nature (it is not anonymous). The feature is currently turned off.

B.17 Suspension and Termination of the Account

B.17.1. Termination by the Customer. The Customer may cancel its Subscription at any time under Article B.7. Cancellation takes effect immediately and no fee is refunded; access continues until the end of the paid period.

B.17.2. Suspension by Corenta. Corenta reserves the right to temporarily suspend the User's account, giving prior notice where possible, in the following cases:

a) The payment cannot be transferred to Corenta by the relevant Store, or the Subscription fee is not paid; b) One of the prohibited uses listed in Article B.3.5 or a breach of the Agreement is detected; c) There is reasonable suspicion that the security of the account has been compromised; d) Use contrary to applicable legislation is detected; e) A binding request from a legal authority (court, public prosecutor's office, regulatory authority).

B.17.3. Termination by Corenta. Corenta may terminate this Agreement unilaterally if the breaches listed in Article B.17.2 are not remedied within a reasonable remedy period (as a rule 15 days; shorter or immediately for serious breaches).

B.17.4. Consequences of Termination. Upon termination or expiry of the Agreement: (a) the User's access to the Service is stopped; (b) if there is a paid and unused balance, refund rights are primarily subject to the relevant Store's refund policy; (c) the Clinic may export a copy of its own Customer Data within a reasonable period (at least 30 days) from the termination date; at the end of this period, the data may be deleted to the extent permitted by applicable legislation and in accordance with the deletion mechanism described in Articles B.12.2–B.12.3.

B.17.5. If Corenta decides to discontinue the Service entirely, it will notify Customers of this a reasonable time in advance and, to the extent possible, endeavor to offer the data portability option described in Article B.12.4.

B.18 Intellectual Property (SaaS Context)

B.18.1. The Platform; software code, interface design, database structure, algorithms, workflows, trademark, logo, the "Corenta" name and all related Intellectual Property Rights belong exclusively to Teta Studio or its licensors. This Agreement does not transfer to the User any ownership right in the Platform.

B.18.2. Limited License of Use. Corenta grants the User a limited, non-exclusive, non-transferable, non-sublicensable right of use (license) for the duration of the Subscription and only for the purposes within the scope of this Agreement. This license ends automatically when the Subscription ends.

B.18.3. Rights in Clinic and Client Data. Ownership of Customer Data remains with the Clinic. Corenta has limited processing authority over Customer Data, in its capacity as data processor, only for the purposes of performing the Service, technical support, security, backup and the purposes specified in this Agreement and in the Privacy Policy/Data Processing Agreement (if any); it does not claim any independent ownership or license right in this data and may not use this data for another purpose in its own name, sell it or transfer it to third parties for marketing purposes.

B.18.4. Corenta may use anonymized or aggregate statistical data obtained from the use of the Service for product development and market research purposes, in a manner that does not make any Customer or Client identifiable.

B.18.5. Feedback. Suggestions, feedback or improvement requests that the User voluntarily provides to Corenta may be used freely by Corenta without giving rise to any obligation of payment or attribution.

B.18.6. Use of the Trademark. The User may not use the "Corenta" trademark, logo or trade dress without Corenta's prior written permission; this restriction does not prevent the Clinic from making a reasonable, truthful reference to its own Clients for the purpose of stating that it uses the Platform (e.g. the statement "we manage our appointments through Corenta").

B.19 Representations and Warranties

B.19.1. The Clinic represents that it holds all professional authorizations, licenses, diplomas and permits required to provide the relevant health/wellness services. Corenta does not audit the Clinic's professional competence or compliance with legislation and assumes no responsibility in this regard.

B.19.2. The Clinic is itself responsible for the nature, quality and results of the medical/clinical service it provides through the Platform (Pilates, physiotherapy, reformer, massage, yoga, etc.). Corenta is only a provider of a software/appointment management tool; it is not a health service provider.

B.20 Community, Growth Features and In-App Entitlements (as of October 18, 2026)

This article applies to the community and growth features that are switched on as modules. A module being switched off falls within Article B.2.5.

B.20.1. In-App Credits. Credits are earned by the Clinic completing selected tasks. Credits cannot be purchased, converted into cash or a discount, or transferred to another Clinic, and they expire 12 months after the date on which they were earned. Credits are spent only on in-app rewards (such as a sticker pack or an extra Corenta Lab vote); spent credits are not restored. Credits have no monetary value.

B.20.2. Stickers. The basic sticker pack is free of charge. Some packs are unlocked with credits or with a particular badge; a pack is unlocked at Clinic level and no separate payment is collected for clients. Stickers are used in one-to-one and group messages and do not generate notifications.

B.20.3. Studio-to-Studio Invitation Code. The Clinic may invite another business to Corenta with its own invitation code. (a) The invitation code can be added by the new studio owner within 14 days after registration and only once. (b) The invited studio receives a 30-day trial period; if its trial period is already longer, it is not shortened. (c) The inviter earns a free 7-day Boost entitlement upon the invited studio's first real payment. The reward is not cash, a price discount or credits. (d) At most 12 rewards can be earned in any rolling 365 days; invitations beyond that are counted but do not give a reward. (e) To prevent misuse, the two studios' tax numbers, phones (last 10 digits) and owner/manager accounts are compared; a matching invitation becomes "not counted" and no reward is given. The reason is not shown to the parties; an objection can be sent to hello@corenta.app. (f) The inviter sees the name of the invited studio and whether it has reached the registration, setup and first payment steps; it does not see the payment amount. (g) If the invitation code is shared in a manner constituting commercial advertising, indicating that it is an advertisement is the responsibility of the sharing Clinic.

B.20.4. Founding Studio Program. The first 50 paying studios that have reached the Rhythm stage may apply to become a Founding Studio; Corenta evaluates the application. The Founding badge of an accepted studio is permanent. The studio's name is shown on the public Founding Studios list only if the Clinic permits it; the Clinic may withdraw this permission at any time.

B.20.5. Corenta Lab. Founding Studios may write proposals; Founding Studios and studios that have reached Level 3 may vote. Each studio has 3 votes per month; at most 3 extra votes per month can be obtained with credits. Proposals and comments are visible to the other participating studios; the studio name is shown only if the Clinic chooses. Client information or health data should not be written in proposals and comments. Proposals fall within Article B.18.5 (Feedback); there is no commitment that a proposal will be implemented or released on a particular date.

B.20.6. Studio League and Challenges. (a) The league is open to studios at the Rhythm stage; the Clinic may leave the league at any time. Points are calculated only from weekly task XP; turnover, amounts and number of clients do not enter the ranking. A studio appears to other studios only under its nickname or code. The nickname may not imitate another business, person or brand and may not contain links. (b) If, in a week, at least 10 and more than half of the past sessions remain without attendance taken, the studio is not counted in the league that week. (c) Clients take part in in-studio challenges optionally; the table shows first name, initial of the surname and the number of sessions attended. Clients under 18 cannot take part. Pain, measurements, weight or health information are not used in a challenge; the Clinic should not write such information in the challenge title either. (d) League, challenge, badge and credit rewards have no monetary value.

B.20.7. Clinic Groups. The Clinic may open class, community and team groups. (a) Clients join a group only with their explicit consent and may leave whenever they wish; their names are shown in the form "Ayşe K.", and phone and email are not shown. (b) Clients under 18 can only be added to class groups to which the Clinic's team invites them; they cannot join community groups. (c) Groups are not designed for sharing health data. The Clinic and its specialists should not share a client's health information (diagnosis, pain, medication, treatment, measurements) in a group and should make client-specific clinical assessments through the one-to-one channel. (d) Group rules: offensive, discriminatory, threatening or harassing content; advertising and spam; sharing another person's personal information or image without permission; and unlawful content are prohibited.

B.20.8. Moderation. The Clinic is the moderator of its own groups: it reviews reports; it may hide or delete a message or lift the hiding; it may mute a member or remove them from the group; it may switch a group to "only the team can write" mode. A message reported by three different members is hidden automatically and goes to the team for review. The Clinic is obliged to remove reported unlawful content within a reasonable time. Corenta does not check group content in advance; if unlawful content is reported to it or a competent authority requests it, it may remove the content and suspend the account concerned under Article B.17.

B.20.9. Discover Videos, Trial Class and Sponsored Content. (a) The Clinic may upload at most 3 videos of 15–30 seconds to its Discover profile. A video is shown publicly in Discover only after Corenta's approval; Corenta may decline to publish a video it does not consider suitable without giving reasons. (b) The Clinic represents and undertakes that it holds all rights to the video it uploads, that it has obtained the written permission of every person who appears in the video, and that the video does not contain health information, promises of diagnosis or treatment, misleading statements or content infringing another person's trademark or copyright. The Clinic is liable under Article B.14 for any untruth in this representation. (c) The Clinic determines the price and conditions of the trial class offer; showing the price inclusive of taxes and ensuring that the offer is truthful are the Clinic's responsibility. Booking rules do not change. (d) Sponsored placement: A Clinic that purchases Boost is shown in a separate area of the Discover and "Find your clinic" screens and always with the label "Sponsored"; Boost does not change the organic ranking. Studios that carry the physiotherapy category are not shown as sponsored, and no trial price, free-spot card or video is shown for them in Discover. A client registered with a studio is not shown competing studios. The fee paid to Corenta for sponsored placement is subject to Article B.5.8.

B.20.10. Repeat Trial Periods. When a new trial is started, the studio owner's email, tax number and phone are compared with other studio records by means of a keyed digest, without the raw value being stored. A match does not by itself block the trial; it goes to Corenta for review. If Corenta establishes that the same business is using the trial period again and again, it reserves the right not to offer the trial period under Article B.6.

B.20.11. Device Limit. For security purposes, owner, manager and specialist accounts are bound to one phone and one tablet, and a client account to one mobile device; the web panel is outside this limit. When the limit is reached, the user chooses which device to sign out of. 3 device changes in 30 days are free; for more frequent changes, a wait of 24 hours from the last change applies.

PART C — COMMON PROVISIONS FOR BOTH PARTIES

C.1 Entire Agreement

This Agreement (together with Parts A, B, C and its annexes, and a separate Data Processing Agreement (DPA), if any) constitutes the entire agreement between the parties and supersedes all prior oral/written agreements on the subject. In the event of a conflict, the subject-specific supplementary document (e.g. the DPA, with respect to the processing of Client Data; the Enterprise supplementary agreement, with respect to the Enterprise scope) prevails over this general Agreement.

C.2 Confidentiality and Protection of Personal Data

Detailed rules on the processing of personal data are set out in the Corenta Privacy Policy and the KVKK Privacy Notice; these texts should be read together with this Agreement. The provisions of Articles B.8, B.9, B.10 and B.11 of this Agreement constitute the core KVKK-specific arrangement and the contractual reflection of the obligations relating to data security under KVKK Art. 12.

C.3 Force Majeure

C.3.1. Neither party can be held liable for delay in or impossibility of performance arising from events occurring beyond its reasonable control that could not be prevented with reasonable care (natural disaster, epidemic, war, terrorism, civil unrest, government decisions/changes in legislation, general outage of electricity/internet/telecommunications infrastructure, general service outage of a third-party cloud/infrastructure provider (including Supabase, Apple, Google, Vercel, Framer), cyberattack, etc., "Force Majeure").

C.3.2. If a Force Majeure event lasts longer than 30 (thirty) days, either party may terminate this Agreement by written notice to the other party, without any obligation to pay compensation arising.

C.4 Prohibition of Assignment

The User may not assign its rights and obligations arising from this Agreement to third parties without Corenta's prior written approval. Corenta may assign this Agreement in the context of a merger, acquisition or asset sale transaction, provided that it notifies the User.

C.5 Severability

If any provision of this Agreement is held invalid or unenforceable by a competent court, this does not affect the validity of the remaining provisions of the Agreement; the provision held invalid is reinterpreted in the manner closest to the original intent of the parties/deemed replaced by a valid provision.

C.6 Waiver

The failure of either party to exercise, or delay in exercising, any right under this Agreement does not mean that it waives that right.

C.6-A Service Market

Corenta is offered globally through the App Store and Google Play, in the countries where those stores operate. The publisher of Corenta is Teta Studio. Subscriptions and other paid entitlements can be purchased only through in-app purchase (Article B.5.1); Corenta does not accept payments on the web. A feature or Plan may not be offered in every country at the same time; the current status is shown in the store and in the Platform. This Agreement applies to Users in every country.

C.7 Amendments to the Agreement

Corenta reserves the right to make amendments to this Agreement. Material amendments are announced by email and/or in-Platform notification a reasonable time (at least 15 days) before they take effect. Continued use of the Service after an amendment means that the current Agreement has been accepted. A Customer that does not accept the amendments may end its subscription under Article B.7.

C.8 Notices

All notices to Corenta are made to hello@corenta.app. Notices from Corenta to the User may be made to the email address specified in the account registration and/or through the in-Platform notification mechanism.

C.9 Language

This Agreement has been prepared in Turkish. Versions of the Agreement translated into other languages are for information purposes only; in the event of any conflict, the Turkish text prevails.

C.10 Governing Law and Competent Court

C.10.1. This Agreement is governed by and interpreted in accordance with the laws of the Republic of Türkiye.

C.10.2. For the resolution of any dispute arising from or in connection with this Agreement, where the User acts as a consumer, the Consumer Arbitration Committees and Consumer Courts authorized by the applicable consumer legislation; in all other cases (in particular in the Subscription relationship to which the Clinic is a party as a merchant), the Ankara (Çankaya) Courts and Enforcement Offices have jurisdiction.

C.10.3. The parties shall first make reasonable efforts to resolve the dispute amicably; if this is not possible, the judicial remedies specified in Article C.10.2 will be pursued.

C.10.4. Where the User acts as a consumer, Articles C.10.1 and C.10.2 do not deprive the User of the protection afforded by the mandatory rules of the country of the User's habitual residence that cannot be excluded by contract, or of any right under those rules to bring proceedings before the courts or consumer dispute bodies of that country.

C.11 Binding Acceptance

Every User who registers for the Service, purchases a Subscription or continues to use the Service represents that they accept the provisions of this Agreement electronically. The Privacy Policy and the KVKK Privacy Notice are informational texts; they are not contractual terms and are not subject to consent.

C.12 Contact

Corenta / Teta Studio Email: hello@corenta.app Web: corenta.app App: app.corenta.app

ANNEX 1: PLAN COMPARISON SUMMARY (For Information Purposes)

*Module-based: Whether the relevant module is on/off for each plan is shown on the current plan comparison screen within the Platform and may be updated over time depending on Corenta's unilateral product management decisions. This Annex is a general summary as of the date of this Agreement; the current and binding information on plan scopes is found on the plan page within the Platform.

ANNEX 2: SUMMARY OF DEFINITIONS

Last updated: October 19, 2026 Version 1.9 · October 19, 2026