Privacy Policy — version 3

This text covers both sides of the app at once: the coach who provides
the service (dietitian, trainer) and the client the coach follows. This is
the privacy policy address declared in the store submissions.

More detailed texts:

• For the coach's own data: KVKK Privacy Notice
• For the division of roles between the coach and the platform: Data Processing Agreement
• For the rules of use: Terms of Service

1. Who processes, and in what capacity

The coach decides for what purpose the client's data is collected and how
long it is kept. The platform processes this data only on the coach's
instructions and to run the service; it does not use it for its own purposes,
does not sell it, does not use it for advertising, and does not market it to
third parties.

2. What data is processed

From the coach: name and surname, email, an irreversible digest of the
password, profession and area of expertise; optionally city, a short
introduction, profile photo and social media username (published only if the
coach opens their public profile themselves). When an agreement is accepted,
the date and IP address are recorded — this is the proof of acceptance.

From the client: name and surname, contact information, date of birth,
sex, height; goals and preferences; health data — statements of illness
and injury, medication and supplement use, allergies and food restrictions,
PAR-Q answers, reports of sleep, steps, energy and mood; measurements (weight,
circumference measurements, calculated body fat percentage); optional progress
photos; meal and workout logs; correspondence with the coach.

From the phone and smartwatch (only if separate permission is given):
daily steps, sleep duration, active calories, resting heart rate, weight from
a smart scale and workout duration. This data is read from the device's health
app (Apple Health / Android Health Connect).

Generated by the app itself: session token, notification token (if
notifications are allowed), crash report (below).

Not collected: location, contacts, microphone, advertising identifier. The
app does not show ads and does not track; on iOS the tracking permission is
not requested because there is no tracking.

3. Health data and explicit consent

Under Turkish law, health data is special category personal data (KVKK
art. 6) and cannot be processed without explicit consent. The client reads
and approves the consent text in the app; the version, date and IP address of
the approved text are recorded. Consent can be withdrawn — when withdrawn, the
consent record is not deleted but marked as "withdrawn"; a trace of the history
must remain.

Program generation does not run without consent.

SEPARATE consent is obtained for device data. The permission you give to
your phone's or watch's health app allows that data to be read; carrying it to
our server and storing it is a separate processing purpose and is approved
separately. This consent can be withdrawn from within the app with a single
tap; when withdrawn, the device data collected up to that day is deleted,
because the basis for keeping it no longer exists.

Figures coming from the device are not written to your record automatically:
they pre-fill the daily tracking form, and you approve or correct them.

4. What goes to artificial intelligence, and what does not

Nutrition and workout drafts, and the posture comment the coach requests, are
generated with a large language model. The data sent to the model passes
through a single gate and is de-identified there.

DOES NOT GO: name and surname, email, phone, date of birth, address, client
number; posture, body and workout photos. Names in free-text fields are also
removed.

GOES: age, sex, height, weight, body fat percentage, goal, activity level,
health restriction codes (for example "lumbar disc herniation", "peanut
allergy"), dietary preferences, a summary of workout history; when the coach
requests a posture comment, posture angles calculated on the phone (numbers,
not photos).

No number in the model output is used directly: calorie, macro and set
calculations are recomputed deterministically on the server. The artificial
intelligence does not diagnose and does not recommend medication; the output
is not shown to the client without passing the coach's approval. **The only
exception is the weekly summary:** if a Kerte Koç package includes this right,
the client sees a short summary prepared from the figures of their own past
week (check-ins, sleep, water, meal and workout logs, weight change) without
waiting for an expert's approval. This summary does not change the program or
the goals, does not set a new calorie or weight goal, and is not medical
advice; output that does not follow these rules is automatically rejected and
not shown. The data sent to the model is the same as the list above; name and
contact information are not sent.

The posture photo is measured on the phone and is not sent to any
artificial intelligence provider. The meal photo is sent to Google's Gemini
model (via OpenRouter) to estimate the foods and portions on the plate only
when three conditions hold together: the feature is on, the client has given a
separate explicit consent for meal photos, and an image model is defined.
This feature is currently off. No identity or location information is sent
with the photo; the estimate is shown as a suggestion and does not become final
until the client or the coach approves it.

5. Transfer abroad

Data from the phone and watch **is not sent to the artificial intelligence
provider**; it stays on the server and is used on the coach's screen and in
your tracking form.

Model requests are routed only to endpoints that **do not retain data (Zero
Data Retention) and only to providers operating in the USA or the EU**; the
list is derived from the country data declared by the provider itself, and if
the condition cannot be met the request does not silently fall through to
somewhere else — it returns an error.

Crash reports are filtered before they are sent: user identity, IP, request
body and app logs are removed; client numbers in addresses are masked. Crash
reports do not contain health data.

6. Retention and deletion

• When a client account is deleted, all of its data is deleted, including

measurements, logs, form, consents, photos, device data and messages.

• When a coach account is deleted, if the coach is the only user in the

organization, the entire organization — including client records — is
deleted. If there are other users, the clients are first required to be
transferred to another coach; this way the deletion does not take a
colleague's records with it.

• Deletion is done from within the app, on the settings screen; there is no

need to send an email or wait for support.

• Copies in backups drop out when the backup cycle completes.
• Agreement and consent acceptance records are kept for as long as the related

account exists, because they are the proof of acceptance.

7. Security

Passwords are stored irreversibly. Each organization's data is separated at the
database level; a coach cannot see another coach's client. Photos and files are
served not by a direct address but through a time-limited, signed link. The
connection is encrypted end to end (HTTPS).

8. Rights (KVKK art. 11)

Everyone whose data is processed has the right to learn whether it is
processed, to request information, to learn whether it is used in accordance
with its purpose, to have it corrected, to have it deleted, to learn the
parties to whom it has been transferred, and to request compensation in case
of damage.

For the client, the first point of contact is their own coach — the coach
is the controller of their data. Direct application to the platform: [info@kerteapp.com](mailto:info@kerteapp.com)

9. Age limit

The app is not designed for persons under 18. A record for a client under
18 can be created only by the coach, with the explicit consent of their parent
or guardian.

10. Medical notice

The app is not a medical device; it does not diagnose and does not recommend
treatment. The nutrition and workout content it produces is general-purpose and
does not replace an examination by a physician or dietitian. When a lab result
is entered, the output stays at most at the level of "outside the reference
range, consult a physician".

11. Changes

If this text changes, the version number increases and the previous version
stays in the archive. For material changes, acceptance is requested again.