Data Processing Agreement — version 3

1. Definition of roles

With respect to the client's personal data, **the coach is the data
controller; the platform operator is the data processor**. By registering
their client on the platform, the coach accepts that they assume this role.

This division of roles changes when the client signs up on their own and has
not yet been linked to a coach: at that stage, the data controller is the
platform operator.

2. Scope of processing

Subject	Content
Purpose	Providing the coaching service: preparing programs, tracking, communication
Duration	As long as the coach's account remains open
Data type	Identity, contact, measurements, health statements, program and tracking records
Data subjects	The coach's clients

3. Obligations of the processor

Processes the data only in line with the coach's instructions and the needs

of the service.

Limits access to what duties require; access records are kept.
Transfer and storage are encrypted.
In case of a data breach, notifies the coach without delay.
The use of sub-processors is listed in §4; changes are announced in advance.

4. Sub-processors

Sub-processor	Purpose	Location
Cloud infrastructure provider	Hosting the application and database	Finalized at deployment — the EU region will be chosen
AI marketplace (OpenRouter) and its sub-providers	Program draft generation, interpretation of posture measurements, item estimation from meal photos (with the client's explicit consent)	USA or EU (below)
Error tracking provider	Technical error records	EU

Technical safeguards provided on the artificial intelligence side

These safeguards are not contract text; they are **settings that the code
applies on every request** (backend/app/services/llm/providers/openai_compatible.py):

De-identification. Name, surname, email, phone and date of birth are not

sent; every call passes a machine check. What is sent: age, sex,
measurements, goal, health codes and posture angles calculated on the phone.

Zero data retention (ZDR). Requests are routed only to endpoints that

declare "Zero Data Retention". If there is no such endpoint, the request
returns an error; it does not fall through to a provider that retains
data.

Not used for model training. Requests are sent with

data_collection: deny; a provider that collects data is never used.

Country restriction. The sub-provider list is limited to **the USA and

the EU** (decision of 13 September 2026). The list is derived from
OpenRouter's country data (scripts/saglayici_cografyasi.py); endpoints in
China and Singapore and providers that do not declare their country are
excluded. Details: docs/kvkk/alt-saglayici-yonlendirmesi.md.

Photos are sent only for meals and only under three conditions.

Posture, body and workout photos are never sent under any

circumstances. Posture is measured on the phone (MediaPipe, on-device);
only angle values go to the provider, and only when the coach requests it.

A meal photo is sent only when these three hold together: the feature is

on (VISION_ENABLED), the client has given a **separate explicit
consent** for meal photos (client consent text v3 and later), and an image
model is defined. If one is missing, the request is not built. The image
model is currently Google Gemini (via OpenRouter); if it changes, this
agreement and the client consent text are updated first.

The photo is re-encoded before it is sent; it carries no metadata such as

location. No identity data is sent with the photo.

The feature is off when this agreement enters into force; turning it

on depends on measuring the accuracy of item estimation.

Which sub-provider each call went to is recorded in the
ai_runs.upstream_provider field and can be audited.

5. Client requests

The coach handles the data subject's requests for access, correction and
deletion; the platform provides the necessary technical support (export and
permanent deletion functions).

6. Termination of the agreement

When the service ends, the data is exported to the coach and deleted from the
platform.