STIMORA PRIVACY POLICY AND PERSONAL DATA PROCESSING NOTICE
Version 1.0, effective date: 1 October 2026
1. Data controller
The data controller under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK"):
- ASTMED MEDİKAL GAYRİMENKUL SANAYİ VE TİCARET LİMİTED ŞİRKETİ ("ASTMED");
- İçerenköy Mah. Akça Sk. Akın Apt No: 7 B, Ataşehir / İstanbul, Türkiye;
- Istanbul Trade Registry No. 1133612; Kozyatağı Tax Office No. 0911402438;
- Email: info@stimora.app.
This notice is issued under Article 10 of the KVKK and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform. It covers personal data processed through the Stimora desktop application ("Application") and through the forms on stimora.app and astmedacademy.com.
2. Data processed, purposes and legal grounds
| Data | When | Purpose | Legal ground (KVKK Art. 5) |
|---|---|---|---|
| Name, email; if given, organization, role, country and form message | Trial or download form on the website; trial registration in the Application | Granting the trial, sending the download link, support and contact | Processing directly related to the establishment or performance of a contract (Art. 5/2-c) |
| Device identifier (derived from hardware), computer name, license key, application version | License activation and periodic verification while the Application is open | Verifying the license, controlling the number of devices, preventing unauthorized use | Performance of a contract (Art. 5/2-c); legitimate interest (Art. 5/2-f) |
| Usage statistics: event type, screen names, time on screen, session identifier, device identifier, version, operating system, language, license type; an "active" signal once a minute | While the Application is open | Product improvement, active user counting | Legitimate interest (Art. 5/2-f) |
| Error report: error message and stack trace, screen, uptime, last clicked elements (at most 8, including short element text), in-app trace records (at most 12), device identifier, version, operating system, language | When an error occurs | Finding and fixing errors | Legitimate interest (Art. 5/2-f) |
| Feedback: message, email, attached screenshots, version, operating system, device identifier, license type, language | If the user sends it | Answering the request | Performance of a contract (Art. 5/2-c); legitimate interest (Art. 5/2-f) |
| Training progress: completed modules and scores, exam results, badge count, device identifier, version, license type, role, institution name | On licensed devices | Training tracking; reporting to the institution's authorized person for institutional licenses | Performance of a contract (Art. 5/2-c) |
| Live training (LiveLink) session data | If LiveLink is used | Real-time relay between instructor and participants | Performance of a contract (Art. 5/2-c) |
| Email address and name (service messages) | After a form is submitted and during the license term | Download link, installation, use, update and license information | Establishment and performance of a contract (Art. 5/2-c). Under Article 6/1 of the Regulation on Commercial Communication and Commercial Electronic Messages, these messages do not require separate consent. |
| Email address and name (promotional messages) | Only if consent was given; the statutory exception for merchant and tradesperson recipients is reserved | Promotion of products and services, campaigns and news | Consent to commercial electronic messages (Law No. 6563, Art. 6) and explicit consent (Art. 5/1). Consent may be withdrawn at any time. |
The legitimate interest relied on for usage statistics and error reports is balanced by these limits: this data contains no name or email and is linked only to a pseudonymous device identifier; no screen content or clinical data is collected (except the short element texts in error reports); it is not used for advertising or profiling and is assessed only to improve the product and fix errors.
The Application is not designed for real patient data or for special categories of personal data such as health data; users are asked not to enter patient data into the Application. Feedback text, attached screenshots and short element texts in error reports may carry content the user sees or types on screen; this content is under the user's control. No decision is taken about you based solely on automated processing.
3. Transfers
Personal data may be transferred, limited to the purposes above, to:
- Hosting (in Türkiye): the application server (api.astmedacademy.com, dl.astmedacademy.com) and the stimora.app website run on servers hosted in data centers in Türkiye.
- Email delivery (abroad): Brevo (Sendinblue SAS, France; data is processed on servers in the European Union). Data transferred: name, email address and message content.
- Email service (abroad): Google (Gmail and Google Workspace; Google LLC and its affiliates, with servers in several countries including the United States). Data transferred: correspondence and feedback emails.
- Administrator notifications (abroad): Telegram (servers in several countries). New registrations, trial starts and error summaries are sent to the administrator as instant notifications; a notification is limited to a summary of the record concerned (for example name, email, organization, country or error message).
- Real-time relay (abroad): Ably (Ably Real-time Ltd, United Kingdom; data centers in Europe, the United States and Asia-Pacific). Data transferred: LiveLink session data.
- For institutional licenses: the authorized person of the licensing institution (training progress).
- Where legally required: competent public authorities and courts.
Transfers abroad are made under KVKK Art. 9. Where the Personal Data Protection Board has issued an adequacy decision for the recipient's country, the transfer relies on that decision. Where there is no adequacy decision, the transfer is made with one of the appropriate safeguards under Art. 9/4, in particular by signing the standard contract announced by the Board and notifying it to the Personal Data Protection Authority within five business days of signature. Incidental transfers for which no appropriate safeguard can be provided are made only in the cases listed in Art. 9/6, for example where the transfer is necessary for the establishment or performance of a contract with the data subject, or where the data subject has given informed explicit consent.
4. Method of collection
Data is collected electronically, partly by automated means, through the website forms, the registration and feedback screens of the Application, and the automatic transmissions of the Application listed above. The legal grounds are stated separately for each data group in the table in Section 2.
5. Retention
Data is kept for as long as the processing purpose requires and for the periods required by law; when the period ends it is deleted, destroyed or anonymized:
- Trial registration and website form data (not converted to a license): 2 years from the end of the trial or from the last contact.
- License records (license key, device identifier, computer name, activation details) and sales records: for the license term and 10 years after it ends (general limitation period under Article 146 of Turkish Code of Obligations No. 6098; retention obligation under Article 82 of Turkish Commercial Code No. 6102).
- License verification records: 2 years from the date recorded.
- Usage statistics: at most 2 years from collection. Aggregate statistics that cannot be linked to a person may be kept after that period.
- Error reports: 1 year from the date recorded.
- Feedback and support correspondence: 2 years from the resolution of the request.
- Training progress: for the license term and 2 years after it ends.
- LiveLink session data: not stored on ASTMED servers; held by the relay provider only briefly for delivery (about 2 minutes under the provider's default setting).
- Consent and opt-out records for commercial electronic messages: 3 years from the end of the consent's validity (Regulation on Commercial Communication and Commercial Electronic Messages, Art. 13).
If a dispute, investigation or official request arises within the retention period, the relevant data may be kept until it is concluded. Data whose period has expired is deleted through periodic destruction carried out at intervals of no more than six months, under the Regulation on the Deletion, Destruction or Anonymization of Personal Data.
6. Your rights (KVKK Art. 11)
Regarding your personal data, you have the right to:
- learn whether it is processed;
- request information if it is;
- learn the purpose of processing and whether it is used accordingly;
- know the third parties in Türkiye or abroad to whom it is transferred;
- request correction if it is incomplete or inaccurate;
- request deletion or destruction under the conditions of KVKK Art. 7;
- request that corrections and deletions be notified to third parties to whom it was transferred;
- object to a result against you arising exclusively from analysis by automated systems;
- claim compensation for damage arising from unlawful processing.
Under the Communiqué on the Procedures and Principles of Applications to the Data Controller, you may send your request in writing to the postal address above, or to info@stimora.app from an email address you have previously given us and that is registered in our system. The request must state your name, surname, contact address and the subject of the request. Requests are answered free of charge within 30 days at the latest; if the action requires an additional cost, the tariff set by the Personal Data Protection Board may apply. If your request is rejected, you find the answer insufficient or no answer is given in time, you may file a complaint with the Personal Data Protection Board under KVKK Art. 14.
You may also ask at info@stimora.app that usage statistics not be processed for your device; your request will be assessed and you will be informed of the outcome. You may stop promotional emails at any time through the unsubscribe link in each message or by writing to info@stimora.app.
7. Security
ASTMED takes appropriate technical and administrative measures under KVKK Art. 12 to protect personal data against unauthorized access, loss and alteration. Examples:
- encrypted connections (HTTPS) between the Application and the server;
- an encrypted license file on the device;
- signed update verification;
- access to the administration panel limited to authorized persons.
8. Cookies
The stimora.app website does not use advertising, analytics or third-party tracking cookies. The site may use technical cookies of the LiteSpeed cache infrastructure, such as "_lscache_priv", and the session cookies WordPress uses only for logged-in site administrators. These cookies are necessary for the site to work and do not require explicit consent under the Personal Data Protection Authority's Guide on Cookie Practices. The site loads fonts from the Google Fonts service; when it does, your browser's IP address is sent to Google. The desktop Application does not use cookies; it keeps its settings and license file only on your device.
9. Changes
This notice may be updated; the current version and its effective date are published at https://stimora.app/privacy/. Significant changes are also announced in the Application. This notice is published in Turkish, English and Arabic; in case of conflict between the texts, the Turkish text prevails.