Personal Data Protection Notice

Data controller

Under Turkish Law No. 6698 (KVKK) the data controller is: MARSALA YAZILIM ANONİM ŞİRKETİ — MERSIS 0612174867800001. Address: Bilişim Vadisi İzmir, Gülbahçe Mh. İçmeler Cad. No: 14/1 İç Kapı No: B05, Urla / İzmir, Türkiye.

Contact: [email protected]

VERBIS registration: The company has fewer than 50 employees and is therefore not required to register with the Turkish data controllers’ registry.

What data we process

Your health and care records are processed only as you enter them. The records you may enter are:

• Baby profile: name, date of birth, sex, prematurity/due-date information, optional photo.
• Care tracking: feeding, formula, diaper, sleep, growth measurements, temperature, medication, solids, water, vomiting and free notes.
• Health records: illness episodes, diagnosis notes, medication plan, questions for the doctor.
• Maternal health: postpartum/breastfeeding records and notes.
• Pregnancy: nickname, due date, last menstrual period, pre-pregnancy weight, height, multiple-pregnancy flag, kick/contraction/weight/blood-glucose measurements.
• Journal: mood, free text, tags and photos.
• Memories and activity logs: title, note, date, photo.
• Reminders: title and time.
• Shop: cart, favourites, delivery address (name, phone, address), orders and bookings.
• If you create an account, depending on the sign-in method you choose: your e-mail address or your mobile number. With Apple or Google sign-in we receive that account’s e-mail address (Apple’s relay address if you choose "Hide My Email"); we do not ask for your name.
• Ad measurement (not entered by you, generated automatically): the device advertising identifier (on iOS only if you allow it), device model, OS and app version, install/launch time and event names such as "registration completed" or "subscription started". None of your health records is part of this.

Special category data and children’s data

Most of the above is health data and counts as "special category personal data" under KVKK Art. 6. It is kept on your device only; sending it to the cloud requires your separate, explicit consent, which you may withdraw at any time.

Some records belong to your baby/child. You enter them as the child’s parent/guardian and give consent on their behalf. The app is not directed at children; the user is the parent.

Nursea is not a medical device, does not diagnose and does not replace a doctor’s examination.

Purposes of processing

• Showing your records back to you (summaries, charts, calendar, reports and shareable PDFs).
• Scheduling reminder notifications on your device.
• Backing up and restoring your records if you ask for it.
• Fulfilling a shop order or booking you placed.
• Verifying entitlement if you purchased a subscription.
• Measuring whether our own ad campaigns lead to installs and subscriptions (Meta ad measurement).
• Meeting legal obligations.

Legal basis and collection method

Health and care data is collected only by you entering it into the app. The only thing collected automatically in the background is the technical event data listed above, produced by the Meta SDK for ad measurement.

Legal bases: explicit consent under KVKK Art. 6/2 for health data; Art. 5/2-c (performance of a contract) for orders and subscriptions; Art. 5/2-ç where a legal obligation applies; explicit consent under Art. 5/1 and Art. 9 for ad measurement and the transfer to Meta — it starts when you accept this notice, and on iOS the system additionally asks for tracking permission.

Transfers

We do not sell your data. The app shows no ads and your health records are never shared with any ad network. Only the limited technical event data listed above is transferred to Meta Platforms Ireland Ltd. (Facebook SDK) to measure our own ad campaigns; this is a cross-border transfer under KVKK Art. 9 and rests on your explicit consent.

If backup is on, your records are stored on our hosting provider’s servers. Server location: Supabase — European Union (Ireland). This is a cross-border transfer under KVKK Art. 9; you are separately informed and asked for explicit consent when you turn backup on.

If you sign in with your phone, your mobile number is passed to our SMS provider Twilio Inc. (USA) to send the verification code. This is a cross-border transfer under KVKK Art. 9; the number is not used for anything else.

If you buy a subscription, payment is handled by the Apple App Store or Google Play; we never see your card details.

If you place a shop order, delivery details are shared with the courier/supplier.

Lawful requests from competent public authorities are reserved.

Retention

Your records are kept until you delete them. When you turn backup off, your records on the server are deleted immediately.

Order and invoice records may be retained for the period required by applicable law.

Ad-measurement events transferred to Meta are subject to Meta’s own retention rules (facebook.com/privacy/policy).

Your rights (KVKK Art. 11)

You can exercise most of these rights directly in the app: Profile → Privacy and my data → "Export my data" and "Delete all my data". For other requests: [email protected]

• Learn whether your personal data is processed and request information about it.
• Learn the purpose of processing and whether it is used accordingly.
• Know the third parties to whom it is transferred, at home or abroad.
• Request correction if incomplete or inaccurate.
• Request erasure or destruction.
• Request that corrections/erasures be notified to third parties.
• Object to a result against you produced solely by automated analysis.
• Claim compensation for damages caused by unlawful processing.