Effective: 30.07.2026 · Version: v1.0
GraftTrack is a mobile app built to help patients who have had a hair transplant operation follow their post-operative care process. The app is developed by ÖzgürKod and published on Google Play; the party providing the service to the patient is the clinic that performed the patient's operation.
This policy explains which data the app processes, which data it does not process, where this data is stored and how you can exercise your rights.
| Party | Role | What it does |
|---|---|---|
| Your clinic | Data controller | Owns and is responsible for your health data. The clinic sets your care protocol, your photo assessments and the messages sent to you. The clinic decides the retention period and the decision to delete. |
| ÖzgürKod | Data processor | Provides the software and infrastructure. It processes your data only under the clinic's instructions and within the framework of this policy; it does not use it for its own purposes, does not sell it and does not use it for advertising. |
If you have a request about your health data, you must apply to your clinic first. ÖzgürKod handles such requests as directed by the clinic.
The table below lists all the data the app processes.
| Data | Source | Why |
|---|---|---|
| First name, last name | Comes from your clinic record | To address you in the app and let the clinic recognize you |
| The last 4 digits of your phone number | You enter it at sign-in | Authentication. The full number is already on file at your clinic; the app does not ask you for the number and does not display it on screen. |
| Surgery details (date, number of grafts, transplant area, technique, physician, session number) | Comes from your clinic record | To set the starting point of your calendar and show you the right care steps |
| Task checkmarks (which care step you did and when) | You check them off in the app | To keep your follow-up going and let the clinic see your compliance status |
| Photos (scalp area, 6 angles) | You take them with the in-app camera | So the clinic can evaluate your healing. Processed only with your explicit consent; if you do not give consent, this section does not work. |
| Symptom answers (your answers in the “Is this normal?” flow) | You answer them in the app | To show the guidance set by the clinic and pass the result on to the clinic |
| Your messages with the clinic | You write them in the app | Communication with your clinic |
| Notification token (FCM), device platform (Android/iOS), language, time zone | Collected automatically from your device | To send reminders at the right time and in the right language |
| IP address, device fingerprint, request logs | Generated automatically | Security: abuse detection, rate limiting, session theft detection |
These are not missing features but deliberate decisions:
GraftTrack does not make medical diagnoses. No automated or AI analysis is performed on your photos. Every clinical assessment you read in the app is text written by a person at the clinic.
The “Is this normal?” flow is not a learning model either: it applies the rules your clinic defines in its panel. The app does not produce automated decisions that have legal consequences for you or significantly affect you.
Information in the app does not replace medical advice.
Your data is not sold. Only the infrastructure providers below, which are needed for the service to work, are used:
| Provider | What for | What data |
|---|---|---|
| Amazon Web Services (S3) | Photo archive | Photos you upload |
| Google (Firebase Cloud Messaging) | Notification delivery | Device notification token and notification text |
| Our hosting provider | Server and database | All data listed above |
Apart from these, your data is shared only in the event of a legal obligation and upon a duly made request from the competent authority.
Under KVKK, health data is special category personal data, and processing it requires explicit consent. The app keeps consents separate from one another:
If there is no consent record, the system assumes consent was not given. You can view your consents in the app under Profile → Privacy and withdraw them at any time.
Under Article 11 of KVKK (Turkey's personal data protection law), you have the right to access your data, request that it be corrected, request that it be deleted, and object to its processing. The app lets you exercise most of these rights directly:
| Your right | Where in the app |
|---|---|
| See my data | Profile screen — your treatment file, task history and photos are visible |
| Withdraw my consent | Profile → privacy |
| See / sign out my logged-in devices | Profile → privacy → my devices |
| Request deletion of my data | Profile → Privacy → Data deletion request |
| Correction request | Contact your clinic (the clinic is the data controller) |
Your deletion request is forwarded to your clinic. The clinic fulfills the request to the extent permitted by its retention obligations under health legislation; if it cannot, it notifies you with the reason.
You can request deletion of your account and data in two ways:
Data that is deleted: your app account, session and device records, notification token, photos you uploaded, task check-offs, symptom responses and in-app messages.
Data that cannot be deleted: your clinic's patient record and medical file are independent of the app and remain at the clinic for the retention periods required by health legislation. To have these records deleted, you must contact your clinic; by law, the clinic may not be able to fulfill this request.
Timeframe: your request is concluded within 30 days at the latest and you are notified in writing.
| Permission | What it is requested for | If you decline |
|---|---|---|
| Camera | Taking follow-up photos and scanning the invitation QR code | Photo and QR features do not work; the rest of the app works. You can enter the invitation code manually. |
| Notifications | Aftercare step reminders and your clinic's replies | You do not receive notifications; you see your steps by opening the app. |
| Internet | Communication with your clinic's server | — |
GraftTrack is not intended for users under 18. The app is used only by adult patients who have had the procedure and were invited by their clinic. We do not knowingly collect data from anyone under 18.
No system can offer absolute security; if you notice a security vulnerability, let us know.
When we update the policy, the version number and effective date on this page change. If there is a significant change, you are notified in the app.
For privacy questions about the app: ozgurkod.com/iletisim
For requests about your health data, contact your clinic first — your clinic is the data controller for your health data.