DRUGTERN PRIVACY POLICY

Last Updated: August 23, 2026 Effective Date: August 23, 2026

1. Introduction

At Drugtern, we attach great importance to the privacy of our users and the protection of their personal data.

This Privacy Policy explains what information may be collected while you use the Drugtern mobile application (“Drugtern”, “Application”), the purposes for which such information is processed, how it is stored, with which service providers it may be shared, and your available rights regarding your personal data.

Drugtern is a personal learning and knowledge management application that enables students studying in the healthcare field—primarily pharmacy students—and healthcare professionals to record, organize, and review information regarding medicines they encounter during their internships, education, or professional learning processes through learning tools such as flashcards.

Drugtern is not a healthcare service, patient registry system, electronic health record, prescription system, or clinical decision support system.

Drugtern is an application accessible globally. Accordingly, this Privacy Policy has been prepared in accordance with Law No. 6698 on the Protection of Personal Data (“KVKK”) for users in Türkiye; relevant general data protection legislation (“GDPR” and its equivalents) for users in the European Economic Area, the United Kingdom, and Switzerland; the California Consumer Privacy Act / California Privacy Rights Act (“CCPA/CPRA”) for users in California; and applicable data protection legislation in other jurisdictions where users are located. The specific provisions applicable to you may vary depending on your country of residence; however, Drugtern aims to apply the same core privacy standards to all its users.

By using the Application, you acknowledge that you have been informed about the data processing activities described in this Privacy Policy.

2. Data Controller

With respect to personal data processed within the scope of Drugtern, the data controller is:

Name / Title: Şükrü Esad DURDURAN
Contact Email: drugtern.esad@gmail.com
Country: Türkiye

You may contact us regarding your personal data or this Privacy Policy via the contact address provided above.

Data Controllers Registry (VERBİS): The data controller assesses the exemption criteria (annual employee count and/or data processing volume thresholds) determined by the Turkish Personal Data Protection Board regarding the obligation to register with VERBİS. In the event that a registration obligation arises, relevant registration procedures will be completed, and this Privacy Policy will be updated accordingly.

European Economic Area Representative: Drugtern does not maintain an establishment in the European Economic Area (“EEA”). If it is determined necessary to designate an EEA representative pursuant to Article 27 of the GDPR, the contact details of such representative will be published in this Privacy Policy. At this stage, users in the EEA may direct their requests to the contact address specified in Section 2.

3. Information That May Be Collected

Drugtern only intends to process data necessary for the operation of the application, management of the user account, storage of data associated with the user, and delivery of the core features of the application.

3.1. Account and Identity Information

When you create a Drugtern account or make changes to your account, the following information may be processed:

first and last name,
email address,
user role or profile information within the application,
user-specific account identifier,
account creation and session information.

Your password is not viewed in plain text or manually stored by Drugtern. Authentication processes are carried out via the Firebase Authentication infrastructure.

4. Sign-In with Google and Apple

Drugtern may offer the following third-party authentication methods to allow users to create an account or sign in:

If you choose to sign in via your Google or Apple account, limited account information that you authorize the relevant service provider to share with Drugtern may be received. Depending on the sign-in method used and user preferences, this may include: first name, last name, email address, provider-specific user identifier.

If Apple's "Hide My Email" feature is used, Drugtern may receive the relay email address generated by Apple instead of your actual email address.

Data processing activities conducted by Google and Apple within the scope of their own services are subject to the respective companies' own privacy policies.

5. User-Generated Content

The primary purpose of Drugtern is to enable users to store in their personal archives the drug information they learn. In this context, the following types of content may be created by the user:

drug name
active ingredient
pharmacological group
indication information
contraindication information
side effects
dosage information
mechanism of action
user notes
custom categories created by the user
selectable or multi-selectable category options
favorite drugs
in-app data regarding learning and flashcard usage

This information is processed primarily to create the user's personal pharmacology archive, synchronize it across different devices, and provide the learning features of the application.

Drugtern does not verify the medical accuracy of drug information entered by the user and does not provide such content as an independent source of medical information.

6. Patient and Third-Party Health Data

Drugtern is not a patient registry system. Users are not expected to enter:

patient first or last name,
national identification number,
patient contact information,
prescription details,
diagnosis or disease information that makes an individual identifiable,
patient-specific treatment information,
patient-specific medication history,
other personal data or special category personal data belonging to third parties

into the application.

The free-text fields in Drugtern are provided solely for users to create their own learning notes.

If a user enters personal or health data belonging to a third party at their own discretion, such use is outside the intended scope of Drugtern. In such a case, the user must delete the relevant data without delay.

Drugtern does not intend for users to create a patient database consisting of third-party health data, and does not use such data for purposes of diagnosis, treatment, profiling, advertising, or clinical decision-making.

7. Purposes of Processing Data

Collected personal data may be processed for the following purposes:

creating and managing user accounts,
ensuring secure user authentication and login,
creating and updating user profiles,
storing the drug archive created by the user,
organizing drug records and presenting them back to the user,
storing favorites and customized category options,
providing flashcard and learning features,
synchronizing data across the user's devices,
maintaining the application experience where offline use is supported,
ensuring account security,
preventing abuse and unauthorized access,
fulfilling user requests for account or data deletion,
ensuring the technical operation of the application,
fulfilling legal obligations.

Your personal data is not used for any purposes incompatible with these objectives.

8. Drugtern Does Not Create Medical Profiles

Drugs recorded in Drugtern are not evaluated as medications used by the user. The fact that a user has added a specific drug to their personal archive does not mean: that the user uses this drug, that the user has any disease, that the user is undergoing any treatment, or that the user has a specific health condition.

Drugtern does not create a health profile about the user based on the drugs recorded by users, does not attempt to make a diagnosis, and does not draw inferences regarding health status.

9. Sharing of Personal Data with Third Parties

Drugtern does not share personal data belonging to users with any third parties. Personal data is not sold to advertisers, and users' personal drug archives are not shared with third parties for commercial advertising profiling purposes.

However, certain service providers are utilized to ensure the technical operation of the application.

Google Firebase

Firebase services provided by Google are utilized in certain parts of Drugtern's account and data infrastructure. Depending on the version of the application, the services utilized may particularly include Firebase Authentication and Cloud Firestore.

Firebase Authentication is used to carry out user authentication. Cloud Firestore may be used to store user profiles and personal application data created within Drugtern in the cloud environment and to synchronize them across devices.

Data processing activities conducted by Google/Firebase are subject to the terms of service, data processing terms, and security measures of the respective services. For international data transfers under the GDPR, Google provides a Data Processing Addendum based on Standard Contractual Clauses adopted by the European Commission; while utilized as a transfer mechanism under the GDPR, this is independent of the explicit consent requirement under the KVKK described in Section 10 below.

10. International Transfer of Data

Servers or technical operations of third-party infrastructure providers utilized by Drugtern (specifically Google Firebase) may be located outside Türkiye, primarily in the European Union and the United States. Therefore, your personal data may technically be processed or stored in systems located outside Türkiye.

Pursuant to Article 9 of Law No. 6698 governing cross-border data transfers, personal data may be transferred, respectively: (i) to countries declared to have an adequate level of protection by the Personal Data Protection Board (“Board”), (ii) to relevant countries where appropriate safeguards, such as a Board-approved undertaking or standard contract, are provided, or (iii) in exceptional and incidental cases where neither route is possible, by obtaining the explicit consent of the data subject after informing them of potential risks.

With respect to infrastructure providers utilized by Drugtern, an adequacy decision has not yet been declared by the Board for destination countries, and a Board-approved undertaking process has not been completed at this stage. Therefore, the transfer of your personal data abroad is carried out pursuant to the exceptional mechanism provided under Article 9 of the KVKK, based on your explicit consent granted following the information provided to you.

In this context, upon account creation or initial use, separate and explicit consent is requested regarding the transfer of your data abroad via Google Firebase infrastructure. This consent is presented as an independent checkbox checked voluntarily by the user, distinct from general acknowledgment of the Privacy Policy, and is never pre-selected. You may withdraw your explicit consent at any time via account settings or by applying to the contact address specified in Section 22; please note that upon withdrawing consent, certain services that rely on cloud synchronization and infrastructure stored abroad may no longer be available.

Transfers regarding users in the European Economic Area are furthermore conducted under Google's GDPR-compliant data processing terms based on Standard Contractual Clauses.

Drugtern may change the infrastructure providers and data transfer mechanisms utilized when necessary. If such a change has a significant impact on users' privacy, this Privacy Policy will be updated and, where required, your renewed consent will be requested.

11. Data Retention

Your personal data may be retained for as long as your Drugtern account is active and as necessary to provide the services of the application.

Drug records and other personal application content created by the user may be stored until deleted by the user or until the account is completely removed.

When you delete your account, the necessary process is initiated to remove personal data associated with your account and user-generated content from active Drugtern systems. Due to technical backup systems, security logs, or data recovery mechanisms of service providers, the complete elimination of certain data may take a certain period of time.

Where there is data required by law to be retained, it may only be retained for the relevant statutory retention period.

12. Account and Data Deletion

Drugtern users may delete their accounts via the profile settings within the application. When the account deletion process is completed, it is intended that Drugtern data associated with your account will be deleted. In this context, data associated with the account, including profile information, drug records, favorites, categories and options created by the user, and other application data linked to the account are included in the deletion process.

Users may also submit requests regarding their personal data to drugtern.esad@gmail.com.

13. Offline Data and Information Stored on Device

Certain features of Drugtern may function even when there is no internet connection. For this reason, certain application data is stored temporarily on the device or within local cache. Following the restoration of an internet connection, eligible data is synchronized with the Firebase infrastructure.

Uninstalling the application from the device may delete certain data located locally on the device; however, in order to completely delete data associated with the cloud account, the in-app account deletion feature in Drugtern must be used.

14. Advertising and Tracking

Drugtern does not use users' personal drug records for advertising purposes. Drugtern does not intend to track users' behavior across applications and websites for advertising purposes.

If advertising, third-party ad networks, or cross-user tracking mechanisms are introduced in Drugtern in the future, this Privacy Policy and necessary application permissions will be updated accordingly.

15. Data Security

Reasonable technical and organizational security measures are implemented to protect personal data against unauthorized access, loss, theft, misuse, alteration, or disclosure. Appropriate authentication and data access rules are employed within Drugtern's cloud infrastructure to segregate user data from one another and ensure that only authorized users can access their own data.

Nonetheless, no method of data transmission over the internet or electronic data storage can guarantee absolute security. Users are also responsible for their own account security and must not share their account credentials with third parties.

16. Children's Privacy

Drugtern is primarily intended for students studying in the fields of pharmacy and healthcare, as well as professionals working in these fields. Drugtern is not designed to collect personal data from children.

In the event that users in an age group requiring parental or legal guardian consent under applicable legislation use the application, relevant statutory requirements are applied. For users in the United States, Drugtern does not knowingly collect personal data from children under the age of 13 under the Children's Online Privacy Protection Act (“COPPA”); for users in the European Economic Area, the age of consent established under relevant national legislation applies.

If it is noticed that personal data belonging to a child has been collected without fulfilling necessary legal prerequisites, appropriate actions are taken to delete such data.

17. Rights of Users in Türkiye (KVKK)

Users in Türkiye, subject to the fulfillment of statutory conditions under Article 11 of Law No. 6698 on the Protection of Personal Data, may particularly have the right to:

learn whether their personal data is being processed,
request information if their personal data has been processed,
learn the purpose of processing personal data and whether it is used in accordance with its purpose,
know the third parties to whom personal data is transferred,
request the rectification of incomplete or inaccurate personal data,
request the erasure or destruction of personal data subject to statutory conditions,
request notification of rectification or erasure operations to third parties to whom data has been transferred,
object to the occurrence of a result against the person by means of analysis conducted exclusively through automated systems under statutory conditions,
claim compensation for damages in the event of suffering damage due to unlawful processing of personal data,
withdraw given explicit consent at any time with prospective effect.

Requests regarding these rights may be submitted to Drugtern via drugtern.esad@gmail.com. Requests will be evaluated and concluded within statutory timeframes in accordance with applicable legislation. If your request is rejected by the data controller, found insufficient, or not responded to in due time, you have the right to lodge a complaint with the Personal Data Protection Board pursuant to Article 14 of the KVKK.

18. Rights of Users in the European Economic Area, the United Kingdom, and Switzerland (GDPR)

With respect to users located in the European Economic Area (“EEA”), the United Kingdom, or Switzerland, provisions of the General Data Protection Regulation (GDPR) and equivalent legislation are also taken into account to the extent applicable.

18.1. Legal Bases for Processing

Depending on the purpose of processing, your personal data is processed based on the following legal grounds:

Account creation, authentication, storage of drug archives, and cross-device synchronization: necessary for the performance of the contract between the user and Drugtern (GDPR Art. 6(1)(b)),
Ensuring account security, preventing abuse, and combating fraud: legitimate interests of Drugtern (GDPR Art. 6(1)(f)),
International transfer of personal data and use of optional features: your explicit consent (GDPR Art. 6(1)(a)),
Compliance with legal obligations under applicable legislation: compliance with a legal obligation (GDPR Art. 6(1)(c)).

18.2. Your Rights

Under the GDPR, to the extent applicable, you may have the following rights:

right to request access to your personal data,
right to request rectification of inaccurate or incomplete data,
right to request erasure of your personal data (“right to be forgotten”),
right to request restriction of processing under certain conditions,
right to receive your data in a structured, commonly used format and transmit it to another controller (data portability),
right to object to processing based on legitimate interests,
right to withdraw consent at any time for consent-based processing,
right to lodge a complaint with a supervisory authority in the country where you reside.

To exercise these rights, you may contact us at drugtern.esad@gmail.com. Your request will be answered within a reasonable period of time.

18.3. International Transfers

Data of users in the EEA may be transferred to Türkiye and other countries where Google Firebase infrastructure is located. These transfers are conducted under Google's data processing terms based on Standard Contractual Clauses approved by the European Commission. See Section 10 for additional details.

19. Rights of California Users (CCPA/CPRA)

Users residing in California may have the following rights under the California Consumer Privacy Act and California Privacy Rights Act (“CCPA/CPRA”):

right to know the categories of personal data collected about you and the sources of such data,
right to request the deletion of your personal data,
right to request the correction of inaccurate personal data,
right to opt out of the sale or sharing of your personal data (“Do Not Sell or Share My Personal Information”),
right not to receive discriminatory treatment for exercising these rights.

Drugtern does not sell users' personal data and does not share it with third parties for advertising purposes; therefore, an opt-out mechanism for data sale/sharing is currently not applicable. For your requests, you may contact us at drugtern.esad@gmail.com; following reasonable verification of your identity, your request will be answered within statutory time limits.

20. Disclaimer Regarding Health and Medical Information

The primary purpose of Drugtern is education and personal knowledge management. Drugtern does not: make diagnoses, recommend treatments, issue prescriptions, select medications specific to a user or patient, determine dosages specific to a user or patient, or substitute for the clinical judgment of a healthcare professional.

Drug information within Drugtern is primarily generated by users during their own learning processes. Therefore, the accuracy, currency, or completeness of information in the application is not guaranteed. Information stored in Drugtern must not be used as a substitute for professional medical assessment or reliable, up-to-date medical sources.

21. Automated Decision-Making and Profiling

Drugtern does not use personal data to make automated decisions that produce legal or similarly significant effects concerning users. No profile is created regarding a user's health status, illnesses, or medication history based on the drugs recorded by users.

22. Non-Disclosure of Data

Drugtern does not disclose users' personal data to third parties. Users' personal drug archives, notes, favorites, or other user-generated content are not provided as a data source to advertisers.

23. Governing Law and Jurisdiction

In the interpretation and application of this Privacy Policy, the laws of the Republic of Türkiye shall apply, subject to mandatory data protection provisions in the country where the user is located. The Central (Istanbul) Courts and Enforcement Offices shall have jurisdiction over the resolution of disputes. Users who qualify as consumers retain their rights arising from mandatory consumer and data protection laws of their own countries.

24. Changes to the Privacy Policy

This Privacy Policy may be updated in the event of changes to Drugtern's features, the technologies it uses, or applicable legislation. If material changes are made, users will be informed within the application or by another appropriate method; where necessary, your explicit consent will be requested anew.

The effective date of the current version of the Policy is specified at the top of the document. Users should review the current version of the Privacy Policy from time to time.

25. Contact

You may contact us regarding any questions, requests, or complaints concerning this Privacy Policy, your personal data, or your privacy rights.

Drugtern Data Controller: Şükrü Esad DURDURAN Email: drugtern.esad@gmail.com Country: Türkiye