Privacy Policy
Last updated: 14 September 2026
This policy explains how the Ecza Dolabı mobile app processes your personal data. The app operates under the Turkish Personal Data Protection Law No. 6698 (KVKK) and the EU General Data Protection Regulation (GDPR).
1. Data controller
NB Bilişim
Email: destek@nbbilisim.com
Contact for users in the European Economic Area (EEA), the United Kingdom and Switzerland: NB Bilişim, Karaağaç Mah. İpekçilik Cad. No:49/B, Yıldırım, 16360 Bursa, Türkiye. Email: destek@nbbilisim.com. You can send all requests under the GDPR to these contact details.
2. Data we process
| Category | Content | Purpose |
|---|---|---|
| Account details | Email address, display name (optional), profile picture (if you upload one), user ID. If you sign in with Apple or Google, the name and email address that provider shares (Apple's relay address if you choose to hide your email) | Creating your account, signing you in and syncing your data across devices |
| Consent record | The dates on which explicit consent for your health-related data was given and withdrawn, and the version of the privacy notice you agreed to | Documenting your consent, acting on a withdrawal and asking again when this notice changes |
| Health-related data | Name, active ingredient, barcode, expiry date and quantity of the medicines you add, your notes, your reminder times and the doses you mark as taken | The app's core function: listing your cabinet and producing expiry and dose reminders |
| Family sharing | The email address you send an invitation to, linked account IDs, the medicines you choose to share | Sharing your cabinet with the people you choose |
| Subscription status | Active subscription type, plan and end date | Unlocking the Premium and Ad-free features |
| Technical and advertising data | Advertising identifier, your ad consent choice (in the EEA, the UK and Switzerland), approximate location at country or region level, device and app information | Showing ads in the free version and diagnosing errors |
Important: Your health-related data, including your medicines and reminders, is never used for ad targeting, is not shared with ad networks and is not sold.
3. Using the app without an account
You can use the app without creating an account. Your data is then stored only locally on your device and is not sent to our servers. If you later create an account or sign in and give your explicit consent, the data on your device is transferred to your account.
4. Legal basis
- Performance of a contract: managing your account and providing the features you request (KVKK Art. 5(2)(c), GDPR Art. 6(1)(b)).
- Explicit consent: health-related data is a special category of personal data and is processed only when you enter it in the app yourself and with your explicit consent (KVKK Art. 6, GDPR Art. 9(2)(a)). You give consent when you create your account or on your first sign-in. You can withdraw it at any time in the app under Settings › Withdraw explicit consent: your medicine, reminder and dose records on our servers are then deleted and your account is kept. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal. You can also write to destek@nbbilisim.com or delete your account.
- Legitimate interests: security, abuse prevention and error diagnosis (KVKK Art. 5(2)(f), GDPR Art. 6(1)(f)).
- Consent: showing personalised ads (GDPR Art. 6(1)(a)). In the EEA, the UK and Switzerland we ask for your consent through Google's certified consent management platform before showing ads, and the option to refuse is on the first screen. You can change your choice at any time under Settings › Ad privacy options, or remove ads entirely with a subscription.
5. Service providers
We do not sell your data. We use the following providers to run the service:
| Provider | Purpose | Data location |
|---|---|---|
| Supabase | Hosting account, medicine and reminder data | European Union (Frankfurt, Germany) |
| Google AdMob | Showing ads in the free version and managing ad consent | USA and worldwide |
| Google Play Billing and Apple App Store | Processing subscription purchases | USA and worldwide |
| Apple (Sign in with Apple) | Verifying your identity if you choose to sign in with Apple | USA and worldwide |
| Google (Sign in with Google) | Verifying your identity if you choose to sign in with Google | USA and worldwide |
| RevenueCat | Verifying and managing subscription status | USA and worldwide |
We may also disclose data where a legal obligation or a request from a competent authority requires it, to the extent the law requires.
6. International transfers
Your medicine and account data is hosted on servers inside the European Union. The advertising, subscription and sign-in providers are based in the USA. These transfers take place under KVKK Art. 9 and Chapter V of the GDPR, on the basis of the providers' standard contractual clauses.
7. Retention
- Your account and medicine data is kept for as long as your account is active.
- If you withdraw your explicit consent, your medicine, reminder and dose records are deleted immediately; the consent record is kept to document the withdrawal for as long as your account exists.
- Following a deletion request, data is permanently deleted within 30 days at the latest.
- Records the law requires us to keep (for example purchase and billing records) are kept for the statutory period.
- When you use the app without an account, data exists only on your device and is deleted when you uninstall the app.
8. Security
- All data in transit is encrypted with HTTPS/TLS.
- Row-level security (RLS) is enforced in the database. Each user can access only their own data and data explicitly shared with them.
- Subscription and premium status is updated only on the server and cannot be changed from the app.
- The consent history is written only by the server and cannot be changed from the app.
9. Your rights
Under KVKK Art. 11 and GDPR Arts. 15 to 22 you have the right to access your data, to have it corrected, to request its deletion, to restrict processing, to object to processing, to receive your data in a portable format and to withdraw your consent. Send your requests to destek@nbbilisim.com; we respond within 30 days at the latest. You also have the right to lodge a complaint with a data protection authority: in Turkey with the Personal Data Protection Authority (KVKK) and, if you live in the EEA, with the supervisory authority of the member state where you live, work or where the alleged infringement took place.
10. Subscription purchases
Subscriptions are purchased through Google Play or the App Store. Payment, billing, renewal and refunds are governed by the terms of that store, and your requests are handled through it. Subscriptions renew automatically; you can cancel at least 24 hours before the end of the current period on Android under Google Play › Subscriptions and on iPhone under Settings › Apple Account › Subscriptions. If you cancel before a free trial ends, you are not charged. You exercise your statutory right of withdrawal in the EU and any refund request through the store's own process.
11. Account and data deletion
You can have your account and all your data permanently deleted. See the account deletion request page for the steps and scope.
12. Children's privacy
Ecza Dolabı is not directed at children under 13 and does not knowingly collect data from children under 13. If such data is found, it is deleted.
13. Notifications
Reminder and expiry notifications are created locally on your device; their content is not sent to our servers. You can turn notifications off in your device settings or in the app's notification settings.
14. Changes
This policy may be updated. We will inform you in the app about significant changes. The date at the top of this page always shows the version in force.
Medical disclaimer: Ecza Dolabı does not provide medical advice, diagnosis or treatment. It stores and reminds you of medicine information only as you enter it. Make decisions about your health together with your doctor or pharmacist.