randevuplanı
My accountGet started

Privacy Policy

Effective date: 01.11.2026

Randevu Planı — Privacy Policy

Language: This is a translation provided for your convenience. The official and legally binding version of this policy is the Turkish one. In the event of any discrepancy, the Turkish text prevails.

This Privacy Policy explains how your personal data is collected, processed, stored and protected when you use the “Randevu Planı” platform (website and mobile application). It covers both the Businesses registered on the Platform and the Customers who book appointments with those businesses.

An important distinction: With regard to Customer data collected by a Business through the Platform, the relevant Business is the data controller; Randevu Planı processes that data as a data processor on behalf of the Business. With regard to the Platform’s own account/analytics data about you, Randevu Planı is the data controller.

1. Data We Collect

  • Identity and contact data: first name and surname, phone number, e-mail address.
  • Appointment and transaction data: appointments booked/given, date and time, service type, appointment history, cancellation and change records.
  • Location and address data: postal address and/or device location (only where you have given permission).
  • Personal details (optional): birth date, gender, occupation — only where you choose to enter them in your account. Your choice on sharing them with businesses is also recorded, together with the date on which you gave or withdrew it and the version of the text in force on that date.
  • Account and technical data: username, hashed password, device/application information, IP address, log records.
  • Review data: the 0–10 recommendation score (NPS) you give after an appointment and your optional note.
  • Commercial message consent records: the business you gave or withdrew campaign SMS consent to, your phone number, the date of consent/refusal, the channel and the text version in force at that time, the IP address and browser/device information from which consent was given, and the status of transmission to İYS.
  • Usage and analytics data: in-app interactions, session durations, screen viewing behaviour and session recordings (Microsoft Clarity). In the mobile app this data is linked to a pseudonymous identifier tied to your account (account number), without your name, phone number or e-mail; it is not anonymous.

2. Purposes of Processing

  • Creating, managing and sending reminders for appointments, and matching Businesses with Customers.
  • Account creation, authentication and account security.
  • Sending notifications (in-app, e-mail, SMS, push).
  • If you allow it, enabling the businesses you book with to offer birthday discounts, campaigns and similar gestures.
  • If you give consent, recording it and transmitting it to the Message Management System (İYS) so that the business you book with can send you campaign SMS.
  • Collecting your post-appointment satisfaction score (NPS) and reporting it to the relevant business.
  • Improving the service, debugging and performing analytics.
  • Fulfilling legal obligations and responding to legal requests.

3. Legal Grounds (KVKK arts. 5–6 / GDPR art. 6)

  • Conclusion and performance of a contract (provision of the appointment service).
  • Your explicit consent (e.g. location data, commercial electronic messages, optional cookies, sharing your optional personal details with the businesses you book with).
  • Compliance with a legal obligation (e.g. registering commercial message consents with İYS and retaining consent records).
  • The legitimate interests of the data controller (security, fraud prevention, service improvement).

4. Third-Party Services and Data Sharing

In order to provide the service we work with suppliers in the following categories. These services are subject to their own privacy policies:

  • Hosting and network security: All requests to the website and from the app to our servers pass through Cloudflare (domain, content delivery, attack protection); in the process your IP address, request details and the approximate country derived from your IP address are processed.
  • Analytics: Google Analytics (website), Firebase Analytics (mobile app), Microsoft Clarity (session and behaviour analysis, including a recording of on-screen interactions). On the website, Google Analytics and Clarity only run if you consent in your cookie preferences (see the Cookie Policy).
  • Error tracking: Sentry (mobile app) — crash and error reports; device and app information and the technical context at the time of the error.
  • Authentication and security: Firebase Authentication (phone number verification), Sign in with Google, Sign in with Apple, Google reCAPTCHA (protection against automated use and abuse on registration, password reset and verification forms on the website and in the mobile app).
  • Calendar sync: Google Calendar — if a staff member or customer connects their Google Calendar, appointments are written to it (staff calendar: customer name, services, time and the business’s appointment note; customer calendar: business name, services and time). The connection can be removed at any time.
  • Notifications / Push: Firebase Cloud Messaging (FCM).
  • Communication: SMS (Verimor in Türkiye, Firebase outside Türkiye), WhatsApp (Meta) and e-mail (Resend) delivery services for verification codes and notifications. For reminder and campaign messages that businesses send with their own SMS accounts, the SMS provider chosen by the business (e.g. Netgsm, Verimor, İleti Merkezi) is used.
  • Message Management System (İYS): If you give or withdraw campaign SMS consent, your phone number and consent details are transmitted to İleti Yönetim Sistemi A.Ş. through the business’s SMS provider (a legal requirement).
  • Maps and location: OpenStreetMap — when the website or the mobile app shows a map, map images are loaded from OpenStreetMap servers and some map library files from unpkg.com; when you pick a location, the address you type or the point you select on the map is sent to the OpenStreetMap Nominatim service to look up the address. Your IP address is passed to these servers in the process.
  • Video: Promotional and product videos on business pages are shown using YouTube’s privacy-enhanced mode (youtube-nocookie.com, Google); when a page containing a video is opened, your IP address and browser/device information are passed to Google.
  • Weather (business dashboard): MET Norway (api.met.no) — the business’s location and the device’s IP address are sent.
  • Artificial intelligence: Google Gemini — in the dietitian service, images and related text are sent to Google to read nutritional and measurement values from uploaded meal photos and body composition printouts. This information may relate to your health.
  • Subscriptions and payments (businesses): RevenueCat, Apple App Store, Google Play — purchasing and verifying business subscriptions.
  • Possible advertising/tracking services: in-app advertising and measurement providers (this list is updated if and when such services are used).

Sharing with businesses: If you turn on the “Let businesses I book with see this” option in your account, your birth date, gender and occupation are shown only to businesses with which you yourself have created at least one appointment; appointments that a business has created on your behalf do not meet this condition. This sharing is based on your explicit consent. The option is off by default; you can turn it off at any time, and once you do, businesses can no longer see this information. While the option is off, your details are not shown to any business and only you can see them in your account. Information that businesses enter themselves into their own customer records is independent of this option; the relevant Business is the data controller for those records (see An important distinction).

Campaign SMS (commercial electronic messages): If the business has enabled this feature, the booking form shows an optional consent box along the lines of “I would like to receive campaigns and offers by SMS”. Consent is given only to that business and for the phone number you provide; other businesses cannot use it. The relevant Business is the data controller for the content and sending of campaign messages; Randevu Planı records your consent and, as required by Turkish Law no. 6563 and the Regulation on Commercial Communication and Commercial Electronic Messages, transmits it to the Message Management System (İYS) through the business’s SMS provider. This transmission includes your phone number, the consent or refusal, its date and the channel through which it was given. Campaign messages are sent only to numbers whose consent is recorded in İYS. You can withdraw your consent at any time from Marketing consents in your account or directly through İYS (iys.org.tr, e-Devlet); your refusal is also transmitted to İYS. Not giving consent does not affect your ability to book.

Satisfaction score (NPS): After your appointment you may be asked, on a scale of 0–10 and with an optional short note, whether you would recommend the business to someone you know (via the review page, My appointments or an app notification). Giving a score is optional. Your score and note are reported, together with the related appointment, only to that business; they are not published and are not passed on to platforms such as Google.

We share your data only for the purposes above and only to the extent necessary. We do not sell your data to third parties for marketing purposes.

5. International Data Transfers (KVKK art. 9 / GDPR Chapter V)

Our servers and some of our suppliers are located in the European Union (EU). Some of the suppliers listed in Section 4 (e.g. Cloudflare, Google, Microsoft, Meta, Sentry, RevenueCat) may also process data on servers outside the EU, in particular in the United States (US). For Users located in Türkiye, your data is therefore transferred abroad (including to the EU and the US) for the purpose of providing the service.

Such transfers rely, under Article 9 of the KVKK, on your explicit consent and/or on their being necessary for the performance of the contract. For these transfers, the safeguards required by the GDPR (an adequacy decision or Standard Contractual Clauses — SCCs) are applied. You may contact us for information about the legal basis of a transfer.

6. Retention Period

Your personal data is retained for as long as the purpose of processing requires and for the mandatory retention periods prescribed by applicable legislation (e.g. commercial and financial records). At the end of that period the data is erased, destroyed or anonymised.

Your optional personal details (birth date, gender, occupation) are kept in your account until you change or delete them. Turning off the option to share them with businesses does not delete them; it only stops them being shown to businesses. If you delete your account, these details and the records of your sharing choice are deleted.

Commercial message consent and refusal records are kept as proof of consent for 3 years from the end of the consent’s validity; they are retained for this period even if you delete your account.

7. Data Security

We take appropriate technical and organisational measures to protect your data, including encryption, access control, secure hosting, daily encrypted database backups and regular security reviews. We would remind you that no system can be 100% secure; in the event of a breach we will make the notifications required by law.

8. Your Rights (KVKK art. 11 / GDPR arts. 15–22)

  • To learn whether your data is being processed and to access it.
  • To request rectification, erasure or destruction.
  • To request restriction of processing and to object to processing.
  • Data portability (to the extent applicable).
  • To withdraw your consent at any time (for sharing with businesses, also by turning off the “Let businesses I book with see this” option in your account, and for campaign SMS by using Marketing consents).

To exercise these rights you may contact privacy.randevuplani@gmail.com. For requests concerning Customer data you may first need to approach the relevant Business (the data controller); we will help direct you as needed.

9. Children’s Privacy

The Platform is not intended for persons under the age of 18. We do not knowingly collect data from persons under 18; if such data is identified, it is deleted.

10. Changes

This Privacy Policy may be updated. Significant changes will be communicated by appropriate means. The current version is always published on the Platform.

11. Contact

12. Data Controller

Mert Can Taşkın