Privacy Notice

1. Scope and controller

This notice covers the medregai.com website and the panel.medregai.com customer panel. The controller's registration details are on the Contact page.

Processing is carried out under the Turkish Personal Data Protection Law (KVKK, No. 6698) and the EU General Data Protection Regulation (GDPR).

2. Data we process

The following categories are processed on the website and in the panel:

• The text of the regulatory question you submit on the website — used only to produce the answer.
• Technical records: IP address, browser details, request time and response status (security and error analysis).
• Preferences stored in your browser: theme choice and your cookie consent.
• Account details in the panel: name, e-mail, company name, tax number and tax office.
• Product and technical file content you upload, and the GSPR documents you generate.
• Credit movements and payment records (we do not store card details).

3. Purposes and legal bases

Providing the account and the service rests on performance of a contract; security, abuse prevention and service improvement on legitimate interests; analytics and advertising measurement on your explicit consent; invoicing and accounting records on a legal obligation.

You may withdraw consent-based processing at any time; withdrawal does not affect the lawfulness of processing before it.

4. Processing by artificial intelligence

Your question and the regulatory excerpts needed to answer it are sent to our AI service provider to generate the response. This data is not used for model training.

Answers are produced solely from the regulatory documents loaded into the system; when no source is found, the system does not invent an answer — it says so explicitly.

5. Transfers and service providers

Data is shared with our hosting, AI response generation and payment infrastructure providers only to the extent the service requires. Data processing agreements are in place with each provider.

Where a transfer abroad is necessary, the conditions set out by KVKK and the appropriate safeguards under GDPR are applied. We do not sell your data to third parties for advertising.

6. Retention

Personal data is kept for as long as the purpose requires and for the retention periods prescribed by applicable law; once those expire it is deleted or anonymised.

If you close your account, account data is deleted except for records subject to a statutory retention obligation.

7. Your rights

Under KVKK Article 11 and GDPR Articles 15-22 you have the right to:

• Learn whether your personal data is processed and obtain access to it.
• Request rectification of incomplete or inaccurate data.
• Request erasure or destruction.
• Object to processing and request its restriction.
• Receive your data in a structured format (data portability).
• Claim compensation for damages and lodge a complaint with the supervisory authority.

8. Security and contact

All traffic is encrypted with TLS, passwords are stored encrypted, and access to data is limited on a need-to-know basis.

You can send requests to the e-mail address on the Contact page. Requests are answered within 30 days at the latest.

9. Changes

When this notice is updated, the date on this page changes. Material changes are additionally announced in the panel.