1. Data Controller

Under the Turkish Personal Data Protection Law No. 6698 (KVKK), the data controller information is provided below.

2. Scope and Definitions

This disclosure text is prepared to inform you about the processing of your personal data when you use our web and mobile applications. Terms such as "personal data", "special category data", "processing" and "transfer" are used with their meanings under KVKK.

2. Collected Personal Data

To provide our services, we may process the following personal data:

• Email address
• Full name
• Date of birth
• Gender
• Phone number (trainers only; for payment purposes, stored encrypted)
• Turkish ID number (trainers only; for payment purposes, stored encrypted)
• Health information (PAR-Q test, health status)
• Fitness information (goals, measurements, workout data)
• Payment/billing information (processed securely through Iyzico)
• Messaging content and timestamps
• Public content (articles, recipes, free programs) and author information
• Progress photos and success story visuals (based on your preferences)
• Security and transaction logs (KVKK consent date/version/IP, etc.)

3. Data Processing Purposes

Your personal data is processed for the following purposes:

• Account creation and management
• Provision of fitness and nutrition services
• Communication with you
• Processing of payment transactions
• Fulfillment of legal obligations
• Publishing public content and managing interactions
• Ensuring security and preventing abuse

4. Legal Bases

Your personal data may be processed based on the legal grounds set out in Articles 5 and 6 of KVKK. For example:

• Necessity for the establishment/performance of a contract
• Compliance with legal obligations
• Legitimate interests (provided that your fundamental rights and freedoms are not harmed)
• Explicit consent (especially for special category health data and public sharing of success stories/visuals)

5. Data Retention Period

Your personal data is retained for the period required by applicable laws or as long as necessary for the purpose of processing. Upon your account deletion request, your data will be deleted, destroyed or anonymized, subject to legal obligations and limitation periods for disputes/claims.

6. Data Sharing and Transfers

Your personal data may be shared with the following third parties:

• Supabase (data processor - database and authentication services) — data may be hosted in **Germany/Frankfurt (Central EU / AWS)**
• Iyzico (payment service provider) — data necessary for payment/billing may be transferred. Card data is processed and stored by Iyzico; we do not store card details. Trainers’ Turkish ID number and phone number are used only for payment purposes, stored encrypted in our database, and transferred to Iyzico when required for payment.

7. Public Content

Content such as articles, recipes, free programs, and success stories may be published on public pages. Such content can be viewed by anyone and may be indexed by search engines.

8. Explicit Consent / Sharing Preferences

For success stories, visual sharing, displaying measurements and social media sharing, we provide sharing permissions within the app. You may change or withdraw your permissions at any time. Withdrawal affects future processing; please note that previous public content may have been copied by third parties.

9. Special Category Personal Data (Health Data)

PAR-Q responses and health information you provide may be considered special category personal data. Such data may be processed to provide the service and support safe usage, and where necessary based on your explicit consent.

10. Data Security

Appropriate technical and organizational measures are implemented to protect your personal data, such as access controls, role-based authorization, secure transmission, logging and monitoring.

11. Data Subject Rights

Under KVKK, you have the following rights:

• Learn whether your personal data is being processed
• Request correction of incorrectly processed personal data
• Request deletion of personal data
• Object to the processing of personal data
• File a complaint with the KVKK Board

12. Cookie Usage

Only necessary cookies are used on our website:

Supabase authentication cookies are used for session management. These cookies are necessary for the service to function and do not require user consent. We currently do not use third-party advertising/pixel cookies.

13. Contact and Application Method

You can contact us to exercise your rights under KVKK. We may request information/documents to verify your identity as part of the application.