Security and KVKK
Patient data stays on your clinic's server.
Avlu runs on a server that is bought in your clinic's name and paid for by your clinic: in Türkiye for clinics in Türkiye, or in the EU for clinics outside it. Your clinic is the data controller: under KVKK in Türkiye, and under its own data-protection law elsewhere. We connect to your server only for support, with your permission, and every connection is logged.
- Your serverIn your clinic's name, in Türkiye or the EU
- With permission, loggedSupport access
- No AIConversations go to no AI company
Where does the data go?
Türkiye or EU · in your clinic's name
Your server
- Patient files and plans
- Photos, X-rays and documents
- Encrypted daily backup, kept off the server
Avlu support
Only with your permission
We connect for support; every connection is logged.
CloudTalk
Calls
If you use Avlu Calls, calls and their recordings are handled in your clinic's own CloudTalk account.
AI companies
Nothing is sent
There is no AI in our system.
Where is the data kept?
- Avlu runs on a server that is bought in your clinic's name and paid for by your clinic: in Türkiye for clinics in Türkiye, or in the EU for clinics outside it. Patient files, plans and documents live there; the encrypted backups are kept off the server, in the same region.
- There is no server or database shared with any other clinic.
- If you use only Avlu Treatment Plan, patient data goes nowhere beyond your server and its encrypted off-server backup; even the PDF is produced on your server.
- Lead Distribution receives Meta lead-form leads through your clinic's own Meta app and your Facebook Pages. The forms we set up ask no health questions.
- In the WhatsApp team inbox, messages pass through Meta's infrastructure, and Meta offers no option to keep the data in Türkiye. That is why we never say “all data stays in Türkiye”.
- With Calls, calls are made through CloudTalk; your clinic contracts with CloudTalk directly.
- For the standard contract and notification steps that cross-border transfers require, we provide templates and guidance.
Who does what under KVKK?
- Your clinic is the data controller for patient data.
- When we connect for support, we act on your clinic's instructions and under the data processing agreement in the KVKK pack.
- The server provider is your clinic's own supplier; your clinic signs that contract.
- The contract states that neither our founder nor any clinic he manages will access your data.
Support access
- We connect to your server only for support, and only with your permission.
- Every connection is logged, and we send you the log whenever you ask.
- You read the access log yourself, on screen.
- The installation and support team is named in the contract and signs a confidentiality undertaking that also covers your price list.
- While under support, the app sends only an anonymous heartbeat: the installation ID, the version and the number of active users. It sends no patient data.
Who sees what inside the app?
| Role | Sees |
|---|---|
| Coordinator | Only their own patients. |
| Team leader | Their team's patients. |
| Clinic owner / admin | All patients. |
| Doctor | Only the plan screen and the cases sent to them; never the chats. |
- Every permission is checked on the server; nothing is merely hidden on screen.
- Phone numbers are masked; revealing a number is logged.
- Only the clinic owner can export.
- When someone leaves, their chats and patients pass to a colleague in one click.
Sign-in security
- Two-step verification is mandatory for team leaders and admins.
- Sessions and sign-in attempts are limited.
- Patient names and numbers never appear in notifications, system logs or the address bar.
- Access keys and secrets are stored encrypted.
Every action on record
- Assignments, stage changes, templates, sign-ins, settings changes and number reveals are written to an audit log that cannot be deleted.
- Every data import during installation and every support connection is recorded too.
Backups and monitoring
- An encrypted backup is taken every day and kept off the server, in the same region as your server. The restore is tested at installation.
- While Updates & Support is active, we monitor your backups and server health remotely, and warn you 30 days before the server and backup bill is due.
- Critical outages (the system is down, leads stop arriving, a connection has dropped): we respond within 2 hours, 08:00–22:00 every day.
- Everyday questions: support in Turkish and English, Monday to Saturday, 09:00–19:00, with a first reply within 4 business hours.
The KVKK pack
- A data processing agreement, the sub-processor list, and notice and consent templates come with the installation.
- We set up your lead forms with a consent checkbox at installation.
- A patient who writes “STOP” receives no automatic messages.
Your data, always in your hands
- You can export all your data as CSV and SQL at any time, free of charge, whether you renew or not.
- There is no switch that stops a fully paid licence remotely.
- The server, the domain, your WhatsApp Business account, your number and your Facebook Page belong to your clinic.
No AI
- No AI talks to your patients in our system, and conversations are sent to no AI company.
- If you keep using the WhatsApp Business app on a phone as well, we switch off Meta's AI features in that app at installation.
We show no badges we do not hold
The day we hold a certificate such as ISO, or a Meta partner status, we will show it here. Until then, we simply describe what we do.
Data processing agreement and KVKK pack
Before installation, we send the data processing agreement, the sub-processor list and the templates for your legal adviser to review.
Ask your questions in the demo.
We show you the contract clauses and explain how support access works: only with your permission, and on record.