Privacy Notice

Data controller. Klivance is a clinical decision-support service operated by ALFA 4N SAN. TİC. LTD. ŞTİ. ("ALFA 4N", "we"), a company established in Türkiye. Under Law No. 6698 (KVKK) the data controller is ALFA 4N. Tax No (VKN): 0510246142 · Address: Hamdibey Mah. İstiklal Cad. No: 143, Biga / Çanakkale, Türkiye · Contact: info@klivance.com, muhasebe@alfa4n.com · Registered e-mail (KEP): alfa4n@hs01.kep.tr. This notice explains which personal data we process and why.

What data we process

• Account data: full name, email, mobile phone number (account security and contact when needed; may later be used for SMS verification), date of birth (a declaration that the account belongs to an adult healthcare professional; account security and abuse prevention), declared country and city (to determine the region and applicable rules under which the service is provided, and to understand our physician community), academic title and declared specialty, and an irreversible hash of your password (Argon2id). Your password is not stored in plaintext. The two consents you give when opening your account (terms of use and disclaimer; this privacy notice) are recorded with timestamp and IP. Accounts opened earlier also carry a third consent that was in force at that time (an undertaking not to enter patient identity); that record is preserved as proof. We send informational emails about using the service; every one of them carries a link that lets you stop receiving them in a single click. So that we can act on your request and evidence it if asked, the date you opted out is recorded on your account (our obligation under Turkish Law No. 6563 on the Regulation of Electronic Commerce; KVKK Art. 5/2(ç)). Mandatory transactional emails — address verification, password reset and payment receipts — fall outside this opt-out and continue to be sent.
• Usage data: the clinical questions you ask, the answers we generate, your conversation history and — if you choose to save them — the clinical notes you keep in your patient records (chronic conditions, medications, visit history). You may enter your patient’s real name in a patient record; you may also continue using a pseudonymous code. Once you enter a real name, these records become health data relating to an identified person — special-category personal data under Article 6 of the KVKK — and are processed as described under "Transfer of personal data" below. The decision to enter your patient’s data into Klivance, and the duty to inform your patient and obtain any consent required from them, rest with you as the physician.
• Tool usage records: when you use our free tools while signed in (drug interaction screening, renal dose check, SGK reimbursement-list status, drug/reference search), which tool you used, when, and the text you entered in that search (the drug, active substance or disease name you looked up) are recorded against your account. The purpose is to operate and secure the service, to prevent abuse, and to see which questions we could not answer so that we can improve our knowledge base (KVKK Art. 5/2-c and Art. 5/2-f). These are free-text fields: please enter only a drug or condition name, and no patient identity or other personal information. These records are not used for advertising.
• Patient files (file library): lab/report files you attach to a patient are stored encrypted at rest (AES-based) and kept permanently until you delete them. You can delete any file at any time (permanent deletion). During analysis a file's content — including any patient identity printed on it — is transmitted to the AI provider to generate the answer (see "Transfer of personal data"). If you close your account, your files are permanently deleted within a reasonable period (at most 30 days). Upload only what is clinically necessary; we recommend redacting identity and contact details you do not need before uploading (data minimisation).
• Billing/financial data: your name, email and the payment amount are processed for the subscription. Your card details are handled solely by our payment institution iyzico (licensed, established in Türkiye); they never reach Klivance/ALFA 4N at any stage. After payment a Turkish tax invoice (e-fatura or e-arşiv, per your tax status) is issued. To issue your invoice, a billing profile is collected before payment: invoice type, invoice name/title and province; from tax-registered users additionally tax ID (VKN/TCKN), tax office and address; from individual users the national ID is optional and only if they wish to expense the invoice. This data is processed solely for invoicing and tax-law obligations. Identity/diploma images are not collected.
• Physician/professional declaration: at sign-up you declare your title and specialty; this declaration is stored with your account. The account currently operates on a declaration basis. If document- or institutional-email verification is added later, only the verification result (verified/method/date) is stored; the document image and identity number are not persisted (verify-don't-store principle).

Transfer of personal data

• AI infrastructure: your questions, the clinical notes in your patient records (including the patient’s name if you entered one) and the documents you upload are processed on the AI infrastructure we use to generate the answer. This data is used solely to generate a clinical decision-support answer for you; it is not used for marketing and is not sold.
• iyzico (a licensed payment institution established in Türkiye): payment processing; your card data never reaches Klivance at any stage.
• Turkish Revenue Administration (GİB): e-invoice issuance and tax obligations.
• External accounting firm (as a data processor) and, where needed, legal counsel.
• Competent public authorities (courts, audit) — only upon a lawful request.

Access within our company

A limited number of authorised administrators at ALFA 4N can access all of your account and its records, with your account identity visible (your name and email address). This access covers your conversations and the answers we generate, and the contents of your patient records — the patient code or, if you entered one, your patient’s real name, the narrative, chronic conditions, medications, visit notes, the names of the files you uploaded and the text extracted from them. Such access is made only in order to resolve your support requests and operate the service (KVKK Art. 5/2-c), for security and abuse investigation and to improve the service and identify gaps in our knowledge base (Art. 5/2-f), and to respond to lawful requests (Art. 5/2-ç). This data is not used for marketing and is not sold. Every access — including which patient record was viewed — is logged as described under "Administrator access records" below. You decide what to enter into a patient record; we recommend entering only what is clinically necessary.

Purpose and legal basis

We process the data to provide the service, manage your account, collect the subscription/payment, invoice, keep the service secure and improve the service — relying on performance of a contract (KVKK Art. 5/2-c), compliance with a legal obligation (Art. 5/2-ç — tax/commercial law) and legitimate interest (Art. 5/2-f — service security together with improving the service and identifying gaps in our knowledge base). If you enter a patient’s name into a patient record, the data processed becomes special-category personal data (KVKK Art. 6); in that case informing the patient and obtaining any consent required from them rests with you as the physician. If you keep using a pseudonymous code, the records contain no patient identity; the remaining clinical content of the record (narrative, chronic conditions, medications, visit notes, files) is stored in any case and is covered by "Access within our company". We do not sell your data to third parties for marketing.

Retention

• Financial/invoice records: 10 years (Turkish Tax Procedure Law / Code of Obligations).
• Account and usage data: for as long as your account is open; deleted within a reasonable period after closure.
• Tool usage records: retained for as long as your account is open; when you close your account they are permanently deleted together with the rest of your account.
• Patient files: until you delete them; if you close your account, permanently deleted within at most 30 days.
• Cookie data: at most 2 years.
• Free-trial record: the free trial is granted once per email address. To enforce this we retain an irreversible one-way digest (salted HMAC) of your email address even after your account is deleted. This record does not contain the address itself and cannot be used to contact you or for marketing; its only function is to answer the question "has this address already received a free trial" — this is also surfaced in our admin panel as a "previously registered with this address" marker. Legal basis: legitimate interest in preventing abuse.
• Memberships closed by us: if we close a membership (e.g. on request or for abuse), a copy of your account record plus a usage/payment summary is retained indefinitely in our administrative archive: name, email, phone, date of birth, country/city, title/specialty, consent record and, if present, billing details (tax ID, address). Clinical data (conversations, patients, files) is not included in that copy and is deleted. Your password digest, email-verification and password-reset tokens, IP address and advertising click ID are not carried into the archive either. Legal basis: reconciliation of financial records and proof of consent. If you request deletion (right to erasure), this archive copy is not taken; only a counter that contains no identity data (how many accounts were deleted) is kept.
• Questions retained from deleted memberships: to improve the service and see gaps in our knowledge base, clinical question and answer texts from deleted accounts are retained DETACHED from the account: these records contain no clinician identity, email or account number, and cannot be traced back to a clinician. Retention is indefinite. Legal basis: legitimate interest in improving the service. ⚠ Because you write the question text yourself, it matters that you do not put identifying information into free-text fields.
• Administrator access records: for security purposes we record when one of our administrators opened or changed the record belonging to your account: the date and time of access, the surface accessed, the action taken, the account number of the administrator and — if a patient record was opened — which patient record was viewed. This record shows the access itself: no copy of the content displayed (question, answer, patient note or file text) is stored inside the record. The content itself remains in your account and is covered by "Access within our company" above. The record is retained for 24 months after your account is closed and is then deleted automatically; its purpose is to be able to show, after the fact, who accessed your account. Legal basis: legal obligation relating to data security (KVKK Art. 12/1 and Art. 5/2-ç).

The three items above are deliberate, explicitly stated exceptions to the "deleted after account closure" rule. You may exercise your data-subject rights to request their deletion. ⚠ For administrator access records this right is limited: these records are kept under a legal obligation relating to data security and cannot be deleted before their retention period expires.

Your rights (KVKK Art. 11)

You have the right to learn whether your data is processed, to request information and correction, to request erasure/destruction, to know the third parties to whom it is transferred, to object to solely automated analysis, and to claim compensation for damage from unlawful processing. To exercise these rights, write to info@klivance.com, KEP alfa4n@hs01.kep.tr, or in writing to our registered address. Your request is concluded within 30 days. This notice is updated as needed; the current version is published on this page.