KVKK Disclosure Notice
What we process under Law No. 6698, on what legal basis, where it goes, and your rights.
Last updated:
Data controller
| Legal name | Psisula |
| Address | İstanbul, Türkiye |
| iletisim@psisula.com |
Whose data, and whose responsibility
This split applies throughout:
- For marketing-site and account data, Psisula is the controller. This covers anyone who fills in the demo form, opens an account, or writes to us.
- For client clinical data, the controller is the clinic or therapist using the service. Psisula acts as a processor and works only on the customer’s instructions. The terms are set by the Data Processing Agreement.
If you are a client with a request about your own records, address it to your therapist or clinic; we assist them technically in fulfilling it.
Categories processed and their legal bases
Processed by us as controller
| Category | Data | Legal basis (KVKK art. 5) |
|---|---|---|
| Identity and contact | Name, email, phone, practice type, team size | Explicit consent (demo request form) |
| Account | Therapist name, email, role, password hash, session records | Performance of a contract |
| Billing | Subscription period, payment status, invoice details | Performance of a contract; legal obligation |
| Technical logs | Request, clinic and therapist ids, error records | Legitimate interest (service security and continuity) |
| Correspondence | The content of emails you send us | Legitimate interest (answering your request) |
| Website usage | On psisula.com only: pages viewed, referrer, campaign tags, links clicked, browser and device type, and a daily-changing pseudonymous identifier derived from the IP address, which is then discarded | Legitimate interest (measuring and improving the website) |
Our technical logs carry no client name, phone number, note or transcript text, assessment answer, portal message or AI request/response body; a linter enforces the rule in continuous integration.
Touched by us as processor
On our customer’s instructions, the client data held in the system: identity and contact details, appointment records, session notes, treatment plans, diagnoses, assessment answers and scores, homework, portal messages, uploaded documents, session fees and payment status, session transcripts. The clinic determines the purpose and legal basis for collecting these.
Purposes
To provide the service and administer your account; to hold the introductory call you asked for; to deliver appointment reminders; to keep the service secure and working and to detect faults and abuse; to meet our legal obligations.
We do not sell, rent or transfer your data to third parties for advertising. Client clinical data is never used to train AI models.
Transfers abroad
The service’s servers, database and file storage are hosted in the European Union (Alkmaar, Netherlands). This constitutes a transfer abroad within the meaning of KVKK art. 9.
The following providers receive only the data the relevant feature needs:
| Recipient | Data received | Location |
|---|---|---|
| Our hosting, database and file-storage provider | All data held in the system (encrypted) | EU (Alkmaar, Netherlands) |
| OpenRouter (gateway) | Session audio and transcript text for note drafting; the relevant record text for summaries and score readings. OpenRouter routes each request to one of two models: openai/gpt-transcribe (OpenAI) and z-ai/glm-5.3-flash (Z.AI) | USA |
| Twilio | Recipient phone number and message text (appointment reminders, portal login links) | USA |
| Resend | Recipient email address and message text (reminders, notifications, password resets) | USA |
| Sentry | Error records and request ids — no client data | EU (Frankfurt) |
| PostHog | Marketing-site visit statistics listed above under “Website usage”; the IP address is discarded after the daily identifier is derived — no client data | EU (Frankfurt) |
| Zoom, Google Meet | Only if the therapist has connected their own account: the meeting title and its start and end time. Google Meet additionally receives the client’s email address as an event attendee, where one is on file. Nothing is read back from either provider except the meeting join link | USA |
Transfers rest on your explicit consent or another condition the Law provides. Every provider other than hosting can be switched off by disabling the corresponding feature.
Retention and destruction
- Technical logs are deleted after 14 days.
- Website usage statistics are deleted after at most 12 months.
- Demo requests are kept for at most 12 months after the request is closed.
- Account and billing data is kept for the term of the contract and thereafter for the statutory retention periods (10 years under tax legislation).
- Retention of client clinical data is set by the clinic. When an account closes, data is exported and destroyed under the Data Processing Agreement.
- Backups are held for a limited period; a deleted record leaves the backups when that period expires.
Your rights
Under KVKK art. 11 you may: learn whether your personal data is processed; request information if it has been; learn the purpose of processing and whether the data is used accordingly; know the third parties to whom it is transferred domestically or abroad; request correction if it is incomplete or inaccurate; request erasure or destruction within the conditions of art. 7; request that such actions be notified to third parties the data was transferred to; object to an adverse outcome produced solely by automated analysis; and claim compensation for damage caused by unlawful processing.
The product produces no solely automated decision about a client: every piece of AI-generated content is a draft awaiting therapist approval.
Making a request
Write to iletisim@psisula.com. Tell us which record your request concerns so we can verify your identity. Requests are concluded within thirty days at the latest, under art. 13 of the Law. If our answer does not satisfy you, you may complain to the Personal Data Protection Board.