Privacy Notice

1. Identity of the Data Controller

Your personal data is processed by Clonify Labs (the "Company") in its capacity as data controller, within the scope and subject to the conditions set out in this Notice.

Item	Value
Company	Clonify Labs
Address	Cyberpark Dikmen GO, Ankara, Türkiye
Email	info@clonifylabs.com
Data protection requests	kvkk@clonifylabs.com
Phone	+90 507 621 65 14

2. Capacity as Data Controller and as Data Processor

The Company acts in two distinct capacities. This distinction determines the party to which the data subject must address requests arising under the GDPR and applicable laws.

As data controller — in respect of website visitors, persons submitting a demo request, waitlist registrants, senders of the contact form and clinic users who create a platform account.
As data processor — in respect of patient data processed by clinics within the Clonify Ops platform, the clinic concerned is the data controller and the Company acts solely on that clinic's instructions. Requests concerning patient data must be addressed to the clinic providing treatment.

3. Personal Data Processed and Method of Collection

Personal data is obtained in electronic form, by partly automated means, upon completion of the forms available on the website or the creation of a platform account.

Channel	Data processed
Demo request form	Name, clinic name, email, phone, modules of interest, message, language
Waitlist form	Name, clinic/company, email, phone, role, language, consent record
Contact form	Name, email, subject, message, language
Platform account	Email, hashed password, name, clinic name, city, phone, consent record (approval + region)
Technical records	Session cookies, language and region preference cookies, server access logs, cookieless aggregate visit statistics, technical browser signals for form abuse prevention

No third-party tracking tools are used on the website for advertising or profiling purposes. Website traffic is measured as aggregate statistics through the Company's own measurement infrastructure, which sets no cookies and the data of which is not disclosed to third parties.

4. Purposes of Processing and Legal Bases

Purpose	Legal basis (GDPR Art. 6)
Handling demo requests and scheduling meetings	Necessary for a contract at the data subject's request (Art. 6(1)(b))
Waitlist management and early-access announcements	Explicit consent (Art. 6(1)(a))
Responding to enquiries	Legitimate interest (Art. 6(1)(f))
Creating the account, authentication and service delivery	Performance of a contract (Art. 6(1)(b))
Information security and abuse prevention	Legitimate interest (Art. 6(1)(f))
Development of platform algorithms and AI models in R&D processes, through full anonymisation (de-identification) of data for which the respective clinic has obtained consent	Legitimate interest (Art. 6(1)(f))
Statutory retention and reporting duties	Compliance with a legal obligation (Art. 6(1)(c))

5. Transfer of Personal Data

Personal data may be transferred to the following categories of recipient, to the extent necessary for the provision of the service and in accordance with Chapter V of the GDPR (and equivalent provisions of applicable laws):

Server hosting providers — form records and platform data are held on servers managed by the Company, located in a data centre within the European Union.
Website hosting and content delivery providers — the website is published on the infrastructure of a hosting provider established in the United States, which processes technical request data such as IP addresses in the course of serving pages.
Form security verification providers — a security verification service established in the United States is used on the demo, contact, waitlist and sign-up forms to filter automated submissions. Form contents are not transmitted to that provider; technical browser signals and the IP address are processed.
Email delivery infrastructure providers — notification and campaign emails are sent from the Company's own mail server and may be relayed through its email infrastructure provider.
Competent public authorities — solely where required by law and limited to the scope of the request.

Hosting data abroad constitutes a transfer of personal data to a third country within the meaning of the GDPR. Such transfer is based on the explicit consent given by way of the checkbox in our forms, or on its being necessary for the fulfilment of the request. Explicit consent may be withdrawn at any time by notice to kvkk@clonifylabs.com; withdrawal does not affect the lawfulness of processing carried out prior to that date.

Personal data is not sold, rented or transferred to third parties for marketing purposes.

6. Retention Periods

Data	Retention
Demo and contact requests	2 years after the request is closed
Waitlist record	Until consent is withdrawn, at most 3 years
Account and membership records	10 years after account closure (commercial law)
Server access and security logs	12 months

Upon expiry of the applicable retention period, personal data is erased, destroyed or anonymised.

7. Rights of the Data Subject under the GDPR and Applicable Laws

As a data subject you are entitled to exercise the following rights by application to the data controller:

Access to the data and a copy thereof
Rectification of incomplete or inaccurate data
Erasure ('right to be forgotten')
Restriction of processing
Data portability
Objection to processing based on legitimate interests
Withdrawal of consent where processing rests upon it
To lodge a complaint with a supervisory authority

8. Procedure for Applications

Requests may be submitted by email to kvkk@clonifylabs.com or in writing to Cyberpark Dikmen GO, Ankara, Türkiye. The application must clearly state the applicant's name, contact details and the subject matter of the request.

Applications are generally concluded free of charge as soon as possible and in any event within one month. Where requests are manifestly unfounded or excessive, a reasonable fee may be charged or the request may be refused.

For questions: kvkk@clonifylabs.com