Privacy Notice (KVKK) - Lumia

1. Data controller

Under KVKK, the data controller is:


Legal name	Neural Academy Ltd. Şti.
Address	Çukurambar mah. Zeki Ergezen cad. 2/4, Çankaya/Ankara
Contact	destek@lumiaapp.net

In this notice, "Lumia" or "we" means the controller above, and "the App" means the Lumia mobile application.

2. What data do we process?

The App can be used without creating an account (anonymously). Even in anonymous use, an anonymous user ID is assigned to your device.

2.0 First, the most important thing: where your data lives

Your health records are not kept on our servers; they stay only on your device. The only things on the server are your account (your email address, your nickname, your session and security logs, and a copy of your language preference) and your consent record.

	Where	What it covers
Your health records	Only in a database on your phone	Your symptoms, your cycle, your hormone medications and dose records, your sleep diary, your reminders, the articles you read, your stage and your stage assessment
Your account	On the server (cloud)	Your email address (if any), your user ID, the hash of your password, your session information, and a record of the consents you have given

What this means in practice: when you log a symptom, mark a dose time, or fill in your sleep diary, that data does not reach us. There is no copy of it on our server. That is why the tracking side of the App works without an internet connection as well.

Why we keep the consent record on the server: we have to be able to demonstrate that you gave your explicit consent to the processing of health data, and that you withdrew it if you do (Article 6/2 of KVKK). That record consists of which consent, which version, and when. It contains none of your health entries.

If you lose or replace your phone, or delete the App, your health records are lost with it. Because your data is held locally, we have no copy. We recommend taking a backup at regular intervals (§6).

2.1 Special category data; health data

Data considered special category under Article 6 of KVKK, which we process only with your explicit consent. All of your tracking records are kept on your device. None of them has a copy on our servers.

Data	What it contains	Where
Stage assessment	Your assessment answers and the calculated stage	On your device
Menopause stage	The stage you selected or that was calculated: pre-perimenopause · perimenopause · postmenopause · undetermined	On your device
Symptom entries	The symptoms you logged, their severity, and any notes you wrote	On your device
Cycle entries	Period start/end marks, spotting, display preferences, and any notes you wrote	On your device
Your hormone therapy / medications	The name you wrote yourself for the medication you take, its form, the dose note you wrote yourself, its times, and whether you took each dose	On your device
Sleep diary and program progress	Bedtime, wake time, number of night wakings, time to fall asleep, which day of the program you are on	On your device
Reminders	The type and time of the reminders you set, and the title you wrote yourself	On your device
Reading record	Which article you read, how much of it, and when	On your device

An honest note about free-text fields: we cannot control what you type into a reminder title or a dose note. If you write a diagnosis, a doctor's name, or information belonging to another person there, that is saved too. These fields never leave your device; but when you take a backup, they are included in it in encrypted form (§6).

2.2 Data we keep on the server

Data	What it contains	Note
User ID	A randomly generated identifier (UUID)	Assigned in anonymous use as well
Email address	·	Only if you upgrade to a permanent account
Password hash	·	We do not see your password itself; the authentication infrastructure manages it
Nickname	·	May be left empty
Your language preference	`tr` or `en`	Your actual preference is kept on your device (§2.3); this copy on the server exists so that we can send the identity emails (verification, password reset) in your language
Account state and timestamps	Whether the account is anonymous, whether the email is verified, sign-up/sign-in times, session information	Required for session management
Your consent record	Which consent, which version, whether granted, and when	Evidence for legal purposes: we keep this on the server so that we can demonstrate that you gave or withdrew consent (Article 6/2 of KVKK)

The App does not ask for or hold your full name, date of birth, national ID number, phone number, location or profile photo.

2.3 Data that stays on your device and never reaches us

This is the App's largest data set:

All of your tracking records (§2.1); in a single database file on your phone. That file sits in the App's own protected area (§9).
There is no synchronization. The only authoritative copy of these records is the file on your device; there is no queue waiting to upload them and no background sync. That is why the tracking side works fully offline.
The computations happen on your device too: the result of the stage assessment, your cycle day, the insights derived from your symptom patterns, and content suggestions; none of them send data to a server.
The free text you write yourself (reminder title, dose note) does not leave your device. It is included, in encrypted form, only in a backup you create yourself (§6).
Your tool preferences: breathing exercise duration, vibration, body scan duration.
Reminder notifications are scheduled by your device's own local notification system; notification contents are not sent to a server. Notification texts are deliberately generic; your medication name does not appear on your lock screen.
These records are deleted when you delete your account, not when you sign out (§8).

One important exception: if your phone's iCloud/iTunes backup is enabled, the database file holding your health records is included in that backup and goes to Apple's servers. This is not a transfer we initiate; it depends on your device's operating system setting. Even so, it is the one exception you do not start yourself to the statement "your data does not leave your device" (the other path is a backup you create yourself).

2.4 What the underlying infrastructure keeps on its own

We do not write most of these records; the cloud infrastructure we use does. The last two rows, however, are written by our own server. We are the data controller, so we list them all:

Data	Where/why
Your IP address and browser/device information (user-agent)	Recorded in the authentication infrastructure's security logs during sign-in, sign-up, email verification and password reset events
Session and refresh token records	Technically required to keep your session open
Platform/request logs	The infrastructure provider's own operational logs
Database backups	The infrastructure provider's disaster-recovery backups
Backup delivery error record	If the email provider rejects the request while sending your backup, the server writes a single-line error entry: the HTTP status code and the provider's error code. The following are NOT written to this record: your email address, your password, the contents of your backup, and the provider's descriptive message. In other words, the record does not say whose backup it was
Identity email error record	If the email provider rejects the request while your verification or password-reset email is being sent, the server likewise writes a single-line entry: the HTTP status code, the provider's error code, the type of the email (verification or reset) and the sending language. The following are NOT written to this record: your email address, the verification link/token in the email, and the provider's descriptive message

How long they are kept:

Authentication event logs (the first two rows of the table) are kept for at most 90 days; entries past that period are deleted on a regular schedule (§8).
The providers' own operational logs and disaster-recovery backups are subject to their own retention periods and are not within our control.

3. Why do we process your data?

To provide the core function of the App: to store your symptom, cycle, medication and sleep entries on your device and show them back to you.
Personalization: to suggest content and tools based on your stage and the symptoms you log. This computation happens on your device.
Reminders: to deliver the reminders you set, on time.
Account security and management: sign-in, email verification, password reset, account deletion. So that we can send these emails in the language you chose, a copy of your language preference is kept in your account metadata (§2.2, §2.3).
Delivering your backup to you: creating your encrypted backup file when you ask for it and sending it to your verified email address (§6).
Meeting legal obligations: retaining consent records and responding to requests from competent authorities.
Improving the App: measuring which screens are used, where in the setup flow you get stuck, and where the App hits errors. This measurement runs only if you separately consent to it (§5.1).

What we do not do: We do not use your data for advertising or marketing, we do not sell it to third parties, and we do not build profiles to share with ad networks. The App contains no ad network. It does contain a tool that measures how you use the App and where it runs into errors; it runs only with your explicit consent (§5.1). The App does not diagnose and does not recommend doses or prescriptions. The emails we send load no remote images; meaning we do not track whether you opened them.

4. Lawful bases

How we collect it: your personal data is collected electronically, by wholly or partly automated means, through the App and the server infrastructure attached to it. The lawful basis for each data type is below:

Data type	Lawful basis
Health data (§2.1)	Explicit consent (KVKK Art. 6/2). You may withdraw your consent at any time (§11).
Email address	Establishment/performance of a contract (Art. 5/2-c)
User ID (UUID), account state and timestamps	Establishment/performance of a contract (Art. 5/2-c); required for your account and session to work
Consent records	Necessary for the establishment, exercise or protection of a right (Art. 5/2-e); proving that consent was given and withdrawn
Nickname	Legitimate interest (Art. 5/2-f); operating the core function
The server-side copy of your language preference (§2.2)	Legitimate interest (Art. 5/2-f); being able to send the identity emails in your language
Session, IP and security logs	Legitimate interest (Art. 5/2-f); account security
Usage and error records (§5.1)	Explicit consent (KVKK Art. 5/1). Explicit consent also for processing abroad (Art. 9; §7). It is not mandatory; you may withdraw your consent at any time (§11)

5. Who do we share your data with?

Recipient	Purpose	What is transferred
Supabase (infrastructure/hosting)	Database, authentication, server functions	Only the data in §2.2 (your account, your consent record) and the infrastructure records in §2.4. Your tracking records (symptoms, cycle, medications, sleep; §2.1) do not go here
Brevo (email delivery)	Delivering your backup file to you by email	(a) your email address, (b) the subject line of the email, (c) your encrypted backup file. Details in §6
Brevo (EU; GCP Belgium)	Email verification and password reset emails	Your email address only
PostHog, Inc. (usage measurement)	Measuring how the App is used and where it hits errors	Only the measurement data listed in §5.1 and the random measurement identifier generated on your device. Your tracking records (§2.1), your account ID and your email address are not sent here. Only if you have given explicit consent
Competent public authorities	Where required by law	Limited to the scope of the request

Beyond these, we make no transfer to any other third party. No ad network or data broker is used. The provider we work with for usage measurement is shown in the table above (§5.1).

Apple is not in this table, because that is not a transfer we make: if your phone's iCloud/iTunes backup is on, the operating system backs up your health database file to Apple. That depends entirely on your own device setting and is stated plainly in §2.3.

Honesty note: the data processing agreements (DPAs) with the providers above are annexes to their terms of service and are in force upon acceptance of those terms; there is no separate wet signature.

5.1 Usage measurement

To be able to improve the App, we measure how you use it: which screens are useful to you, which are never opened, where in the setup steps you get stuck, and where the App runs into errors. This measurement is not required; it runs only if you separately consent to the relevant item on the consent screen. If you do not consent, you keep using the whole App exactly as before and no feature is turned off.

What reaches us through the measurement is this:

which screen or tool you opened and which tab you switched to;
which area a record was created in — for example whether it was a symptom record or a sleep record; not the record itself;
which step of the setup flow you are on (the step number);
that you opened, completed or abandoned a piece of content or a tool;
the moment the App hit an error: the type of the error and the surface it happened on;
your app language, the platform you use and the app version;
a random measurement identifier generated on your device.

What does not enter the measurement is this:

your symptom, cycle and medication records do not take part in this measurement; neither do your sleep diary, your mood, your notes or your menopause stage;
the content of a record — its value, severity, count, date, duration, name, or any free text you wrote — is never sent;
which article you read is not sent.

The measurement uses a random identifier generated on your device. That identifier is not combined with your account, your email address or your user ID; we never send those to the measurement provider.

The measurement is carried out on our behalf by a service provider: PostHog, Inc. (San Francisco, United States). That provider is our data processor: it processes the data only on our instructions and may not use it for its own purposes. The data transferred is shown in the table in §5. A data processing agreement (DPA) is in force between us and the provider.

The measurement data is processed abroad. The data is stored in the provider's infrastructure in the Frankfurt (Germany) region, but the provider also processes it from countries outside Europe, including the United States, in order to deliver the service; we expressly agreed to this in the contract. The lawful basis for this is your explicit consent (KVKK Art. 9), and we ask for that consent through a separate item about usage measurement on the consent screen. This is a separate consent from the one you give for your account data to be processed abroad, and it is recorded separately: not giving the measurement consent, or withdrawing it later, does not affect your account or your other consents.

Measurement records are kept for a limited period and then deleted; the period is set by our provider's retention policy. When you withdraw your consent the measurement stops immediately and no new records are sent. The provider also offers a route for deleting records, but gives no commitment as to how long that deletion takes.

You can turn the measurement off whenever you want: Profile → Privacy and data → Consent preferences → Usage statistics. Turning it off takes effect immediately and you do not need to restart the App. When you turn it off, your measurement identifier is deleted as well. If you withdraw your consent to the processing of health data, the measurement is switched off along with it (§11).

6. Backups and exporting your data

Because your tracking records (symptoms, cycle, medications, sleep…) exist only on your device, the App gives you a way to take your own backup against the risk of losing your phone.

You create the backup:

When you create a backup, you are asked to set a password. The backup file is encrypted with that password.
Only you know this password. We do not store it and our server never sees it. If you forget it, the backup cannot be opened.

You can obtain the backup in two ways:

By sharing the file; you save it from your phone's share sheet to a destination you choose (Files, a cloud service, another device). On this path the file never passes through us.
By sending it to your own email address; our server takes the file and sends it to your address via our email provider (Brevo).


What is sent	Your encrypted backup file, your email address, and the subject line of the email
Who it is sent to	Only the verified email address of your own account. If you have not verified your email address, this path does not work
Can we open the file	No; the password is only yours. Neither we nor the provider can read the contents
Do we keep a copy	No. It is written to no storage and to no database table, and its contents are recorded in no log
Where it is processed	Our email provider is located in Belgium

Points we want to draw your attention to:

Even encrypted, this is a transfer of personal data. The fact that we cannot open the file does not mean, in legal terms, that we are not processing data.
The delivery is not anonymous. The sender address, the subject line and the file name identify Lumia. So even though the email provider cannot see inside the file, it does learn that "this address uses Lumia."
The email provider's own delivery logs are not within our control.
The file stays in your mailbox. Even if you delete your account, we cannot delete that copy; it is yours now.

7. Cross-border transfer

The data processed abroad is your account data (§2.2) and the infrastructure records (§2.4). They are processed in the Frankfurt (Germany) region; the server function that runs when you email yourself a backup is pinned to the same region, and our email provider is in Belgium (§6); both within the European Union. Usage measurement data is also processed abroad; its basis is the separate item about usage measurement on the consent screen, and that item is not mandatory (§5.1). The cross-border consent you give for your account data and the consent you give for measurement are obtained separately and recorded separately.
The legal basis is your explicit consent (Article 9 of KVKK). We ask for your consent to the processing of your account data abroad as a separate item on the consent screen, and we keep a record of it. Because our server is abroad, the practical way to withdraw this consent is to delete your account (§8); we are not hiding that.
Disclosure about possible risks: there is no adequacy decision announced by the Board for the countries the transfer is directed to; for as long as your data is processed abroad, exercising your rights may take longer than it would in Türkiye, and the Turkish authorities' ability to supervise processing abroad is more limited. On the other hand, Germany and Belgium, where our servers are located, are subject to EU data protection law (GDPR).
Given the nature of this App, the mere fact that "an email address is registered with Lumia" may itself amount to a statement about health; that is why the transferred set is deliberately kept minimal (your account data and your consent record), and your health diary is never moved abroad under any circumstances.

8. How long do we keep your data?

The health records on your device stay on your device until you delete them. Deleting the App also removes them.
Your account data is kept until you close your account.
Your session and security logs (§2.4; your IP address, sign-in and sign-up events) are kept for at most 90 days, and entries past that period are deleted on a regular schedule. The infrastructure providers' own operational logs and disaster-recovery backups are outside this; they follow the provider's own periods (see the note below).
When you delete your account, two things happen together: 1. Your account on the server and all records linked to it are deleted (the one exception is the consent record, two bullets below); 2. The health database on your device is destroyed as well. If the deletion is interrupted (for example if you close the App), the remaining part is completed the next time the App opens. The operation cannot be undone.
Your consent records are kept for 5 more years after your account is deleted, and are erased at the end of that period. The basis is Art. 5/2-e: we must be able to prove, even against a claim made after the account is closed, that consent was given and withdrawn. The record holds none of your health data; once the account is deleted it no longer contains your email address; only the random user ID (UUID) and the consent metadata remain.
Usage measurement records are kept by the measurement provider for a limited period and then deleted; the period is set by the provider's retention policy. Once you withdraw your consent, no new records are sent (§5.1).

9. How is your data protected?

For the data on your device:

The health database file sits in the App's own protected area; other apps on your phone cannot read it.
Your phone's device encryption covers this file too; so while your phone is locked, the file is encrypted.
An honest limit: the database file itself is not additionally encrypted with a separate password on top of device encryption.
Anyone who knows your phone's passcode can open the App.

For the data on the server:

Each user can access only their own data. This is enforced at the database level with Row Level Security; so even a bug in the application code cannot expose another user's data.
Data is encrypted in transit and at rest.
Our staff do not view users' records in routine operations.

We do not promise absolute security for any system; the above are the concrete measures we take.

10. Your rights under Article 11 of KVKK

By applying to the data controller, you may request to:

Learn whether your personal data is being processed,
Request information if it has been processed,
Learn the purpose of processing and whether it is used accordingly,
Know the third parties to whom it is transferred, in Türkiye or abroad,
Request correction if it is incomplete or inaccurate,
Request erasure or destruction,
Request that corrections/erasures be notified to third parties to whom the data was transferred,
Object to a result against you produced solely by automated analysis,
Claim compensation if you suffer loss due to unlawful processing.

How to apply: by email from the email address registered to your account to destek@lumiaapp.net, or in writing to Çukurambar mah. Zeki Ergezen cad. 2/4, Çankaya/Ankara. Your request will be concluded within 30 days at the latest.

From within the App you can also:

View and withdraw your explicit consent to health data processing from the Consent preferences screen (Profile → Privacy and data → Consent preferences): you can see what you consented to, with which version of the text and when, and withdraw it; you do not need to send a written request. §11 describes what happens when you do,
Create and download an encrypted copy of your records from the Backup screen (§6),
Delete account to permanently delete both your account on the server and your records on the device (§8),
Sign out; this does not delete the records on your device; it only ends your session.

Withdrawing your consent now happens inside the App. Earlier versions announced this screen as "upcoming"; it has now shipped and the first item in the list above tells you where to find it. The application address above has not closed; it stays open for your other Article 11 rights and for any problem you run into.

11. What happens if you withdraw consent?

What is deleted:

The personalization and tracking features that rely on this data stop working.
All of your health records on the device are deleted: your symptoms, your cycle, your hormone medications and dose records, your sleep diary, your reminders, the record of which articles you read, and your stage and stage assessment. (We count the reading record too, because §2.1 treats it as special category data; we do not carve out an exception to our own rule.)
Your scheduled reminder notifications are cancelled (titles you wrote yourself will not appear on your phone again) and the backup reminder is turned off.

What is not deleted; and why:

Your account is not deleted. Your email address, your password and your session stay as they are; this is not an account deletion. If you also want to delete your account, that is a separate route (§8).
Your consent record stays on the server, and a "withdrawn" entry is added on top of it (the existing record is not altered). We do this because we have to be able to show that you gave consent and that you withdrew it (Article 6/2 of KVKK; §2.0). That record contains none of your health data.
Your language preference and app settings (for example the length of the breathing exercise) are kept; they are not health data and deleting them would gain you nothing.

The usage measurement consent is separate: if you withdraw your usage measurement consent, the measurement stops immediately, pending records are not sent, and the measurement identifier on your device is deleted. Your account, your health records and your other consents are not affected. If you withdraw your consent to health data processing, usage measurement is switched off along with it (§5.1).

Withdrawal does not affect processing that was lawful before the date of withdrawal. You can change your mind again. After withdrawing, the App takes you back to the consent screen; if you want, you can consent again from there and start over. But the deleted records will not come back.

Backup files you took earlier remain in your hands; deleting them is up to you.

12. Changes

When we update this notice we will change the effective date and announce significant changes from within the App. If a change broadens the scope of health data processing, we will ask for fresh explicit consent.

This document is issued under the disclosure obligation in Article 10 of KVKK and should be read together with the Privacy Policy (privacy-policy.md).