Privacy Policy

1. Purpose and Scope

This Privacy Policy explains how we collect, use and protect personal data when you use the ATAC Med. School website and mobile application (the "Service"). By using the Service you agree to the practices described here. Users subject to Turkish law (KVKK) may also refer to the Turkish KVKK Information Notice on the Turkish site.

2. Data Controller

The data controller for the Service is the operator of the platform offered under the ATAC Med. School brand.

Contact: iletisim@atacakademi.com.

3. Data We Collect

Depending on how you use the Service, we process:

• Information you provide at signup: first name, last name, email address, university, year of study.
• Account information: user ID, user code, subscription status, profile updates.
• Learning data: questions answered, correct/wrong records, per-subtopic performance, total answered, accuracy ratio, daily streak.
• Content preferences: saved questions, your wrong-answer pool, answers given in the anatomical structure labeling exercise.
• Social data: friend requests and friend list.
• Messaging data: the content, timestamp and parties of direct messages you send and receive; records of users you have blocked; reports you file or that are filed about you, together with the message excerpts attached to those reports.
• Support requests and account deletion logs.
• Payment/subscription state (handled by App Store / Google Play; we do not store your card details).
• Device and technical data: app version, error logs, IP / device identifiers.

4. Why We Process Data

We process your data to:

• Create your account, sign you in, and authenticate you.
• Deliver and personalize content (your wrong-answer pool, module progress, streak).
• Run the quiz, anatomy labeling, and statistics features.
• Manage subscriptions and gate premium content.
• Detect errors, secure the Service and prevent abuse.
• Respond to support requests.
• Provide the messaging feature; prevent abuse, review user reports and keep the community safe.
• Comply with legal obligations and protect rights.

5. Legal Bases

Where applicable, processing is based on contract performance (delivering the Service), compliance with legal obligations, and our legitimate interests (security, improvement, abuse prevention). Where required by law, explicit consent is requested separately.

6. Data Sharing

Your data may be shared with the following categories of recipients for the purpose of providing the Service:

• Cloud and infrastructure providers (e.g. Google Firebase) — authentication, database, Cloud Functions, logging.
• Subscription platforms — Google Play and Apple App Store.
• AI assistant provider (Anthropic) — the questions you type and any images you attach to the AI assistant are sent to Anthropic to generate a response; this content is not used for advertising.
• Competent authorities — where legally required. Where content is assessed to constitute a criminal offence, or upon a lawful request from competent authorities, your message content and related account information may be shared with those authorities.

7. International Data Transfers

Because we use Firebase, store platforms and an AI assistant provider, your data may be processed or stored on servers outside your country (including in the EU, US or elsewhere) by Google, Apple and Anthropic. We aim to apply appropriate technical and organizational safeguards for such transfers.

8. Retention

Account data is retained while your membership is active, and thereafter for the periods required by law or for handling disputes. Learning/statistics data is kept as long as needed for the Service's functionality. Error and log records are limited to reasonable periods (e.g. 6–24 months). When you delete your account from within the app, your profile, answer history, wrong-answer pool, saved questions and friend records are deleted or anonymized. Message content is permanently deleted from our servers 30 days after it is sent; conversations that are reported or subject to a lawful request are exempt from this automatic deletion. Connection metadata (who messaged whom and when) may be retained separately from content due to legal obligations. When you delete your account, your messages are deleted together with the one-to-one conversations you took part in. Reports filed about you and the message excerpts attached to them are moderation and legal records, and may be retained after account deletion for the periods required by law.

9. Security

We apply technical and organizational measures to protect your data — access control, secure transport (TLS), owner-based access rules on Firestore, least-privilege principle, and error monitoring. No internet-based system is 100% secure, but we treat security as a continuing obligation.

Messaging is NOT end-to-end encrypted. Messages are encrypted in transit and protected by server-side access rules, but they remain technically readable by us. Please do not use messaging to share sensitive health data, identity documents or confidential information.

10. Messaging and Content Moderation

In-app messaging is available only to premium members and only between users who are mutual friends. Only text can be sent; photos and other media are not supported.

Before you use messaging for the first time, we show you a notice covering the points in this section and ask for your acceptance. Messaging is not enabled until you accept. If the notice changes materially, your acceptance is renewed.

When you report a user, the recent messages in that conversation are shared with the moderation team and retained with the review record so that the report can be assessed. This is necessary for the reporting mechanism to work.

Where content is assessed to constitute a criminal offence, or upon a lawful request from competent authorities, your message content and related account information may be shared with those authorities.

To use messaging you must provide your phone number. The number is processed to prevent abuse and to identify the correct person to the authorities if messaging is used to commit a crime; it is never shown to other users and is not used for marketing. In addition, when you sign in and when you use messaging, the time of the action and your IP address are kept as traffic records. These records contain no message content, are deleted automatically after 2 years, and are used only for moderation review and lawful requests from competent authorities.

Message content is automatically and permanently deleted from our servers 30 days after it is sent. If something goes wrong you therefore need to report it within that window.

For a reported conversation, retention works as follows: messages are not deleted while the review is ongoing; if the report is dismissed the conversation returns to the normal 30-day rule and the report leaves no lasting effect; if the report is upheld the messages are retained as evidence for 2 years and deleted at the end of that period. Indefinite retention is not applied.

Every message you send passes through an automated content filter. The filter only detects inappropriate language; it is not used for profiling, advertising or any other purpose.

You can block any user at any time. Blocking stops messaging, friend requests and challenges in both directions.

11. Cookies and Similar Technologies (Web)

The ATAC Med. School website may use cookies and similar technologies that are necessary for session management, security and core functionality. You can manage cookies via your browser settings; some features may be limited if you disable them.

12. Your Rights

Subject to applicable law (including GDPR for EU/EEA users and KVKK for Turkish users), you may have the rights to be informed about and access your data, request correction or deletion, object to certain processing, withdraw consent, and lodge a complaint with a supervisory authority. To exercise these rights contact: iletisim@atacakademi.com.

13. Children's Privacy

Data of users who are not of age may be processed only with legal guardian permission and within the limits of applicable law. If you believe the data of a minor has been processed unlawfully, please contact us.

14. Changes

We may update this policy from time to time. The current text takes effect when published on the Service. For material changes we may notify you in-app or by email.