Agreements
Acceptable Use Policy
Which uses of EnaResearch are permitted and which are prohibited for customer organizations, their researchers and the participants of their studies.
This English version is a translation provided for convenience. In case of conflict the Turkish version prevails.
This Acceptable Use Policy (the "Policy") sets out how the EnaResearch service may be used. It applies to the Service as defined in the Terms of Service: the web administration interface, the participant web area, the EnaResearch mobile app (iOS and Android), the wearable-device hub connection (where available), the API and related support services. The Policy supplements Section 9 of the Terms of Service and forms part of the Contract Documents. Terms such as Customer, User, Participant, Customer Environment and Customer Data have the meanings given in the Terms of Service.
1. Who this applies to
The Policy applies to:
- the organization or individual using the Service (the "Customer"), for example a hospital, university, research center, research lab, research group, department, clinic or independent researcher;
- the Customer's organization users (owners and researchers; "Users");
- people who take part in a Customer's study and use the participant web area or the mobile app ("Participants"), for the rules in Section 8;
- visitors of the www.enaresearch.com website.
The Customer is responsible for its Users' compliance with this Policy.
2. Research only within an approved, lawful framework
EnaResearch is meant for research that the Customer runs on its own responsibility. In particular, the Customer and Users must not:
- start collecting personal data in a study before the approvals required for that study are in place, for example ethics committee approval, institutional approval or the approval of a competent authority where the law or the Customer's own rules require it;
- add Participants to a study, issue activation cards to them or collect their data without the legal basis the Customer has determined for the study, and in particular without explicit consent where explicit consent is the legal basis (for example under Article 6 of Turkish Law No. 6698 ("KVKK") or Article 9 GDPR for health data);
- collect data from a person without first giving them the participant information notice the Customer is responsible for (our Participant Information Notice Template is only a starting point);
- continue to collect data from a Participant who has withdrawn from the study; the research team ends the participation and revokes the participant code;
- give access to a study, its data or its datasets to people who are not part of the approved study team.
Whether a study needs ethics approval or consent, and which law applies, is the Customer's decision. ENA Innovation does not check approvals and does not make that determination.
3. Data minimization and study scope
The Customer decides for each study which measurement types, data sources, identifier and retention period are used. When doing so, the Customer and Users must not:
- request or upload data that goes beyond the approved study protocol, for example measurement types, clinical records, free-text notes or attachments the protocol does not cover;
- enable sensitive measurement types (for example reproductive health or sexual activity data) unless the ethics approval and the participant information explicitly cover them;
- use free-text fields, clinical notes or imported files (CSV, FHIR R4) to store data that is not needed for the study, such as national ID numbers, contact details of third parties or unrelated medical history;
- import data about people who are not Participants of a study in that Customer Environment;
- set retention periods longer than the study and the applicable law require.
4. No re-identification
EnaResearch reduces identifiability where it can: the person identifier is stored as a keyed hash, exports use pseudonyms (for example P001), and groups smaller than 5 are hidden in aggregates and in AI assistant context. The Customer and Users must not:
- try to re-identify Participants from pseudonymized exports, aggregates or AI assistant output, or link them with other data sources for that purpose, except where the approved protocol and the law expressly allow it;
- try to work around small-group suppression, for example by running many overlapping queries or filters to isolate an individual;
- share exported datasets with people outside the approved study team, publish them, or transfer them to third parties without the legal basis and safeguards the Customer is responsible for;
- use data from the Service to profile, score or take decisions about individual Participants outside the research purpose, for example for employment, insurance, credit or marketing.
5. Not a medical device
EnaResearch is not a medical device. The Service must not be used:
- for diagnosis, treatment, prevention or monitoring of disease, clinical decision support or vital-sign monitoring;
- as an alarm or emergency system; the Service does not monitor data in real time and raises no health alerts;
- to give Participants the impression that their data is being watched for their safety.
Statistical results and AI assistant texts are research aids and must be reviewed by the Customer.
6. Accounts, codes and activation cards
- Organization user accounts are personal. Users must not share sign-in details or let others act through their account.
- Activation cards, participant codes and activation keys must be given only to the Participant concerned. The research team must not activate the mobile app on a Participant's behalf without the Participant's knowledge, or activate it on a device that is not the Participant's.
- Users should be given only the roles and study team membership they need. The Customer removes access promptly for people who leave.
- No one may act as if on behalf of another person, organization or ENA Innovation.
7. AI assistant
Where the Customer enables the optional AI assistant (off by default):
- Users must not type participant-level data, names, identifiers, contact details or other directly identifying information into the assistant;
- assistant output must not be used as a clinical statement or as the only basis for a scientific conclusion; it must be checked by the researcher;
- the assistant may be used only for the study it is opened in.
8. Rules for Participants
Participants use the mobile app and the participant web area at the Customer's invitation. Participants must not:
- use another person's activation card, participant code or PIN, or pass theirs on to others;
- enter or send data they know to be false, or send data from another person's device or health account;
- try to access data of other Participants, the Customer Environment or the Service beyond their own participant interface.
Questions about the study itself should be directed to the research team. The End User License Agreement sets out the other terms for the mobile app.
9. Abuse of system resources and security
- No one may try to bypass rate limits, access controls, sign-in lockouts or other security measures.
- Load testing, denial-of-service testing, scraping and automated mass requests against the Service are prohibited.
- Malware, links to phishing pages or other harmful content must not be uploaded to the Service.
- Security research is allowed only within the scope and rules of the Responsible Disclosure Policy. If the Customer wants to have its own Customer Environment tested, it must first obtain written permission via support@enainnovation.com.
10. Unlawful content and third-party rights
Content that infringes the law of Türkiye or of the country where the Service is used, or the intellectual property, personality or privacy rights of others, must not be uploaded to the Service. This includes questionnaires, scales or instruments the Customer has no right to use.
11. Reporting violations
| Topic | Contact |
|---|---|
| Misuse of the Service | support@enainnovation.com |
| Security vulnerabilities | support@enainnovation.com (see the Responsible Disclosure Policy) |
| Personal data | support@enainnovation.com (see Data Subject Requests) |
Requests about data in a study should first be sent to the organization running the study. ENA Innovation forwards such requests it receives to the organization concerned.
12. Enforcement
12.1. Depending on the severity of the violation, ENA Innovation may:
- inform the Customer and ask for the violation to be remedied;
- with the Customer or on its instruction, restrict access to the content or data concerned;
- temporarily suspend the user account, participant code or feature concerned (for example the AI assistant);
- suspend the Service in whole or in part under Section 13 of the Terms of Service;
- terminate the agreement under Section 16 of the Terms of Service.
12.2. If the security of the Service, other customers, Participants or third parties is under serious and imminent threat, ENA Innovation may act first and inform the Customer afterwards.
12.3. For Customer Data, ENA Innovation acts on the Customer's instructions, as set out in the Data Processing Agreement, unless the law requires otherwise. ENA Innovation does not review Customer Data in advance and has no obligation to monitor it.
13. Changes
ENA Innovation may update this Policy. Changes that materially affect the Customer are notified to the Customer's registered email address at least 30 days before they take effect. The current version is published on this page with its effective and update dates.
This Policy is published in Turkish and English. In case of conflict, the Turkish version prevails.