Data Processing Agreement

This English version is a translation provided for convenience. In case of conflict the Turkish version prevails.

This Data Processing Agreement (the "Agreement") sets out the rights and obligations of the organization or individual using the EnaResearch service (the Customer, as defined in Section 1.1) and ENA Innovation regarding personal data processed on the Customer's behalf. It is based on Turkish Personal Data Protection Law No. 6698 ("KVKK") and its secondary legislation. Where Regulation (EU) 2016/679 (the "GDPR"), the United Kingdom GDPR (the "UK GDPR") or the Swiss Federal Act on Data Protection (the "FADP") applies to the Customer, Section 17 also applies.

1. Parties and scopeCopy Anchor Link

1.1. The parties are:

1.2. This Agreement applies together with the quote or order form accepted by the Customer, the Terms of Service and any other terms the parties agree in writing (together, the "Main Agreement").

1.3. On matters of personal data protection, this Agreement prevails over the Main Agreement in case of conflict. If the parties agree in writing to use the Customer's own data processing agreement, that agreement replaces this Agreement.

2. DefinitionsCopy Anchor Link

The terms "personal data", "special categories of personal data", "data subject", "data controller", "data processor", "processing" and "Board" have the meanings given in KVKK. In addition:

• Service: the provision of the EnaResearch software through its web application, participant web area, mobile application, wearable-device hub connection (where available) and the related ENA Cloud services (organization discovery and notification gateway).
• Customer Data: personal data entered into the Service by the Customer, its users or study participants, or collected or generated through the Service on the Customer's behalf.
• Sub-processor: a third party engaged by ENA Innovation to process Customer Data.
• Data Breach: the unlawful acquisition of Customer Data by others, or a security incident leading to it.
• Customer Environment: the application and data environment allocated to the Customer, running at organizationcode.enaresearch.com: a separate environment with its own application stack and its own database and database user.

3. RolesCopy Anchor Link

3.1. For Customer Data, the Customer is the data controller and ENA Innovation is the data processor. The Customer determines the purposes and means of processing.

3.2. ENA Innovation acts as a data controller only for processing for its own purposes, such as contract management, invoicing, communication with Customer representatives and the security of its own central services. That processing is governed by the EnaResearch Privacy Policy.

3.3. Apple and Google are not ENA Innovation's Sub-processors for Apple Health (HealthKit) and Health Connect data; this data is sent by the app on the participant's device directly to the Customer Environment.

4. Subject matter, nature and durationCopy Anchor Link

4.1. The subject matter and purpose of processing, the categories of data subjects and the categories of data are set out in Annex 1.

4.2. ENA Innovation processes Customer Data for the term of the Main Agreement and until the deletion or return period in Section 14 ends.

5. Customer instructionsCopy Anchor Link

5.1. ENA Innovation processes Customer Data only on the Customer's documented instructions. Instructions include the Main Agreement, this Agreement, settings the Customer makes in the Service (including study, measurement type, data source, device assignment, identifier type and encrypted copy, user and role settings, and enabling the AI assistant) and written requests from an authorized Customer representative.

5.2. If ENA Innovation believes an instruction violates KVKK or other legislation, it informs the Customer without delay and may suspend the processing concerned until the instruction is clarified.

5.3. If the law requires ENA Innovation to process Customer Data for another purpose, ENA Innovation informs the Customer before processing, unless the law prohibits it.

5.4. ENA Innovation does not use Customer Data for its own purposes; does not use it for advertising, marketing or profiling; does not sell it or share it with data brokers; and does not use it to train AI models.

6. Customer obligationsCopy Anchor Link

As data controller, the Customer is responsible in particular for:

• Determining the legal basis for each processing activity. Device and health-platform data, clinical records and manually entered values are a special category of personal data (health data); the Customer determines the legal basis for processing it under Article 6 of KVKK and, where applicable, Article 9 GDPR or the relevant legislation.
• Obtaining the ethics committee approvals and other permissions needed for the study.
• Informing data subjects under Article 10 of KVKK and other applicable law. The Participant Information Notice Template provided by ENA Innovation is only a starting point and is not legal advice.
• Obtaining, and being able to prove, consent where it relies on explicit consent.
• Enabling for each study only the measurement types and data sources the protocol requires, and making choices on the use of an identifier and on storing an encrypted copy in line with the principle of data minimization.
• Giving participant codes and activation keys only to the participant concerned, and renewing or revoking them when needed.
• Meeting its controller obligations, such as registration where applicable (for example VERBİS in Türkiye, records of processing under Art. 30 GDPR), a retention and destruction policy and responding to data subject requests.
• Assigning user roles and study team membership on a need-to-know basis and removing access for users who leave.

7. ConfidentialityCopy Anchor Link

7.1. ENA Innovation ensures that its employees and other persons working on its behalf who access Customer Data are bound by written confidentiality obligations. Under Article 12(4) of KVKK, these obligations continue after they leave their role.

7.2. Access to Customer Data is limited to the persons and the extent needed to provide, support, maintain and secure the Service.

7.3. ENA Innovation does not disclose Customer Data to third parties except as permitted by this Agreement. If a competent authority requests Customer Data, ENA Innovation informs the Customer, unless the law prohibits it, and limits the disclosure to what the law requires.

8. Data securityCopy Anchor Link

8.1. Under Article 12 of KVKK, ENA Innovation takes technical and organizational measures that ensure an appropriate level of security to prevent unlawful processing of and access to personal data and to safeguard it. These measures are set out in Annex 2. They are determined taking into account that the data processed includes special categories of data.

8.2. The measures may be updated as technology develops. Updates may not lower the overall level of protection described in Annex 2.

8.3. Under Article 12(2) of KVKK, the parties acknowledge that they are jointly responsible for taking data security measures. Settings within the Service, user accounts, roles, hubs and devices on the Customer's premises and datasets the Customer takes out of the Service are the Customer's responsibility.

9. Sub-processorsCopy Anchor Link

9.1. The Customer gives general written authorization for the engagement of the Sub-processors listed in Annex 3.

9.2. ENA Innovation notifies the Customer by email or within the Service at least 30 days before adding or replacing a Sub-processor. The notice states the Sub-processor's name, the processing activity and the place of processing.

9.3. The Customer may object in writing on reasonable grounds within 15 days of the notice. The parties will discuss a reasonable solution in good faith. If no solution is found, the Customer may terminate the Main Agreement for the affected part of the Service, without penalty, before the change takes effect.

9.4. If an urgent change is needed for security or service continuity, ENA Innovation makes the change and informs the Customer without delay. Section 9.3 still applies.

9.5. ENA Innovation imposes on each Sub-processor written data protection obligations no less protective than those in this Agreement. ENA Innovation remains liable to the Customer for a Sub-processor's failure to meet its obligations.

10. Cross-border transfersCopy Anchor Link

10.1. The region where the Customer Environment is hosted is set in the order form or the Main Agreement according to the Customer's choice. Using services marked as "cross-border transfer" in Annex 3 may require part of the Customer Data to be transferred outside that region.

10.2. For every cross-border transfer to which it is a party, ENA Innovation complies with Article 9 of KVKK as amended by Law No. 7499 and with the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad. Each transfer is based on an adequacy decision or, if there is none, on one of the appropriate safeguards, primarily the standard contract published by the Board.

10.3. Where ENA Innovation signs a standard contract as the data exporter, ENA Innovation notifies the Board within 5 business days of signing. Where the Customer is the data exporter, the notification is the Customer's responsibility, and ENA Innovation provides the information needed for it.

10.4. If a Sub-processor's standard terms do not allow the required safeguard to be put in place, ENA Innovation informs the Customer. The parties then jointly consider options such as an alternative provider or another legal basis.

11. Assistance with data subject requestsCopy Anchor Link

11.1. If a data subject request reaches ENA Innovation directly, ENA Innovation does not answer it. It forwards the request to the Customer within 5 business days and tells the requester that the request has been passed to the Customer.

11.2. The Customer handles data subject requests primarily with the Service's own tools (viewing records, export as CSV, Excel, SPSS (.sav) or R, with a data dictionary, revoking a participant code, deleting records). Where these are not enough, ENA Innovation provides reasonable technical assistance on the Customer's written request. To help the Customer meet the statutory response periods, ENA Innovation normally completes such assistance within 10 business days.

11.3. If data of a specific data subject must be permanently erased or anonymized, ENA Innovation does so, or shows the Customer how to do so, at the Customer's request. Exceptions needed to preserve the integrity of audit records are agreed with the Customer.

12. Data breach notificationCopy Anchor Link

12.1. When ENA Innovation becomes aware of a Data Breach affecting Customer Data, it notifies the Customer without undue delay and in any case within 48 hours of becoming aware of it. This period is intended to let the Customer notify the supervisory authority in time (under Article 12(5) of KVKK and the Board's decision on the 72-hour notification period, and, where applicable, Article 33 GDPR).

12.2. To the extent known at the time, the notice includes:

• the nature of the breach and the dates it started and was detected
• the categories of data affected and the approximate number of data subjects
• likely consequences
• measures taken and proposed
• a contact person at ENA Innovation

If information is not yet available, ENA Innovation does not delay the first notice; it adds information as it becomes known.

12.3. ENA Innovation takes the measures needed to limit the effects of the breach and reasonably assists the Customer in notifying the supervisory authority and data subjects. The obligation to make these notifications rests with the Customer as data controller. ENA Innovation does not announce the breach to third parties on the Customer's behalf without the Customer's prior written approval, unless required by law.

12.4. Data Breach notices are sent to the email address and phone number of the authorized person the Customer names under the Main Agreement. The Customer keeps this information up to date.

13. Audits and informationCopy Anchor Link

13.1. At the Customer's request, ENA Innovation provides the information and documents needed to demonstrate compliance with this Agreement. This includes answering security questionnaires, keeping the annexes to this Agreement up to date and providing reasonable information for the Customer's data protection impact assessment.

13.2. Under Article 12(3) of KVKK, the Customer may carry out an audit itself or through an independent auditor. An audit:

• takes place at most once a year, with additional audits allowed after a Data Breach, at a supervisory authority's request or on serious suspicion of non-compliance
• requires at least 30 days' written notice and a scope agreed in advance
• takes place during business hours without unreasonably disrupting ENA Innovation's operations
• gives no access to other customers' data or to ENA Innovation's trade secrets
• is carried out under a confidentiality undertaking, at the Customer's cost unless agreed otherwise

13.3. This Agreement does not mean that ENA Innovation or the Service holds any certification or is compliant with any law. The Service is designed to support the Customer's obligations.

14. Term, termination, return and deletionCopy Anchor Link

14.1. This Agreement takes effect together with the Main Agreement and remains in force until ENA Innovation stops processing Customer Data.

14.2. Before the Main Agreement ends, the Customer can retrieve its data with the Service's export tools (CSV, Excel, SPSS (.sav) or R, with a data dictionary). If the Customer requests it in writing within 30 days after termination, ENA Innovation delivers a copy of the Customer Data in a common machine-readable format.

14.3. Within 30 days after the Main Agreement ends, ENA Innovation shuts down the Customer Environment and deletes Customer Data, including databases, file storage and backups (encrypted measurement-database backups, nightly database dumps and dumps taken before updates, file storage archives and any remote copy of them). Automatic backups of the managed database service are deleted automatically when their configured retention period expires.

14.4. If the law requires a longer retention period, ENA Innovation keeps the data concerned only for that purpose and period, keeps it confidential and deletes it at the end of the period.

14.5. At the Customer's request, ENA Innovation confirms in writing that deletion is complete.

15. LiabilityCopy Anchor Link

15.1. Each party is liable for breaching its own obligations under this Agreement and the applicable data protection law.

15.2. The limitations of liability in the Main Agreement apply to this Agreement to the extent permitted by law. Liability is not limited for intent, gross negligence or where the law does not permit a limitation.

16. Governing law and other termsCopy Anchor Link

16.1. Unless the Main Agreement provides otherwise, this Agreement is governed by the laws of the Republic of Türkiye. The jurisdiction clause of the Main Agreement applies to disputes.

16.2. If any provision of this Agreement is held invalid, the other provisions are not affected.

16.3. ENA Innovation may update this Agreement to reflect changes in legislation or in the Service. Material changes to the Customer's detriment are notified to the Customer at least 30 days before they take effect.

16.4. This Agreement is published in Turkish and English. In case of conflict, the Turkish version prevails.

17. Customers subject to the GDPR, the UK GDPR or the FADPCopy Anchor Link

17.1. Where the GDPR, the UK GDPR or the FADP applies to the Customer, this Agreement is applied so as to cover the matters required by Article 28(3) GDPR (and the corresponding provisions of the UK GDPR and the FADP). References to KVKK are then read as references to the corresponding provisions of the applicable law.

17.2. ENA Innovation assists the Customer with its obligations under Articles 32 to 36 GDPR (security of processing, breach notification, data protection impact assessment and prior consultation), taking into account the nature of processing and the information available to ENA Innovation.

17.3. Where Customer Data needs to be transferred from the EEA, the UK or Switzerland to Türkiye or to another country without an adequacy decision, the parties sign the European Commission's standard contractual clauses separately (with the adaptations for the UK and Switzerland where needed). Module Two (controller to processor) is used where the Customer is a controller, and Module Three (processor to processor) where the Customer is itself a processor; for the UK the International Data Transfer Addendum, and for Switzerland the adaptations recognized by the FDPIC, are added.

18. ContactCopy Anchor Link

Annex 1: Details of processingCopy Anchor Link

Subject matter and purpose. Collecting data for the Customer's research studies from mobile health platforms (Apple Health, Health Connect) and, where available, wearable devices (through a hub or the participant's phone); recording clinical records entered or imported by the research team (admissions and discharges, procedures such as surgery, clinical events, free-text notes; import from CSV or FHIR R4), manually entered values and eligibility assessments; validating data, converting it to a standard form and organizing it according to the study protocol; deriving research variables and producing statistical results; managing studies, participation, participant codes and device assignments; monitoring data transfer and synchronization status and showing the participant, in the participant web area (participant code and PIN), the transfer status and a daily summary; matching people within the Customer Environment with researcher approval; exporting pseudonymized datasets; sending the emails the Customer chooses; where the Customer enables the AI assistant, sending aggregate study information to its provider; support, maintenance and security.

Nature of processing. Collection, recording, import, storage, validation, standardization, organization, matching (with researcher approval), viewing, summarizing, derivation of research variables and statistical analysis, pseudonymization, export, transfer (to the email delivery provider and, where the AI assistant is enabled, aggregate information only to its provider) and deletion.

Data subjects and data categories:

Special categories of personal data. Device and health-platform data, clinical records and manually entered values are health data. The legal basis, ethics approval and informing data subjects are the Customer's responsibility under Section 6.

Retention. Customer Data is kept until the Main Agreement ends or, where the Customer sets a shorter period for a study, until that period, counted from the study's final closure, expires; Section 14 then applies. When a study's period expires, its measurement data, clinical records, export files, analysis results and AI assistant history are deleted; the study record, its definitions (protocol, variables, dataset and analysis plans), study pseudonyms and the audit log are kept. When a participant withdraws, the Customer can delete the data of that participation. Raw device payloads are deleted after 90 days; their standardized form is kept under the rules above. Export files are deleted after 30 days. Encrypted backups are kept for up to 35 days. Measurements not yet transferred from the participant's device are kept there until the Customer Environment confirms that it has stored them permanently, and are then deleted from the device.

Annex 2: Technical and organizational measuresCopy Anchor Link

Environment separation

• Each Customer has its own Customer Environment: a separate environment with its own application stack and its own database and database user. One Customer's data cannot be reached from another Customer's environment.
• The organization code is used only for routing; it does not grant access by itself.

Transport security

• All traffic is encrypted with TLS. Where a hub is used, its connection is also made over TLS.

Authentication and authorization

• Organization users sign in through an invite-only identity service (Logto); public sign-up is disabled.
• For every protected action, identity, role, Customer context and study team membership are checked on the server; access is denied by default. The owner manages users and approves studies; the user who opens a study is its principal investigator; researchers access only studies whose team they belong to.
• Participants do not use accounts; a one-time, time-limited activation, a device-bound session and a PIN are used. Rate limiting, increasing delays or lockout, and audit logging apply to sign-in attempts. Revoking a participant code ends all of that participant's device sessions.

Data minimization and pseudonymization

• The person identifier is not stored in clear text; a keyed hash (HMAC) and the last 4 characters are kept. An encrypted copy (AES-GCM) is kept only if the Customer switches it on; switching it off deletes the copies.
• The identifier is not included in exports, the mobile app or audit records.
• Participants are shown under a pseudonym (for example P001) in exported datasets.
• In person matching, researchers see candidates in masked form; records are merged only with researcher approval.
• A study sees only the data within its own participation period and for the measurement types it allows.
• The AI assistant is off by default and works only if the Customer enables it. Only aggregate study information and text the researcher types are sent to its provider; counts below 5 are suppressed; no participant-level records or identity data are sent. Every request is logged.

Logging and traceability

• Sensitive operations, access to participant data, matching, exports and permission changes are written to the audit log.
• Health data is not copied into application logs unnecessarily. Application access logs do not record URL query strings (for example search terms), and failed participant sign-in attempts are logged without the code that was entered. When the error monitoring service is enabled, it is configured not to send personal data.

Backup and continuity

• The measurement database is backed up daily; backups are encrypted (AES-256) and kept for 35 days (the most recent backup chain is always kept). They may also be copied to a remote S3-compatible store in the Customer Environment's hosting region or in another region agreed with the Customer.
• Every night a dump of the application database and an archive of the file storage are taken, encrypted (AES-256) and kept for 14 days; the 10 most recent dumps and the most recent archive are always kept, even if they are older.
• An encrypted database dump is taken before each update; these dumps follow the same retention rule.
• The database is also protected by the managed database service's automatic backups.

Organizational measures

• Access to Customer Data is limited to staff who need it for their work, and staff are bound by confidentiality obligations.
• Security vulnerabilities are received and assessed through the published responsible disclosure policy.
• Sub-processors are bound by written obligations under Section 9.

Annex 3: Sub-processorsCopy Anchor Link

Notes

• ENA Cloud (organization discovery and notification gateway) is operated by ENA Innovation itself and is not a Sub-processor.
• Apple and Google are not Sub-processors (Section 3.3).
• The current list is also published on the Sub-processors page. The full legal names and processing locations of Sub-processors are provided in writing on request.