Privacy and data protection
Data Subject Requests
How participants and other data subjects exercise their KVKK, GDPR, UK GDPR and Swiss FADP rights for data processed with EnaResearch.
This English version is a translation provided for convenience. In case of conflict the Turkish version prevails.
This page explains how to exercise your rights over personal data processed with EnaResearch: the rights in Article 11 of Turkish Law No. 6698 on the Protection of Personal Data ("KVKK"), in Articles 15 to 22 of Regulation (EU) 2016/679 (the "GDPR") and the United Kingdom GDPR ("UK GDPR"), and in the Swiss Federal Act on Data Protection ("FADP"). Which law applies depends on who processes your data and where; this page does not decide that for you.
1. First, find out who is responsible for your data
Who you should write to depends on the data concerned. The same role split applies as in our Privacy Policy (Section 2) and Data Processing Agreement.
| Your situation | Data controller | Where to send your request |
|---|---|---|
| You take part, or took part, in a study run with EnaResearch (identity details, device and health-platform data, clinical records, manually entered values, participation records, mobile app and participant web area sessions) | The organization running the study (the Customer), for example a hospital, university, research center or independent researcher | The organization's contact point named in the participant information notice you received; or your research team |
| You use EnaResearch as an owner or researcher of an organization (your user account, study team membership, audit records, text you typed into the AI assistant) | The organization you work for (the Customer) | Your organization's administrator or data protection contact |
| You visited www.enaresearch.com, filled in a contact or demo form, receive our commercial emails, or are the contact person of a customer or prospective customer | ENA Innovation | ENA Innovation directly (Section 3) |
For data in a study or an organization's Customer Environment, ENA Innovation is only the data processor: it processes the data on the organization's instructions and does not decide whether a request is granted. ENA Innovation also does not hold the information needed to confirm who a participant is; only the research team can link a participant code to a person.
If such a request reaches us: we do not answer it ourselves. We forward it to the organization concerned within 5 business days and let you know that we have done so. We then help the organization answer it, normally within 10 business days of its written request. If we cannot tell from your request which organization runs your study, we will ask you; please do not send health data or copies of identity documents for this purpose.
2. If you are a study participant
2.1. What you can do yourself
- Stop data transfer from your phone: in the EnaResearch app, choose "Disconnect this device". Transfer stops immediately, and measurements on the device that have not yet been sent are deleted from the device. You need a new activation card from your research team to reconnect.
- Withdraw health data permissions: you can withdraw access in Apple Health (iOS) or Health Connect (Android) at any time in the operating system settings; no new data is read after that. See the Health Data Statement.
- Uninstall the app: the app's data on the device is deleted. Data already transferred to the organization stays with the organization and is subject to its retention rules.
- See your transfer status: the participant web area (with your participant code and PIN) shows the transfer status and a daily summary.
These steps do not delete data already held by the organization. To withdraw from the study, or to request access, correction or deletion, contact your research team.
2.2. What the organization can do with EnaResearch
With the Service's own tools, the organization can view your records, export them (CSV, Excel, SPSS (.sav) or R, with a data dictionary), correct identity details, end your participation, revoke your participant code (which also ends the session on your device) and, when you withdraw, delete the data of that participation. Where these tools are not enough, ENA Innovation provides technical assistance on the organization's request.
2.3. Limits the organization may apply
Whether a request is granted is decided by the organization as data controller under the law that applies to it. For example, data protection laws contain specific rules for scientific research, and the organization may keep certain records to keep the study and its audit trail intact (EnaResearch keeps study pseudonyms and the audit log after a study's data is deleted). The organization must explain its decision to you. ENA Innovation does not take these decisions.
3. Requests to ENA Innovation as data controller
3.1. How to apply
| Method | How |
|---|---|
| Write to support@enainnovation.com from the email address you gave us (for example in a form or in correspondence). Subject: "Data subject request". | |
| Written application | Send a signed letter to ENA Innovation Sağlık ve Yazılım Teknolojileri San. Tic. A.Ş., Battalgazi Mah. Eskişehir Yolu Bulv. A.N.S. Kampüsü, Zafer Technopark, Merkez/Afyonkarahisar, Türkiye. For applications under KVKK, please write "Information Request under the Personal Data Protection Law" on the envelope. |
| Secure electronic or mobile signature (KVKK) | Send your application signed with a secure electronic signature or mobile signature to support@enainnovation.com. |
You may write in Turkish or English.
3.2. What to include
- Your full name and, for written applications, your signature.
- Your contact address (email or postal) for our response.
- Which right you want to exercise and a clear description of your request.
- Any information that helps us find your data (for example the date of a form you sent or the organization you work for).
- For applications under KVKK: the information listed in Article 5 of the Communiqué on the Procedures and Principles of Application to the Data Controller (the "Communiqué"), including your Turkish ID number (citizens of Türkiye) or nationality and passport or ID number (foreign nationals), and your residential or business address.
We may ask for additional information to verify that the request comes from you; we ask only for what we need for that. If you apply on someone else's behalf, please attach proof of your authority (for KVKK applications, a notarized power of attorney granting specific authority; for persons under parental authority or guardianship, a document showing that authority).
3.3. Your rights
| Right | KVKK (Art. 11) | GDPR / UK GDPR | FADP |
|---|---|---|---|
| Learn whether your data is processed, get information and a copy | Yes | Access, Art. 15 | Information, Art. 25 |
| Correction of inaccurate data | Yes | Art. 16 | Art. 32 |
| Deletion or destruction | Yes, under the conditions of Art. 7 | Art. 17 | Art. 32 |
| Notification of correction or deletion to recipients | Yes | Art. 19 | |
| Restriction of processing | Art. 18 | ||
| Data portability | Art. 20 | Art. 28 | |
| Objection (including to direct marketing) | To a result against you arising exclusively from automated analysis | Art. 21 | Art. 30–32 |
| Not to be subject to solely automated decisions | See above | Art. 22 | Art. 21 |
| Withdraw consent | Yes | Art. 7(3) | Yes |
| Compensation for damage from unlawful processing | Yes | Art. 82 | Under Swiss civil law |
You can withdraw consent to commercial emails at any time with the link in each message, without making a formal request.
3.4. Response time
- KVKK: as soon as possible depending on the nature of the request and within 30 days at the latest.
- GDPR and UK GDPR: within one month of receipt; for complex or numerous requests this can be extended by two further months, in which case we tell you why within the first month.
- FADP: information requests within 30 days; if this is not possible, we tell you within that period when you will receive it.
We reply in writing or electronically. If we refuse a request in whole or in part, we give the reasons.
3.5. Fees
Requests are free of charge. Under KVKK, if the action requires an additional cost, the tariff in Article 7 of the Communiqué may apply (for written responses over 10 pages, 1 Turkish lira for each page above 10; for responses on a recording medium, the cost of the medium); any fee charged is refunded if the application results from our error. Under the GDPR, the UK GDPR and the FADP, we may charge a reasonable fee or refuse to act only where a request is manifestly unfounded or excessive, as those laws allow.
4. Complaints to a supervisory authority
If you are not satisfied with the response, you can complain to a supervisory authority:
- Türkiye: the Personal Data Protection Board (KVKK Art. 14), within 30 days of learning of the response and in any case within 60 days of the application date. Under KVKK you must apply to the data controller first.
- European Economic Area: the supervisory authority of the country where you live or work or where the alleged infringement took place.
- United Kingdom: the Information Commissioner's Office (ICO).
- Switzerland: the Federal Data Protection and Information Commissioner (FDPIC).
For data in a study, complaints concern the organization running the study as data controller. Our representatives in the EU, the UK and Switzerland, where appointed, are listed in the GDPR Privacy Notice.
5. Contact
For questions about this process: support@enainnovation.com · +90 850 308 45 91
Address: ENA Innovation Sağlık ve Yazılım Teknolojileri San. Tic. A.Ş., Battalgazi Mah. Eskişehir Yolu Bulv. A.N.S. Kampüsü, Zafer Technopark, Merkez/Afyonkarahisar, Türkiye