GDPR Privacy Notice

This English version is a translation provided for convenience. In case of conflict the Turkish version prevails.

This notice is for people in the European Economic Area (EEA), the United Kingdom or Switzerland whose personal data is processed by ENA Innovation, for example when they visit www.enaresearch.com, contact us, or work for a customer organization. It supplements our Privacy Policy, which describes all processing in detail, and is given under Articles 13 and 14 of Regulation (EU) 2016/679 (the "GDPR"), the United Kingdom GDPR (the "UK GDPR") and the Swiss Federal Act on Data Protection (the "FADP"). For processing under Turkish law, see the KVKK Privacy Notice.

1. ControllerCopy Anchor Link

ENA Innovation Sağlık ve Yazılım Teknolojileri San. Tic. A.Ş., Battalgazi Mah. Eskişehir Yolu Bulv. A.N.S. Kampüsü, Zafer Technopark, Merkez/Afyonkarahisar, Türkiye. Contact for personal data: support@enainnovation.com.

Trade registry: Afyonkarahisar Trade Registry Office, registration no. 18590 · MERSİS no. 0334130943400001 · Tınaztepe Tax Office, tax ID 3341309434 · D-U-N-S number 448896706.

• EU representative (Art. 27 GDPR): where we are required to appoint one, its name and contact details are published in this section. Until then, write to the address above.
• UK representative (Art. 27 UK GDPR): where we are required to appoint one, its name and contact details are published in this section. Until then, write to the address above.
• Swiss representative (Art. 14 FADP): where we are required to appoint one, its name and contact details are published in this section. Until then, write to the address above.
• Data protection officer: we have not appointed a data protection officer, because the conditions of Article 37 GDPR do not apply to the processing we carry out as controller. We review this assessment regularly, including in view of the health data we process as processor in EnaResearch. Write to the address above for any data protection question.

2. When we are controller and when we are processorCopy Anchor Link

We are the controller for the website, contact and demo requests, customer contracts, billing, support and commercial messages you opted in to.

We are a processor for data processed in an EnaResearch Customer Environment, such as study participants' identity details, wearable-device, Apple Health and Health Connect data, and study and participation records. The organization or individual that uses EnaResearch to run the study (for example a hospital, university, research center, research lab, research group, department, clinic or independent researcher) is the controller for that data; it is the organization's responsibility to give you its own privacy notice, to determine the legal basis (including Art. 9 GDPR for health data) and to obtain ethics approval. We process such data only on the organization's documented instructions, under a Data Processing Agreement that contains the terms required by Article 28 GDPR. Please send requests about that data to the organization running the study; requests that reach us are forwarded to it.

3. Data, purposes and legal basesCopy Anchor Link

Where we rely on legitimate interests, we have weighed them against your interests and rights; you can ask us for details. We do not process special categories of data as controller. When we receive your data from someone else (for example from a customer organization that employs you), it is limited to your name, work contact details and role.

For people covered by the FADP, the same purposes and data categories apply; processing follows the general principles of the FADP (Art. 6).

4. RecipientsCopy Anchor Link

We share data only with service providers acting as our processors (hosting, identity, e-mail delivery and error monitoring services; see Sub-processors), with professional advisers under confidentiality, and with public authorities where the law requires it. We do not sell personal data.

In the EnaResearch service, if an organization enables the optional AI assistant (off by default), aggregate study information and text the researcher types are sent to Anthropic (USA) as a sub-processor; participant-level records and identity data are not sent.

5. Transfers outside the EEA, the UK and SwitzerlandCopy Anchor Link

ENA Innovation is established in Türkiye, so data you send to us is transferred to Türkiye, which has no adequacy decision of the European Commission, the United Kingdom or Switzerland. Some of our providers process data in other countries, including the USA (for example Vercel and Resend, and Anthropic if an organization enables the AI assistant).

For these transfers we rely on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR), for the UK on the International Data Transfer Addendum or the International Data Transfer Agreement (IDTA), for Switzerland on standard contractual clauses recognized by the Federal Data Protection and Information Commissioner (FDPIC), or, for providers certified under it, on the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, together with supplementary measures such as encryption in transit. The safeguard relied on for each provider is set out in our data processing terms with that provider. You can ask for a copy of the relevant safeguards at the address above.

The hosting region of a Customer Environment is set in the agreement with the organization, according to the organization's choice.

6. RetentionCopy Anchor Link

We keep data only as long as needed for the purpose and as required by law. The periods are listed in section 10 of the Privacy Policy; for example, contact requests that do not lead to a contract are deleted 2 years after the last contact.

7. Your rightsCopy Anchor Link

You have the right to:

• access your data (Art. 15) and receive a copy;
• have inaccurate data corrected (Art. 16);
• have data erased (Art. 17);
• restrict processing (Art. 18);
• data portability for data you gave us on the basis of consent or contract (Art. 20);
• object at any time to processing based on legitimate interests, and to direct marketing (Art. 21);
• withdraw consent at any time, without affecting processing before the withdrawal (Art. 7(3)).

People covered by the FADP have the right to information (Art. 25), to data portability (Art. 28) and to the protection of their personality rights, including correction and erasure (Art. 32).

Write to support@enainnovation.com (details: Data Subject Requests). We answer within one month; this can be extended by two months for complex requests, in which case we tell you why.

You also have the right to lodge a complaint with a supervisory authority: in the EEA, in particular in the country where you live, work or where the alleged infringement took place; in the United Kingdom, with the Information Commissioner's Office (ICO); in Switzerland, with the Federal Data Protection and Information Commissioner (FDPIC).

8. Is providing data required?Copy Anchor Link

Website use requires no personal data beyond technical logs. Information marked as required in our forms is needed to answer your request; without it we cannot respond. Contract data is needed to conclude and perform the contract.

9. Automated decisionsCopy Anchor Link

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you (Art. 22). The EnaResearch service does not take automated decisions about people; the organization running the study decides how data is used in its studies.

10. ChangesCopy Anchor Link

We may update this notice. The current version is published on this page with its effective and update dates.