Privacy and data protection
Privacy Policy
How ENA Innovation processes personal data on the www.enaresearch.com website, in the EnaResearch service and in the EnaResearch mobile app.
This English version is a translation provided for convenience. In case of conflict the Turkish version prevails.
This Privacy Policy explains how your personal data is processed when you visit the www.enaresearch.com website, contact us by form, email or phone, when your organization is an EnaResearch customer, when you take part in a study that an organization runs with EnaResearch, and when you use the EnaResearch mobile app. The information required under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") is also provided in the KVKK Privacy Notice, and the information for people in the European Economic Area, the United Kingdom and Switzerland is in the GDPR Privacy Notice.
1. Who we are
ENA Innovation Sağlık ve Yazılım Teknolojileri San. Tic. A.Ş. ("ENA Innovation", "we") is a technopark company located at Battalgazi Mah. Eskişehir Yolu Bulv. A.N.S. Kampüsü, Zafer Technopark, Merkez/Afyonkarahisar, Türkiye. EnaResearch is a product of ENA Innovation.
EnaResearch is a research-data collection and management platform for hospitals, universities, research centers, research labs, research groups, departments, clinics and independent researchers. It collects, organizes and exports data from mobile health platforms and, where available, wearable devices, together with clinical records and values entered by the research team, according to the protocol of the organization's study.
EnaResearch is not a medical device. It is not used for clinical decision support, diagnosis, treatment or vital-sign monitoring.
For questions about personal data: support@enainnovation.com
2. Our role: data controller or data processor?
| Activity | ENA Innovation's role | Data controller |
|---|---|---|
| Running the website; contact and demo requests | Data controller | ENA Innovation |
| Contracts, billing and support with customer organizations | Data controller | ENA Innovation |
| Commercial electronic messages you opted in to | Data controller | ENA Innovation |
| Data processed in an EnaResearch Customer Environment (participant identity details, device and health-platform data, study and participation records, organization users, audit records, etc.) | Data processor | The organization using EnaResearch (the Customer) |
If you take part in a study run with EnaResearch, the organization running the study is the data controller for your data. The purpose of the study, the legal basis, the retention period and how to exercise your rights are set out in the participant information notice the organization gives you. Please send requests about that data to the organization first. ENA Innovation processes such data only on the organization's instructions and to provide the service.
3. Data processed on the website
3.1. When you visit the website
- Technical logs: our website is hosted on Vercel. When you access the site, your IP address, browser and device information, the requested page and the time are processed in the hosting provider's server logs to run and secure the site.
- Aggregate visit statistics: we use Vercel Web Analytics and Speed Insights. These tools do not use cookies, do not track visitors across sites and give us only aggregate data such as page views, country, device type and page performance. See the Cookie Policy for details.
- Organization login redirect: when you enter your organization code on the "Login" page, your browser connects to ENA Innovation's central organization discovery service (discovery.enainnovation.com) to send you to your organization's EnaResearch address. This service keeps access logs that include IP address, browser information and country.
3.2. When you fill in a form or write to us
Our contact and demo forms ask for: full name, work email, phone, organization, sector, your role, expected number of participants, request type and your message. The form content is sent to our team as an email through ENA Innovation's notification infrastructure and its email service provider (Resend).
When you contact us by email, phone or WhatsApp, the content of the conversation and your contact details are processed. When you use WhatsApp, WhatsApp's (Meta's) own privacy terms also apply.
Please do not include special categories of personal data, such as health data, in forms or messages.
3.3. Commercial electronic messages
If you tick the optional box in a form, we may email you about product updates and events. This approval is obtained under Turkish Law No. 6563 on the Regulation of Electronic Commerce and its regulation, and is recorded in the Message Management System (İYS) where the law requires it. You can withdraw your approval at any time using the link in each message or by writing to support@enainnovation.com.
4. Data processed in the customer relationship
When your organization is, or is considering becoming, an EnaResearch customer, we process the full name, title and work contact details of authorized and contact persons, quote, contract and invoice details, and support requests and correspondence.
To set up a Customer Environment, we use the full name and email address of the organization's first administrator (owner). Accounts of organization users (owners and researchers) are kept with our identity provider, Logto.
5. Data processed in the EnaResearch service (as data processor)
Each organization uses its own Customer Environment running at organizationcode.enaresearch.com: a separate environment with its own application stack and its own database and database user. The hosting region of the environment is set in the agreement with the organization.
Depending on the organization's configuration and the study protocol, the following data may be processed in a Customer Environment:
| Group | Data categories |
|---|---|
| Participants (people taking part in a study) | Given name, family name, sex, date of birth; an optional identifier chosen by the organization (for example a Turkish national ID number, NHS number, BSN, AHV number, KVNR or hospital record number); 6-character participant code; study and participation records; wearable device and device assignment details; device and health-platform data for the measurement types the study allows (for example heart rate, steps, calories, SpO₂, skin temperature, heart rate variability, sleep); clinical records entered or imported by the research team (admissions and discharges, procedures such as surgery, clinical events, free-text notes; import from CSV or FHIR R4); manually entered values (for example pain and fatigue scores, Borg scale, hemoglobin, CRP, leukocytes, creatinine, albumin); eligibility assessments; derived research variables and statistical results; data transfer and synchronization status; mobile app session and device details; participant web area session (participant code and PIN), where the participant sees the transfer status and a daily summary |
| Organization users (owner, researcher) | Name, email, role and study team membership; session information; audit records; text typed into the AI assistant (if enabled) |
Minimal identity data: the identifier chosen by the organization is not stored in clear text; only a keyed hash and its last 4 characters are kept. If the organization switches the feature on, an encrypted copy of the identifier is also stored. In exported research datasets participants are shown under a pseudonym (for example P001); the identifier is not included in exports.
Health data: device and health-platform data, clinical records and manually entered values are a special category of personal data (health data). The organization, as data controller, decides the legal basis for processing it, obtains ethics approval and informs participants. Our Participant Information Notice Template is a starting point for organizations.
AI assistant: the research module has an optional AI assistant that is off by default and is switched on only by the organization. Its provider is Anthropic (USA). It receives only aggregate study information (variable definitions, counts with small numbers suppressed, statistical test output) and text the researcher types; participant-level records and identity data are never sent.
Purposes we do not use data for: data in a Customer Environment is not used for advertising, marketing or profiling, is not sold, is not shared with data brokers and is not used to train AI models.
The organization decides the purposes, legal basis and retention period for this data. For details, please refer to the privacy notice of the organization concerned.
6. Mobile app
The EnaResearch mobile app (iOS and Android) lets people taking part in an organization's study transfer device and health-platform data to the organization's Customer Environment. The organization running the study is the data controller for data sent through the app; ENA Innovation processes it as data processor, as described in Sections 2 and 5.
6.1. No account, a participant code
Participants do not have accounts. The research team gives you a 6-character participant code and a one-time activation key. The app uses these to open a session bound to your device; you also set a 6-digit PIN. Session details are kept in the device's secure storage (iOS Keychain, Android Keystore). The research team can renew or revoke your code; revoking it also ends the session on your device.
6.2. Data read and permissions
- Apple Health (HealthKit) and Health Connect: the app reads this data only with the permission you give on the operating system's permission screen, and only for the measurement types the study allows. Details: Health Data Statement.
- Wearable devices (where available): data from devices used in the study, such as a heart-rate armband, may be received through a hub set up by the organization or through your phone over Bluetooth.
- You can withdraw permissions at any time in the operating system settings; no new data is read after that.
6.3. What the app does not contain
The app contains no ads, advertising identifier, in-app purchases, or third-party analytics or tracking tools, and it does not track you across other companies' apps and websites. Push notifications are not used.
6.4. Data stored on the device
Measurements not yet transferred are kept on the device until the organization's server confirms that they have been stored permanently, and are then deleted from the device. When you uninstall the app, the app's data on the device is deleted. Data already transferred to the organization's server is subject to the organization's retention rules.
7. Purposes and legal grounds (as data controller)
| Purpose | Data categories | Legal ground (KVKK Art. 5) |
|---|---|---|
| Running and securing the website | IP address, browser and device information, access logs | Legitimate interest (Art. 5/2-f) |
| Aggregate visit and performance statistics | Aggregate, non-identifying usage data | Legitimate interest (Art. 5/2-f) |
| Redirecting users on the login page to the right organization address | Organization code, IP address, browser information | Performance of a contract (Art. 5/2-c); legitimate interest (Art. 5/2-f) |
| Answering demo and contact requests | Identity, contact and professional details, request content | Necessary to enter into a contract (Art. 5/2-c); legitimate interest (Art. 5/2-f) |
| Entering into and performing customer contracts, billing, support | Identity, contact and professional details, customer transaction and financial details | Performance of a contract (Art. 5/2-c); legal obligation (Art. 5/2-ç) |
| Legal obligations (tax and commercial law, requests from authorities) | Invoice and contract records | Legal obligation (Art. 5/2-ç) |
| Protecting rights in legal disputes | Relevant records | Establishing, exercising or protecting a right (Art. 5/2-e) |
| Sending commercial electronic messages | Name, email, preference and approval records | Explicit consent (Art. 5/1) and commercial message approval under Article 6 of Law No. 6563 |
Information for people covered by the GDPR, the UK GDPR or the Swiss Federal Act on Data Protection (FADP) is in the GDPR Privacy Notice.
8. Recipients
We do not sell your personal data. Data is shared only with the following recipients, limited to the purpose:
- Our service providers (data processors): hosting, identity, email delivery and error monitoring services and, if an organization enables it, the AI assistant (Anthropic; aggregate study information only). Current list: Sub-processors. The website also uses Vercel (hosting and aggregate analytics).
- Competent public authorities: on request of authorities empowered by law.
- Professional advisers: lawyers, accountants and auditors, under confidentiality obligations.
- The customer organization: data we process as data processor is made available to the authorized users of the organization, which is the data controller.
Apple and Google are not EnaResearch sub-processors: Apple Health and Health Connect data stays on your device until the app sends it to the organization's environment.
9. International transfers
Some of our service providers are located abroad or use infrastructure abroad. In particular, our website is hosted on Vercel (USA), and form content and service emails are sent through Resend (USA). If an organization enables the optional AI assistant, aggregate study information and text the researcher types are sent to Anthropic (USA); participant-level records and identity data are not sent. The hosting region of a Customer Environment is set in the agreement with the organization; the region may be outside Türkiye.
These transfers are made under Article 9 of the KVKK and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad. For transfers to countries without an adequacy decision, we rely on one of the appropriate safeguards provided in the law, such as the standard contracts announced by the Personal Data Protection Board; standard contracts are notified to the Personal Data Protection Authority within five business days of signature. In exceptional cases where an appropriate safeguard cannot be provided, transfers are made only under the incidental transfer conditions listed in Article 9/6 of the KVKK.
10. Retention periods
| Data | Retention period |
|---|---|
| Website server logs | For the hosting provider's (Vercel's) standard log retention period, which is short and at most 30 days |
| Aggregate analytics data | Kept as aggregate, non-identifying data |
| Demo and contact requests that do not lead to a contract | 2 years from the last contact |
| Customer contracts, invoices and related correspondence | 10 years from the end of the contract (taking into account the Turkish Commercial Code, tax law and the limitation periods in the Turkish Code of Obligations) |
| Commercial message approval and opt-out records | 3 years from withdrawal of approval (under the applicable regulation) |
| Data in a Customer Environment (as data processor) | Until the contract ends, or earlier for a period the organization sets counted from the study's final closure; deleted from live systems within 30 days after the contract ends. Raw device payloads are deleted after 90 days, export files after 30 days; encrypted backups are kept for 35 days (measurement database) or 14 days (application database and file storage); the most recent backups are always kept until the environment is deleted |
When the period ends, data is deleted, destroyed or anonymized.
11. Security measures
The main technical and organizational measures in the design of the service are:
- For each organization, a separate environment with its own application stack and its own database and database user; one organization's data cannot be reached from another.
- All traffic encrypted in transit with TLS.
- Invite-based authentication for organization users (Logto) and server-side checks of role and study team membership. The owner manages users and approves studies; the user who opens a study is its principal investigator; researchers access only studies whose team they belong to.
- A one-time activation, a device-bound session and a PIN for participants; rate limiting, increasing delays or lockout, and audit logging for sign-in attempts.
- The participant identifier stored as a keyed hash rather than in clear text; an encrypted copy kept only if the organization switches it on.
- Pseudonyms in exports, and every export written to the audit log.
- Daily encrypted (AES-256) backups of the measurement database (kept for 35 days) and nightly encrypted backups of the application database and file storage (kept for 14 days); the most recent backups are always kept.
- Confidentiality obligations for our staff and access limited to what their role requires.
No system is completely secure; if a data breach occurs, we make the notifications required by law. EnaResearch is designed to support organizations' legal obligations; these measures are not a statement of compliance or certification.
12. Your rights
Under Article 11 of the KVKK, you have the right to learn whether your personal data is processed; to request information about it; to learn the purpose of processing; to know the recipients to whom it is transferred; to request correction, deletion or destruction; to request that these actions be notified to recipients; to object to a result against you arising from automated analysis; and to claim compensation for damage caused by unlawful processing. People covered by the GDPR, the UK GDPR or the FADP also have the rights to restriction of processing, data portability and objection.
You can send requests to support@enainnovation.com. If your request concerns data processed in an organization's study, we recommend that you contact that organization first; we forward such requests that reach us to the organization concerned. Application methods and response times are explained on the Data Subject Requests page.
13. Children
Our website is aimed at business buyers and is not directed at people under 18. Whether minors take part in a study, and how parental or guardian consent is obtained, is decided by the organization running the study and its ethics committee. Details: Age Suitability Statement.
14. Changes
We may update this policy. The current version is published on this page with its effective and update dates.
15. Contact
- Legal name: ENA Innovation Sağlık ve Yazılım Teknolojileri San. Tic. A.Ş.
- Address: Battalgazi Mah. Eskişehir Yolu Bulv. A.N.S. Kampüsü, Zafer Technopark, Merkez/Afyonkarahisar, Türkiye
- Trade registry: Afyonkarahisar Trade Registry Office, registration no. 18590
- MERSİS no.: 0334130943400001
- Tax office / tax ID: Tınaztepe Tax Office / 3341309434
- Personal data: support@enainnovation.com
- General: support@enainnovation.com
- Phone: +90 850 308 45 91