Privacy Policy
Last updated: August 18, 2026 · Version 1.1
This document is provided for convenience; the Turkish version prevails. This Privacy Policy (the "Policy") has been prepared to explain, pursuant to Turkish Law No. 6698 on the Protection of Personal Data (the "KVKK" or the "Law") and its secondary legislation, the privacy practices relating to the hearing aid center management software (the "Platform" or the "Service") offered under the BLUEHAMS brand at bluehams.com by OYOX LLC ("OYOX", the "Company" or the "Data Controller"), a Domestic Limited Liability Company registered with the New Mexico Secretary of State on February 23, 2026 under Registration No. 0008084103. This Policy is the broader, more readable exposition of the Privacy Notice required under the Law; it sets out, end to end, which Personal Data is processed on whose behalf, where it is kept, and under which technical and organizational measures. As used in this Policy, "Data Subject" means the natural person whose personal data is processed, and "Personal Data" means any information relating to an identified or identifiable natural person. Effective date August 18, 2026, Version 1.1.
Scope and Roles — Controller / Processor Distinction
BLUEHAMS is a business-to-business (B2B) subscription service for hearing aid sales and fitting centers established in the Republic of Turkey (each a "Clinic" or "Customer"). With respect to the Personal Data processed within the Service, the Company simultaneously holds two distinct capacities within the meaning of the KVKK, and this distinction forms the backbone of the entire Policy.
Where the Company acts as data controller. For website visits, demo requests, account registrations, subscription and payment receipt records, and security logs, the Company itself determines the purposes and means of processing; the "Data Controller" within the meaning of Article 3/1-i of the KVKK for this data is OYOX LLC. Detailed information on this area is provided in the Privacy Notice.
Where the Company acts as data processor. For the patient records, audiograms and other patient documents, collection records, SMS contents and clinic staff records that Clinics keep in the Platform, the "Data Controller" is the relevant Clinic. The Company processes this data solely on the Clinic's instructions and strictly within the purpose and scope defined in the Data Processing Agreement, acting as a "Data Processor"; it performs no operations on this data for its own purposes and does not use it for marketing, profiling, transfer to third parties, or sale.
| Data area | Data controller | Data processor |
|---|---|---|
| Site visits, demo requests, accounts, subscriptions, security logs | OYOX LLC | — |
| Patient records, patient files, collections, SMS contents, clinic staff | The relevant Clinic | OYOX LLC (BLUEHAMS) |
The parties to the Service are merchants within the meaning of Turkish Commercial Code No. 6102 ("TCC"); the Service is not offered to consumers within the scope of Turkish Law No. 6502 on Consumer Protection or the Distance Contracts Regulation, and that legislation does not apply to this relationship. For the contractual framework, see the Terms of Service.
Full Inventory of Data Processed
The inventory below reflects the data fields actually processed by the Service. If the inventory changes, this section is updated and the change is announced through the procedure set out in Section 10.
A) Data for Which the Company Is the Data Controller
| Process | Data processed | Purpose |
|---|---|---|
| Site visit | Server access records (including IP address), session cookie | Operating the site and ensuring its security |
| Demo request form | Full name, clinic name, e-mail, phone, number of branches, message content | Handling the request, scheduling a demo, and quote communication |
| Account registration | First name, last name, e-mail, phone, username, password (stored only as a cryptographic hash) | Formation of the contract and operation of the account |
| Subscription and payment | Subscription payment records, bank transfer receipts uploaded via the panel | Payment verification, subscription administration, financial records |
| Security records | Login attempts (including IP address), user activity log, administrator audit log, two-factor authentication recovery codes, password reset records | Account security, abuse prevention, auditability |
The processing activities tabulated above rely on the following legal grounds: Article 5/2-c of the KVKK, as directly related to the formation and performance of the contract; Article 5/2-ç, for the Company's compliance with its legal obligations; and Article 5/2-f, for the Company's legitimate interests, provided that the fundamental rights and freedoms of the Data Subject are not harmed. Passwords are never stored in plain text at any stage. After registration, accounts are activated upon administrator approval; only the registration data above is used in the approval process.
B) Data for Which the Company Is the Data Processor (Clinic Patient and Staff Data)
Clinics may keep the following data fields in the Service; the Data Controller for this data is the relevant Clinic.
- Patient identity and contact details: first name, last name, Turkish national ID number, phone, date of birth, gender, address
- Device details: hearing aid brand, model, type and serial number, battery type, fitted ear (left/right/both), purchase status
- Appointment details: appointment date and time, free-text notes entered by the Clinic
- Patient files: audiograms, reports and similar documents (PDF, JPG, PNG, DOC, XLS; up to 10 MB per file)
- Patient history and financial records: transaction history, payment and installment records
- Technical service records: device fault and service tracking
- SMS records: the patient's phone number and the full text of the message sent
- Generated documents, and clinic and manager notes
- Clinic staff data: staff accounts, attendance records, performance records
Each Clinic's data is segregated through tenant isolation at the application layer; no Customer can access another Customer's data. Access is restricted through role-based authorization (clinic owner / staff).
Where Data Is Kept, and Retention
All static resources of the Site — including stylesheets, fonts, the icon library (Font Awesome) and the charting library in the management panel (Chart.js) — are served locally from the Company's own server under the bluehams.com domain. No resource is loaded from any external content delivery network (CDN); when pages are displayed your browser sends no request to any domain other than bluehams.com, and your IP address is not transmitted to any third party for the loading of site resources. You may verify this at any time via the Network tab of your browser's developer tools.
The concrete rules on backup and retention are as follows.
- Backups are encrypted with AES-256 and retained for 14 days. An automatic backup is taken before every deployment (update).
- SMS dispatch records are automatically anonymized after 180 days; the phone number is masked and the message body is removed from the record.
- Audit records are automatically deleted after 730 days (2 years).
- Records deleted by users are first moved to a trash bin (recoverable); permanent destruction is carried out through the trash purge procedure.
Retention periods for Clinic patient data are determined by the Clinic as Data Controller, subject to the minimum periods under the applicable Turkish health legislation. Details on periods and destruction procedures are provided in the Retention and Destruction Policy.
Summary of Security Measures
Within the scope of its obligations under Article 12 of the KVKK, the Company applies the following technical and organizational measures, which are actually in operation and are implemented with regard to the Personal Data Security Guide of the Turkish Personal Data Protection Authority and, for special categories of data, Board Decision No. 2018/10.
- Transport security: all traffic is encrypted with TLS 1.2/1.3; HTTP requests are redirected to HTTPS and HSTS is enforced.
- Encryption at rest: database tablespaces are encrypted on disk (at rest); backups are encrypted with AES-256.
- Authentication: passwords are stored as cryptographic hashes; a password policy is enforced; two-factor authentication (TOTP) with recovery codes is available.
- Session security: cookies carry the httponly, Secure and SameSite=Lax attributes; sessions terminate automatically after 30 minutes of inactivity.
- Application security: all database queries run as parameterized (prepared) statements; CSRF protection, output escaping and a Content Security Policy (CSP) are applied.
- File upload security: uploads are validated against a MIME type whitelist, renamed randomly server-side, and limited to 10 MB.
- Access control: role-based authorization and tenant isolation applied on every query ensure that Customers access only their own data.
- Abuse protection: failed login attempts are recorded and rate-limited against brute force attacks; intrusion blocking and SSH hardening are applied at the server level.
- Traceability: user operations and administrator operations are kept in separate audit logs.
- Infrastructure security: application components are separated through container isolation; access to sensitive paths and extensions is blocked at the web server.
Sub-Processors
The Company uses a limited number of sub-processors in delivering the Service. The current list is below.
| Sub-processor | Role | Location | Status |
|---|---|---|---|
| Hostingdünyam (CNC Bilişim Hizmetleri Ltd. Şti.) | Server (VDS) hosting | Istanbul, Turkey | Active |
| SMS provider | Delivery of patient reminder SMS messages | To be announced upon selection | Not yet active |
The SMS dispatch feature does not currently perform real sending; once an SMS provider is selected and activated, this table will be updated and the provider's identity and location announced.
Before any new sub-processor is added or an existing one replaced, Clinics receive prior notice with respect to data processed in the Company's Data Processor capacity, and the objection right granted in the Data Processing Agreement applies. Written obligations no less protective than the security and confidentiality obligations undertaken by the Company are agreed with each sub-processor.
No third-party advertising or analytics service (Google Analytics, Meta pixel, or similar) is used in the Service.
International Transfers
Personal Data belonging to the Service is hosted on servers located within the borders of the Republic of Turkey. Transfers abroad take place only where the appropriate safeguards set out in Article 9 of the KVKK are in place; no transfer is based on explicit consent, nor on any approval made a condition of the Service.
Because the Company is a legal entity established in the United States, remote access to the servers from the US may be needed for system administration. Under the Board's guidance, remote access from abroad — including on-screen viewing — qualifies as a transfer abroad. The Company therefore makes the following commitment.
All static resources of the Site — including stylesheets, fonts, the icon library (Font Awesome) and the charting library in the management panel (Chart.js) — are served locally from the Company's own server under the bluehams.com domain. No resource is loaded from any external content delivery network (CDN); when pages are displayed your browser sends no request to any domain other than bluehams.com, and your IP address is not transmitted to any third party for the loading of site resources. You may verify this at any time via the Network tab of your browser's developer tools.
Cookies Summary
The Service adopts a minimalist approach to cookies. The complete inventory of cookies used is as follows.
| Cookie / record | Purpose | Type | Duration |
|---|---|---|---|
| Session cookie | Authentication and session management | Strictly necessary | For the session (ends after 30 minutes of inactivity) |
| hams_lang | Language preference (TR/EN) | Functional | Stored in the browser |
| hams_theme, hams_sidebar (localStorage) | Theme and menu preference | Functional (not a cookie; never sent to the server) | Until deleted by the user |
No cookies are used for advertising, analytics, or tracking. Since the site uses only strictly necessary and functional cookies, no separate explicit consent is sought for these cookies within the exemptions of the Cookie Practices Guide of the Turkish Personal Data Protection Authority; for that reason, the site displays no cookie banner. Should a cookie requiring consent ever be added to the inventory, this arrangement will be reassessed.
All static resources of the Site — including stylesheets, fonts, the icon library (Font Awesome) and the charting library in the management panel (Chart.js) — are served locally from the Company's own server under the bluehams.com domain. No resource is loaded from any external content delivery network (CDN); when pages are displayed your browser sends no request to any domain other than bluehams.com, and your IP address is not transmitted to any third party for the loading of site resources. You may verify this at any time via the Network tab of your browser's developer tools.
Data Breach Procedure
The procedure to be followed where Personal Data is unlawfully obtained by others depends on the role attached to the data.
For Clinic patient data (Company as processor). Upon learning of a breach, the Company notifies the affected Clinic immediately and without delay, and provides all information the Clinic needs regarding the scope of the breach, the affected records and the measures taken. The obligation to notify the Authority as soon as possible and within 72 hours rests with the Clinic as Data Controller; the Company's immediate-notification commitment exists so that the Clinic can meet that deadline.
For data for which the Company is the Data Controller. Pursuant to Article 12/5 of the KVKK and Board Decision No. 2019/10, the Company notifies the Turkish Personal Data Protection Board as soon as possible and within 72 hours of learning of the breach, and informs the affected Data Subjects as soon as reasonably possible.
In both cases, the internal procedure includes the following steps.
- Detecting the breach, containing its scope and stopping its impact.
- Identifying the affected data categories and record counts; reviewing the audit logs.
- Making the notifications and keeping a breach register.
- Root cause analysis and corrective measures to prevent recurrence.
Children's Data
The Service is not open to users under the age of 18; account registration and user accounts are intended solely for Clinics acting as merchants and the adult staff they authorize.
That said, Clinics' patient records may by their nature contain Personal Data of child patients (including identity, health and device information). The Data Controller for that data is the Clinic; conducting privacy notices for child patients and, where required, obtaining explicit consent duly from parents or guardians is the Clinic's responsibility. The Company processes this data solely on the Clinic's instructions and under the safeguards set out in this Policy and in the Data Processing Agreement.
Changes to This Policy
This Policy may be updated due to legislative changes, decisions of the Turkish Personal Data Protection Board, or changes in the Service's architecture. Every version is stamped with an effective date and a version number; the current version is always published on bluehams.com.
Material changes are announced before they take effect, through a site announcement and the announcement mechanism in the application panel. No change will be construed retroactively in a way that narrows Data Subjects' rights. Which text is in force can always be verified through the version information at the bottom of this page.
Contact
The following channels are available for any question, request or notice regarding privacy practices and the processing of your Personal Data. For applications and service of notice, the primary channel is the OYOX LLC (US) postal address above, by mail.
- Postal address (primary address for applications and service of notice): OYOX LLC, 1209 Mountain Road PL NE, STE N, Albuquerque, NM 87110, United States
- E-mail: kvkk@bluehams.com — will become active once the e-mail infrastructure is established
- Web: the contact (demo and inquiry) form on bluehams.com
To exercise your rights under Article 11 of the KVKK (information, rectification, erasure, objection to processing, and others) in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, you may complete the KVKK Application Form and submit it to the OYOX LLC (US) postal address above; your applications are concluded within thirty days at the latest, and as a rule free of charge, depending on the nature of the request. Requests concerning patient data are directed to the relevant Clinic, since the Data Controller capacity belongs to the Clinic; the Company assists the Clinic in that referral and in fulfilling the request.