KVKK and Legal Information

Identity of OYOX LLC and BLUEHAMS

BLUEHAMS is a cloud-based center management software developed for hearing aid sales and fitting centers established in the Republic of Turkey (the "Clinic"), covering patient records and follow-up, appointments, inventory, technical service, collections and installment tracking, staff and branch management, and reporting. Throughout this body of documents, BLUEHAMS is referred to as the "Platform" or the "Service".

The BLUEHAMS brand and the bluehams.com website are operated by OYOX LLC (the "Company" or the "Data Controller"), a Domestic Limited Liability Company registered with the New Mexico Secretary of State on February 23, 2026 under registration number 0008084103. Its head office mailing address is 1209 Mountain Road PL NE, STE N, Albuquerque, NM 87110, United States.

The channels available for any question, request or application concerning the protection of personal data are as follows.

• By post, to the OYOX LLC (USA) address stated above (primary channel)
• By e-mail at kvkk@bluehams.com (secondary channel; it will become active once the e-mail infrastructure is deployed)
• Through the contact form on bluehams.com

The purpose of this page is to set out clearly the legal position, under the Law, of both our Clinic Customers and our website visitors, and to gather the core legal documents in a single hub. The document set is expanded with new documents as the need arises.

Who Holds Your Data, and in Which Role?

The Law defines two fundamental roles for the processing of personal data in its Article 3. The data controller is the party that determines the purposes and means of processing personal data; the data processor is the party that processes personal data on behalf of the controller and upon its authorization. "Personal Data" means any information relating to an identified or identifiable natural person, and the "Data Subject" (İlgili Kişi) is the natural person whose personal data is processed. At BLUEHAMS this distinction is clear-cut, and the Company states openly the capacity in which it acts for each data set.

In practical terms this means the following. Your Clinic is the data controller for, and the party primarily accountable under the Law for, your patients' Personal Data; the Company processes that data solely to provide the Service to you, within your instructions and the limits of the contract, in its capacity as data processor. Each Clinic's data is kept technically separate through tenant isolation; every Customer can access only its own data. The full details of this relationship, the mutual obligations of the parties and the security commitments are governed by the Data Processing Agreement.

For your own data the position is different. For your demo request, your BLUEHAMS user account, your subscription and your login and audit records, the Data Controller is the Company; transaction logs that touch your Clinic's patient data are kept in our capacity as data processor and within the framework of the Data Processing Agreement. Detailed information on the processing activities that the Company carries out in its capacity as data controller is available in the Privacy Notice and the Privacy Policy.

Where Is Your Data Hosted, and How Is It Protected?

All data recorded in BLUEHAMS is hosted on servers located within the borders of the Republic of Turkey, in Istanbul. Where any transfer abroad within the meaning of Article 9 of the Law is involved — including remote access to the infrastructure by the Company's personnel located abroad for system administration purposes — it is carried out only on condition that the appropriate safeguards provided for in that Article are in place; the details are explained in the Privacy Policy and the Data Processing Agreement.

Within the framework of the data security obligations under Article 12 of the Law, the Company applies principally the following technical and organizational measures.

• All traffic runs over HTTPS (TLS 1.2/1.3, HSTS)
• The database is encrypted at rest; backups are encrypted with AES-256 and retained for 14 days
• Passwords are irreversibly hashed; two-factor authentication (TOTP) with recovery codes is available
• Sessions expire automatically after 30 minutes of inactivity; session cookies are httponly, Secure and SameSite protected
• Tenant isolation is enforced on every query; role-based authorization ensures staff can access only the data they are authorized for
• Only parameterized queries are used against SQL injection, together with CSRF tokens, output escaping and a Content Security Policy (CSP)
• File uploads are subject to a type allowlist, a size limit (10 MB) and server-generated random naming
• Failed login attempts are monitored; brute-force protection and server-level hardening are in place
• User and administrator actions are written to audit logs (activity log)
• Automated retention cleanup is in place; SMS records and audit records are automatically anonymized or deleted within the framework of the Clinic's instructions and the periods set out in the Retention and Destruction Policy (in the default configuration, SMS records are anonymized after 180 days and audit records are deleted after 730 days); deleted records pass through a recycle bin before permanent destruction

All static resources of the Site — including stylesheets, fonts, the icon library (Font Awesome) and the charting library in the management panel (Chart.js) — are served locally from the Company's own server under the bluehams.com domain. No resource is loaded from any external content delivery network (CDN); when pages are displayed your browser sends no request to any domain other than bluehams.com, and your IP address is not transmitted to any third party for the loading of site resources. You may verify this at any time via the Network tab of your browser's developer tools.

Frequently Asked Questions

How do I receive an invoice from a US company, and what about VAT?

OYOX LLC (the "Company") is established in the United States and, as it has no tax registration in Turkey, it does not issue Turkish e-fatura or e-arşiv invoices; it issues a commercial invoice for the service fee. Our prices do not include VAT. A VAT-registered buyer established in Turkey declares and pays the VAT calculated on the service fee under the reverse charge mechanism, pursuant to Article 9 of Value Added Tax Law No 3065, via VAT return No 2, and may deduct the same amount in VAT return No 1 in accordance with the general rules. This is a well-established, ordinary practice for businesses procuring services from abroad.

Which law governs my contract?

The BLUEHAMS subscription agreement is governed by Turkish law; for disputes between the parties, the Istanbul (Çağlayan) Courts and Enforcement Offices have jurisdiction under a jurisdiction agreement valid between merchants pursuant to Article 17 of the Code of Civil Procedure No 6100 (HMK). As both parties are merchants within the meaning of the Turkish Commercial Code No 6102 (TTK), Consumer Protection Law No 6502 (TKHK) and the Distance Contracts Regulation do not apply to this relationship. The contractual relationship is subject to the general provisions of the Turkish Code of Obligations No 6098 (TBK). The Service is a pure subscription service that involves no transfer of source code or reproduction rights. See the Terms of Service for the full provisions.

What are my KVKK obligations for my patients' data, and how does BLUEHAMS help me?

With respect to your patients' Personal Data, your Clinic is the data controller; under Article 10 of the Law, informing your patients (the Data Subjects), satisfying the minimum elements set out in Article 5 of the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Disclosure Obligation, ensuring lawful processing and taking the security measures required under Article 12 of the Law are primarily your obligations. The Company gives you concrete support in carrying that burden. Your data is hosted in Turkey on an infrastructure protected by the measures summarized above; through the Data Processing Agreement executed with each Clinic, we undertake to process your data only on your instructions and within the stated purposes, to comply with our confidentiality obligation, and to notify you without delay of any data breach. Product features such as role-based authorization, audit logs and automated retention cleanup make the Law's data security obligations workable in your day-to-day operations. We also remind you, importantly, that for special categories of personal data relating to your patients (health data, including hearing and device information), you must comply with the additional conditions set out in Article 6 of the Law.

Does it replace my written patient record book?

No, it does not. The relevant legislation preserves the written record-keeping obligations of hearing aid centers; BLUEHAMS does not replace the official patient record book and makes no such claim. The Platform is an electronic record system that supports that book; it helps you keep your patient records in order and provides printable records and document outputs when needed. For the exact scope of your official book obligations, we recommend relying on the current practice of your provincial health directorate.

Your Rights and How to Apply

Under Article 11 of the Law, every Data Subject whose personal data is processed has the following rights.

• To learn whether their data is being processed and, if so, to request information about it
• To learn the purpose of processing and whether the data is used in line with that purpose
• To know the third parties to whom the data is transferred
• To request correction of incomplete or inaccurate data
• To request erasure or destruction of the data under the conditions set out in the law
• To request that corrections, erasures and destructions be notified to third parties to whom the data was transferred
• To object to a result arising against them from analysis carried out exclusively by automated systems
• To claim compensation for damage suffered due to unlawful processing

For data that the Company processes in its capacity as data controller (demo requests, account and subscription information, website visits), you may submit your application, within the framework of Article 13 of the Law and the Communiqué on the Procedures and Principles of Application to the Data Controller, through the following channels.

• By post, to the OYOX LLC (USA) address (1209 Mountain Road PL NE, STE N, Albuquerque, NM 87110, United States) — primary channel
• By e-mail at kvkk@bluehams.com (secondary channel; it will become active once the e-mail infrastructure is deployed)
• Through the contact form on bluehams.com

Applications are concluded as soon as possible and in any event within thirty days at the latest; where a fee applies, the current tariff in the aforementioned Communiqué is used (currently 1 TL per page for responses exceeding ten pages). For the application steps and a sample form, use the KVKK Application page.