This page is generated from the same source as the agreement accepted in the app.
This Information Notice has been prepared in order to provide information about the personal data processed during the creation of a membership through Quidit, an artificial intelligence-supported smoking cessation application, the holding of voice conversations with the artificial intelligence coach, the monitoring of the personalised quitting process and the secure provision of the application.
The application is intended solely for persons who have reached the age of 18. The date of birth is requested during registration and persons who are understood not to have reached the age of 18 are not permitted to create an account. Opening an account with an incorrect or untrue declaration of age is prohibited.
Within the scope of Law No. 6698 on the Protection of Personal Data (“KVKK”), your personal data is processed, in the capacity of data controller, by Quidit (the “Company”), whose contact details are set out below.
Website and Application: https://quidit.app and Quidit
KVKK Application E-mail Address: privacy@quidit.app
Depending on the way you use the application, the following personal data may be processed:
It is recommended that information belonging to third parties that is not necessary and special categories of personal data other than health data are not shared during conversations with the artificial intelligence coach.
Personal data is processed for the purposes below and on the basis of the legal grounds set out opposite them. Health data processed for the purpose of personalised coaching, the parts of voice or written conversations containing health information and the assessments relating to health status derived from these are processed on the basis of the explicit consent obtained separately pursuant to sub-paragraph (a) of the third paragraph of Article 6 of the KVKK. The ground of the establishment or performance of a contract relating to the processing of data of a general nature is not by itself sufficient for the processing of health data. The processing of special categories of data other than health data within the scope of coaching is not intended; where such processing becomes necessary, separate information will be provided and the statutory processing condition will be fulfilled in respect of the relevant data.
Purpose of processing: Creation of the membership, login and account management, verification that the user is over the age of 18 and provision of the basic functions of the application
Legal ground: KVKK Art. 5/2(c): being directly related to the establishment or performance of the contract
Purpose of processing: Holding of the voice conversation with the artificial intelligence coach, processing of the voice and its conversion into text during the conversation, generation of the coaching content requested by the user
Legal ground: In respect of voice and technical transaction data not containing health information, KVKK Art. 5/2(c): being necessary for the establishment or performance of the contract; in respect of the health information contained in the conversations and the assessments relating to health status derived from it, KVKK Art. 6/3(a): separate explicit consent
Purpose of processing: Monitoring of the smoking habit, the quit goal and progress; creation of the personalised quit plan, reminders and coaching recommendations
Legal ground: In respect of account, habit and usage data not containing health information, KVKK Art. 5/2(c); in respect of health information and the assessments relating to health status derived from it, KVKK Art. 6/3(a): separate explicit consent
Purpose of processing: Where activated by the user, provision of location-based reminders and coaching recommendations relating to the places the user designates
Legal ground: KVKK Art. 5/2(c): being directly related to the establishment or performance of the contract (provision of the optional feature requested by the user)
Purpose of processing: Where activated by the user, provision of the voice cloning feature; creation of a voice model from the audio recording uploaded by the user
Legal ground: KVKK Art. 5/1: the explicit consent given by the user separately and specifically for this feature
Purpose of processing: For the purpose of looking after the user’s safety, scanning of the transmitted content by automated means for signs of an emergency, directing of the user to emergency assistance channels where a sign is detected, and review of the relevant content by authorised personnel
Legal ground: In respect of content containing health information, KVKK Art. 6/3(a): separate explicit consent; in respect of other data, KVKK Art. 5/2(f): legitimate interest, provided that fundamental rights and freedoms are not harmed
Purpose of processing: Collection of payment, conduct of accounting and invoicing processes; fulfilment of statutory record-keeping and notification obligations
Legal ground: KVKK Art. 5/2(c) and Art. 5/2(ç): performance of the contract and the legal obligation of the data controller
Purpose of processing: Ensuring the security of the application and the account, detection of errors and misuse, improvement of system performance and service quality
Legal ground: KVKK Art. 5/2(f): legitimate interest, provided that fundamental rights and freedoms are not harmed. Aggregated or anonymous data is used for this purpose as far as possible.
Purpose of processing: Finalisation of withdrawal, cancellation, refund, requests and complaints; enabling the exercise of consumer rights
Legal ground: KVKK Art. 5/2(c), Art. 5/2(ç) and Art. 5/2(e): performance of the contract, legal obligation and the establishment, exercise or protection of a right
Purpose of processing: Compliance with the legislation, meeting the requests of competent authorities, conduct of audit and legal processes
Legal ground: KVKK Art. 5/2(ç) and Art. 5/2(e): legal obligation and the establishment, exercise or protection of a right
Purpose of processing: Finalisation of user requests and complaints
Legal ground: KVKK Art. 5/2(c): the processing of personal data being necessary, provided that it is directly related to the establishment or performance of a contract, and Art. 5/2(e): data processing being mandatory for the establishment, exercise or protection of a right
Explicit consent is not additionally requested for activities based on one of the processing conditions other than explicit consent provided for in the Law. The explicit consent relating to the processing of health data is obtained separately from the acceptance of the user agreement and from the consent to commercial electronic messages.
As the core functions of the application require the processing of health data, membership cannot be created without explicit consent being given to the processing of this data. The user may withdraw the explicit consent at any time. As the application cannot be provided without the processing of health data, withdrawal of consent takes place by way of closure of the account; for this purpose the user may use the “Delete account” option on the Profile page of the application or send the request to the e-mail address privacy@quidit.app. Processing based on consent is stopped as from the withdrawal statement reaching the Company; the waiting period specified in section 8 applies to account deletion requests made through the application. Data that must be retained on the basis of another legal ground is kept limited to the relevant purpose and period.
The explicit consent relating to the voice cloning feature is optional and may be withdrawn at any time, without the need to close the account, by switching off the relevant preference in the application and deleting the voice model created.
Consent to commercial electronic messages is an optional and separate choice. Its not being given or its being withdrawn does not prevent Quidit membership or benefiting from the artificial intelligence coach service.
The artificial intelligence coach generates responses and recommendations by analysing, by automated means, the voice or written content transmitted by the user. In this context, the voice data processed during the conversation may be converted into text; the content of the conversation, previous goals and progress information may be assessed together for the personalisation of the response.
Within the scope of the personalisation of the artificial intelligence coach, a profile specific to the user is created by assessing, by automated means, the information shared by the user together with the application usage and interaction data. In this context, assessments are made such as the prediction of the user’s risk of resuming smoking and of the time periods in which this risk increases, the recording, for the continuity of the coaching, of inferences relating to the user’s preferences, triggers and coping methods, and the identification of users who show a tendency to move away from the application. These assessments are used solely for the purpose of providing the coaching content, reminders and support in a manner suitable for the user; they are not used for advertising or marketing purposes.
The content generated by artificial intelligence is in the nature of general information and behaviour change support; it does not replace a medical examination, medical diagnosis, treatment or emergency assistance service. It is not intended that a decision which produces legal effects concerning the user or similarly significantly affects the user be made through the application based solely on automated processing. If such a function is added, users will be informed separately.
For the purpose of looking after the user’s safety, the voice or written content transmitted to the application is scanned by automated means for signs of an emergency, such as the risk of self-harm. Where such a sign is detected, the user is directed to emergency assistance channels and the relevant content may be reviewed, limited solely to the purpose of looking after the user’s safety, by personnel authorised in this respect. This scanning does not turn the application into a service that continuously monitors emergencies or provides emergency intervention.
Personal data is collected by automated or partly automated means through the registration and membership screens, the user account, in-app forms and preferences, voice or written conversations with the artificial intelligence coach, microphone access, support channels and the technical records of the application; and, where necessary, by non-automated means through electronic documents.
Personal data may be transferred to the following groups of recipients, provided that it is related to the purpose, limited and proportionate:
Domestic transfers are carried out provided that one of the processing conditions required in Article 8 of the KVKK exists in respect of the relevant category of data. Access to health data is limited to the persons who must have access by reason of their duties, and the additional security measures provided for special categories of personal data are applied.
Where the cloud hosting, communication or technical support infrastructure used by Quidit is located abroad or these services are accessed from abroad, personal data may be transferred abroad. Such a transfer is carried out by ensuring one of the appropriate safeguard mechanisms provided for in Article 9 of the KVKK and by making the necessary notifications. If explicit consent needs to be requested in respect of an exceptional transfer for which no appropriate safeguard exists, the recipient of the transfer, its country, its purpose and the possible risks are explained separately and separate explicit consent is obtained.
Personal data is retained for the period required by the relevant processing purpose, the statutory retention obligations and the periods necessary for the establishment, exercise or protection of a right, provided that a valid processing condition exists in respect of the relevant category of data. Where the processing condition ceases to exist or the relevant period expires, the data is deleted, destroyed or anonymised in accordance with the Regulation on the Deletion, Destruction or Anonymisation of Personal Data and the Company’s retention and destruction processes.
Voice data is processed during the conversation. The fact that no permanent audio recording is kept does not mean that the voice or the health information contained in the conversation is not processed during the conversation. The retention of voice data, the conversation transcript and health/coaching data is assessed separately for each.
In voice conversations with the artificial intelligence coach, the voice is processed in real time during the conversation; no permanent audio recording of the conversation is kept either in the Company’s systems or with the voice conversation service provider. The voice notes and photographs added by the user of the user’s own accord to the journal section are outside this rule; these are retained until the user deletes them or the account is deleted. The audio recording uploaded by the user within the scope of the voice cloning feature is processed solely for the creation of the voice model and is not retained in the Company’s systems; the voice model created is retained with the voice conversation service provider until it is deleted by the user or the account is deleted. Database backups are retained for a maximum of 90 days and are deleted at the end of this period.
Conversation transcripts, session summaries and the content of coach messages are retained for 180 days and are automatically deleted at the end of this period; the conversation transcripts held with the voice conversation service provider are also deleted at the end of the same period. Health, quit plan and progress data is retained for as long as the account is active; completed task periods are deleted after 180 days. Journal entries, the media added to them and artificial intelligence memory records are retained until the user deletes them or the account is deleted. Upon an account deletion request, the data is permanently deleted at the end of the 30-day reversal period; the evidence records relating to explicit consent and the deletion transaction are retained for 3 years, and login and IP records for 1 year. The places designated by the user and the records of entry into and exit from these places are retained until the user deletes the relevant place or the account is deleted. The review records relating to content in which a sign of an emergency has been detected are retained until the account is deleted; when the account is deleted, an anonymous summary of these records containing no content or identity information is kept for a period of 3 years. Credit usage records are retained in detail for a period of 1 year and, at the end of this period, in the form of a monthly summary; purchase and refund records are kept until the account is deleted, and payment records that must be retained under the legislation are kept for the relevant statutory period.
In the case of in-app purchases, the full number and security code of the payment card are not stored in Quidit’s systems.
Within the scope of Article 11 of the KVKK, you have the right to learn whether your personal data is processed, to request information if it has been processed, to learn the purpose of the processing and whether it is used in accordance with its purpose, to know the third parties to whom it is transferred domestically or abroad, to request its rectification if it has been processed incompletely or incorrectly, to request its deletion or destruction if the conditions have arisen, to request that the rectification and deletion operations be notified to the third parties to whom the data has been transferred, to object to the emergence of a result to your detriment by reason of its being analysed exclusively by means of automated systems, and to claim compensation in the event that you suffer damage due to unlawful processing.
In addition to these rights, you may view through the application the information that the artificial intelligence coach has recorded about you for the continuity of the coaching and delete any record you wish.
You may submit your applications, together with the information and documents evidencing your identity and your request, to the KVKK application e-mail address (privacy@quidit.app) via your electronic mail address registered in the Company’s systems. Applications are finalised as soon as possible depending on their nature and within 30 days at the latest.
The application is not offered to persons under the age of 18. The date of birth declared during registration is checked and the registration of persons who have not reached the age of 18 is not completed. If the Company determines that an account has been opened by a person who is not of full age, it may suspend or close the account and deletes the personal data that is not legally required to be retained. Where an account belonging to a person who is not of full age is identified, notification may be made via the e-mail address privacy@quidit.app.
This Information Notice is presented in an accessible manner on the membership screen and within the application at the time the personal data is obtained. The recording of the fact that the text has been read or presented does not mean that explicit consent has been given. A separate choice is obtained for operations requiring explicit consent. In the event of a material change in the data processing activities, the text is updated and the current version is published through the application.