Privacy Policy

1. Who is responsible for your data

The controller of your personal data is Dr. Kerem AL, who runs qiboo.ai as a sole proprietorship in İzmir, Türkiye.

Write to [email protected] with any question about this policy or your data.

qiboo.ai is an evidence and education resource. It is not a medical device and not a medical-records system.

2. What we collect and where it comes from

2.1 Data you give us on the site

• Account: your e-mail address; your password, which we store only as a one-way bcrypt hash; your username and display name; the role and interests you choose at sign-up.
• Optional profile fields: bio, country, specialties, affiliation, website, ORCID iD and profile photo. Your profile is not shown to other members or visitors.
• Agreement and consent records: what you accepted, gave or withdrew, which text version, in which step (for example sign-up or Settings) and when.
• Saved items: the studies, videos and courses you save.
• Verification requests: your role, an evidence link (ORCID, faculty page or licence register), the licence details, an institutional e-mail address and a short statement you enter.
• AI tools: the text you type, the answers, and what is kept in your account (chat history, appraisals, documents and letterhead). See section 4.
• Practitioner directory: the fields of your listing. See section 15.
• Newsletter: your e-mail address, the topics and language you choose, and the record of your subscription and confirmation.
• E-mails you send us and our replies.

2.2 Data we receive from other services

• Google, if you use "Continue with Google": your name, e-mail address and profile picture link.
• Paddle, if you buy a subscription: your Paddle customer and subscription IDs, the status of your subscription, its currency, the next billing date and any scheduled change. We never receive your card details.
• Cloudflare Turnstile, at sign-up and after three failed sign-in attempts: the result of the check (person or bot). We use it only at that moment and do not store it.

2.3 Data collected automatically

• AI tool usage log: which tool, when, how many characters, the number of messages in a conversation, the language and level you chose, the study's ID, the term you looked up in the glossary or in reference look-ups (up to 80 characters), the result code, how long it took, your account ID and your IP address. The text you type into the AI tools and the answers are not in this log.
• Usage counters for monthly limits: per account, or per IP address if you use a tool without an account.
• Record of the notice you confirm before generating a clinical document: that you confirmed it, with your account ID or, without an account, a hash of your IP address.
• Sign-in sessions: for each session, a record that includes your browser's identification string (user agent).
• Web server access logs: IP address, time, page path, referring page and browser. We remove query strings and authorization and cookie headers, and we do not log requests to our API.
• Access log of our sign-in service and system error logs.
• Visit statistics (Umami, on our own server): the page address, the referring page, browser, operating system, device type, screen size, language and approximate location (country, region, city). Umami sets no cookies and does not store your IP address. It does not run on pages whose address contains a one-time key (e-mail confirmation, password reset, newsletter confirmation and unsubscribe).
• Browser storage: see section 9.

2.4 What is required

To open an account you need an e-mail address and a password, or a Google account. Everything else is optional. Without an account you can read the site and use Ask qiboo within a usage limit.

2.5 Authors of published studies

Our library shows the bibliographic details of published research (author names, title, journal, year) as the authors and publishers made them public. To ask for a correction, write to [email protected].

3. Purposes, legal bases and how long we keep data

Each row below is one purpose. We do not use your data for any purpose that is not listed here. If we need a new purpose, we will tell you before we start.

When you delete your account (Settings → Your data → Delete my account permanently), we delete at once your profile, saved items, chat history, appraisals, documents, letterhead, usage counters, consent records, verification requests, directory listing, subscription record, newsletter subscription and our record of e-mails sent to you. Your 👍/👎 answer ratings and their notes are deleted at once as well. Rows of the AI tool usage log stay until their 1-year period ends, but your account identifier and e-mail address are removed from them; the IP address in those rows stays until the row itself is deleted at the end of that year. Records of reports about directory listings and of our decisions on them stay without your name for 3 years, then they are deleted.

Backups: data you delete also disappears from our backups when those copies expire, at the latest after about 3 months.

4. Health information and the AI tools

4.1 What counts as health information

Health information is any information about a person's physical or mental health: symptoms, complaints, diagnoses, test results, medicines, treatments, and findings such as tongue or pulse descriptions. The law treats it as a special category of personal data (GDPR Art. 9; KVKK Art. 6).

4.2 Which tools receive what you type

Ask qiboo (also usable without an account), Ask this study, the AI study appraisal, Find evidence for a condition (you choose a condition or topic; the tool does not ask for your symptoms), the TCM Diagnostic Assistant (for members; you describe findings in writing, and the result is shown for you to read or print), patient information notes and PDF Studio documents. We no longer offer tongue-photo analysis.

4.3 Information about a patient

If you are a practitioner, do not enter anything that identifies a patient: name, date of birth, ID or file number, address, phone number, e-mail address or photo. Also avoid details that could identify a patient when combined, such as exact dates, place of residence, workplace or a rare condition that points to one person. Describe the case in general clinical terms only. De-identified clinical information can still be a patient's health data and is protected under the rules in this section.

When you enter information about a patient while signed in, you are the controller of that information and qiboo acts as your processor, under the data processing terms in our Terms of Service. We process this information only on your instructions and for the purposes stated in this section: to produce what you ask for, to keep what is saved in your account and to keep the service secure. We ensure that the people who can access it are bound by confidentiality; we apply the security measures required by KVKK Art. 12; we notify you without undue delay if we become aware of a personal data breach affecting it; when you delete the record or your account we delete it, and it leaves our backups as they expire (within about 3 months at the latest); and we tell you by e-mail before we change the list of sub-processors. If a patient contacts us about this information, we will pass the request to you. You are responsible for informing your patient and for having a legal basis to use their information in this way.

This information is stored on our server in Germany and sent to Google in the United States to generate answers. Under KVKK, no standard contract is yet in place for these transfers (section 12.5); take this into account in your own assessment and enter only general clinical information that does not identify the patient. If you are a practitioner established in the EU, EEA, Switzerland or the United Kingdom, do not enter information about your patients in qiboo.ai, because we do not yet offer the data processing and transfer agreement this would require. Do not enter patient information into tools you use without an account. When you enter information about your own health, qiboo is the controller and relies on your explicit consent (section 4.4).

qiboo.ai does not provide services as a HIPAA covered entity or business associate. Do not enter protected health information (PHI).

4.4 Information about your own health

For information about your own health that you type into the AI tools, we rely on your explicit consent (GDPR Art. 9(2)(a); KVKK Art. 6(3)(a)): to generate the answer and, when you are signed in, to keep it in your chat history and in the items you save. This consent is optional and separate from the Terms of Service. You can give it when you sign up or later in Settings → Health information in AI tools. The consent text reads:

"Optional: I give my explicit consent to qiboo processing health information about myself that I choose to type into its AI tools, to generate answers and — when I am signed in — to keep it in my chat history and the items I save until I delete them. To generate answers, this information is sent to qiboo’s AI provider, Google (United States). I can withdraw this consent at any time in Settings. Privacy Policy" (version 2026-10-02b; the last words link to this section)

The consent covers only information about yourself. Do not type health information about another person, for example a family member.

The consent is not a technical switch: the tools work the same whether or not you have given it. So if you have not given it, or you use the tools without an account (where we cannot record a consent), do not type information about your own health. You can still read everything on the site and ask general questions.

You can withdraw your consent at any time in Settings → Health information in AI tools. Withdrawal does not affect processing before it, and it does not delete anything by itself. To delete what was saved, use the button "Delete my saved chats and documents" in the same place: it deletes all of them from your account in one step. You can also delete items one by one. When you accept updated Terms of Service, leaving the health box unticked does not withdraw a consent you gave earlier; consent is withdrawn only in Settings.

4.5 What happens to the text you type

• It is sent to Google Cloud's Vertex AI service (Google LLC, United States) to produce the answer; the search in our library also turns your question into a search code (embedding) through the same service. We use Vertex AI under the Google Cloud Data Processing Addendum, which we accepted on 2 October 2026; under it Google processes the data as our processor. Under the Google Cloud terms, Google does not use your prompts or the answers to train its models. Google may keep them for a limited time as those terms allow, for example to detect abuse.
• On our server, before the text reaches the AI provider, we replace e-mail addresses, runs of 10 to 15 digits (phone or ID numbers) and numbers in the format of a US Social Security number with placeholders. This applies to Ask qiboo, Ask this study, the TCM Diagnostic Assistant, Find evidence for a condition, patient information notes, document generation, and the conversations you save. Names, dates of birth and addresses cannot be recognised this way, so do not type them.
• qiboo does not keep the text in its logs. Our usage log records only the metadata listed in section 2.3. Content records from before 2 October 2026 have been deleted.
• If you generate a document without an account, we keep it for 30 days so that you can download the PDF and its QR verification link works. It is stored under a hash of your IP address and is then deleted automatically. When you generate a document without an account, do not type information about a patient or about your own health; choose a condition from the list instead.
• Our answer cache keeps some answers so that the same question can be answered faster. It stores only the answer, under a code made from the question; it does not store your question and is not linked to you. Answers in Ask qiboo, Ask this study and query expansion are deleted 90 days after they were last used. Reports from the TCM Diagnostic Assistant, patient information notes, results of Find evidence for a condition and documents generated from a typed complaint are never cached, because they can restate the clinical details you entered.
• The "memory" feature, which used earlier questions to shape later answers, is switched off. Your past questions do not affect new answers.

4.6 What is kept in your account

If you are signed in, your conversations with the AI tools are saved automatically to your chat history. The appraisals and documents you generate are also kept in your account automatically, and so is your letterhead (clinic name, practitioner name and logo). We keep your 100 most recent conversations and 200 most recent documents; older ones are deleted automatically. Documents generated from a complaint you typed, rather than from a condition chosen from the list, are deleted 30 days after they were generated, also for members. Everything else stays until you delete it or delete your account.

The TCM Diagnostic Assistant shows its result for you to read or print. It does not save your description or the result in your account or on our server. Saved cases were retired on 2 October 2026, and the cases saved until then were deleted that day.

The QR code on the PDFs you generate opens the document's verification page on qiboo.ai. That page shows the document's text and sources, and anyone who has the QR code or the link can open it without signing in. When the document is deleted (for documents generated without an account or from a typed complaint, after 30 days), the page closes.

Chat history is not end-to-end encrypted. Only the controller, as administrator, can access it.

5. Your profile and saved items

• Your profile (username, display name, role and the optional profile fields you fill in) is not shown to other members or visitors. qiboo.ai has no public profiles and no member search.
• The studies, videos and courses you save are not shown to others either.
• Your research feed is ordered by the specialties you choose and by the topics of the studies, videos and courses you save. It is not based on your reading history or on what you type into the AI tools.
• We do not publish your conversations on public links. Others can see only a directory listing you have applied for and we have published (section 15), and the verification page of a document you generated, which anyone who has its QR code or link can open (section 4.6).
• The community features (posts, comments, likes, follows, direct messages, notifications and member discovery) were closed on 2 October 2026. The data stored in them was deleted that day and all profiles were made private; deleted data leaves our backups as those expire (within about 3 months at the latest).

6. E-mails

• Service e-mails: e-mail verification, password reset and required notices about your account or subscription (for example, changes to prices or to the Terms of Service). They are part of the service and contain no promotion.
• Weekly evidence newsletter: sent only if you subscribe and then click the confirmation link we send you. If you subscribe again after unsubscribing, we send you a new confirmation link; no newsletter is sent until you confirm. Every issue has a one-click unsubscribe link. It contains no promotion. The topics you pick are used only to choose the studies we send; we suggest you pick topics you treat or study rather than your own health conditions. We record the version of the consent text and the page where you subscribed. Requests you do not confirm are deleted after 30 days. After you unsubscribe, we keep your address and the dates for 3 years, to be able to prove your choices and to make sure we do not write to you again, and then delete them.
• Promotional e-mails: we do not send them. If we ever plan to, we will first ask for your separate consent.

7. Who receives your data

A processor handles data only on our instructions. An independent controller decides for itself how it uses the data and is responsible for that under its own privacy notice. A service provider is a company that provides a service to us and processes data for that service.

Pictures from other sites (video thumbnails, podcast covers and news images) are fetched by our own server and shown to you from there, so opening a page does not make your browser connect to those sites. We do not sell your personal data. We do not share it with advertisers or data brokers.

8. Transfers to other countries

• Hosting in the EU: our server is in Germany.
• Access from Türkiye: the controller is in Türkiye and runs the service from there, so data stored in Germany is accessed from Türkiye. The European Commission has not adopted an adequacy decision for Türkiye. Because we offer the service to people in the EU, the GDPR applies directly to how we process their data, and your GDPR rights are the same wherever we access the data from. The same applies to users in the United Kingdom: the UK has no adequacy regulations for Türkiye, and your UK GDPR rights apply in full.
• United States (Google Cloud Vertex AI and Cloudflare): these providers' data processing terms include the European Commission's standard contractual clauses for transfers from the European Union. For Vertex AI, they apply under the Google Cloud Data Processing Addendum, which we accepted on 2 October 2026. Google LLC and Cloudflare, Inc. also participate in the EU-U.S. Data Privacy Framework and its UK Extension. If you are in the EU, EEA, Switzerland or the United Kingdom, you can ask for a copy of these safeguards at [email protected].
• United States (Google Gmail and Google Drive): we use Google's personal-account services, under Google's general terms, to send e-mails, to receive the e-mails sent to our @qiboo.ai addresses and to store encrypted backups. For these services there is no separate data processing agreement with Google and no standard contractual clauses. Backups are encrypted before they reach Google, and Google cannot read them; the content of e-mails, including the messages you send us, passes through and is stored on Google's servers.
• Videos and podcasts: if you press play on a video or a podcast episode, your browser connects directly to YouTube (Google) or to the service that hosts the podcast, mostly in the United States.
• United Kingdom (Paddle): Paddle receives data as an independent controller. The United Kingdom is covered by an adequacy decision of the European Commission.
• Under KVKK: because the controller is in Türkiye, every recipient in the table above that is outside Türkiye, including our server in Germany, is a transfer abroad, wherever you live. See section 12.5.

9. Cookies and browser storage

We do not use advertising, retargeting or social-media tracking cookies or pixels. Below are the items qiboo.ai itself stores in your browser (a few more exist only for administrators and for features still being tested). Items kept only on your device are not sent to our server.

Services that load only in certain places:

• Visit statistics (Umami): runs on our own server. It sets no cookies, uses no browser storage and does not store your IP address. Nothing goes to a third party. It does not run on pages whose address contains a one-time key. What it records is listed in section 2.3.
• Bot check (Cloudflare Turnstile): on the sign-up form, and on the sign-in form after three failed attempts. It is loaded from Cloudflare (United States) and checks your IP address and browser signals.
• "Continue with Google": on the sign-in and sign-up pages the button is loaded from Google (United States) when the page opens. Loading it connects your browser to Google. Google may set a cookie (g_state) to remember the button's state, and if you are signed in to Google in this browser, Google can recognise you.
• Payments (Paddle): Paddle's script loads only on the pricing page, to show your local price, and when you click a checkout button. Paddle may set its own cookies there under its own privacy notice.
• Videos and podcasts: thumbnails and cover images are served through our own server, so your browser does not connect to YouTube or to podcast hosts just by opening a page. The video player is loaded from youtube-nocookie.com (YouTube, Google, United States) only when you press play; YouTube may then set its own cookies or store data in your browser. If you play a podcast episode, the audio is loaded directly from the service that hosts it.
• Images: pictures from other sites, such as news and stock images, are also served through our own server.

Removing it: signing out removes the session items. Clearing this site's data in your browser removes everything else. On a shared computer, sign out and clear the site data, because letterhead details and other local items could otherwise be seen by the next person.

10. Your rights and how to use them

10.1 Do it yourself in Settings

• Settings → Your data → Download my data (JSON): a copy of the data held in your account: profile, consent records, saved items, chat history, appraisals and documents, letterhead, usage counters, the metadata in the AI tool usage log, subscription and newsletter records. The file does not include your password hash, your session tokens or our record of e-mails sent to you (kept for 30 days).
• Settings → Your data → Delete my account permanently: you confirm by typing your e-mail address. If you have an active paid subscription, first stop its renewal: Dashboard → Manage subscription, which opens Paddle's subscription portal. Once renewal is stopped, you can delete your account straight away; your access for the rest of the paid period then ends too. What is deleted and what remains is explained in section 3.
• Settings → Health information in AI tools: give or withdraw your consent. The button "Delete my saved chats and documents" in the same place deletes all of them in one step.
• Settings: correct your profile.
• Newsletter: use the unsubscribe link in any issue.

10.2 Your rights under the GDPR

• Access to your data and information about how we use it (Art. 15).
• Rectification of inaccurate or incomplete data (Art. 16).
• Erasure (Art. 17).
• Restriction of processing (Art. 18).
• Data portability in a machine-readable format (Art. 20).
• Objection to processing based on our legitimate interests (Art. 21).
• Withdrawing consent at any time, without affecting processing before the withdrawal (Art. 7(3)).
• Complaint to a supervisory authority (Art. 77), see 10.4.

We apply these rights to all users, wherever they live. Your rights under Article 11 of the KVKK are listed in section 12.6.

10.3 How to make a request

For anything you cannot do in Settings, e-mail [email protected], if possible from the e-mail address registered with your account, and say which right you want to use. If you have no account, tell us how we can find the data concerned. We may ask you to confirm your identity before we act.

We reply without undue delay and within one month. If a request is complex, this can be extended by up to two further months; we will tell you within the first month. Requests under KVKK are answered within 30 days, free of charge (section 12.7).

10.4 Complaints

• EU/EEA: the data protection supervisory authority of the country where you live, work or where the alleged infringement took place.
• United Kingdom: the Information Commissioner's Office (ICO).
• Türkiye (KVKK): the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu), after you have first applied to us (section 12.7).

California: we do not sell or share personal information as these terms are defined in the California Consumer Privacy Act. You can ask to know or delete your data at [email protected], and we will not treat you differently for doing so.

11. AI and automated decisions

• When you use the AI tools, you are interacting with an AI system, not a person. Answers are generated with Google's Gemini models, through Google Cloud Vertex AI, from the qiboo reference library and may contain errors. Every AI tool says on screen that its output is generated by AI: the question box on the home page, the Ask qiboo page, Ask this study, Find evidence for a condition, the AI study appraisal and the TCM Diagnostic Assistant. Every page of our PDF documents carries a note that it was prepared with AI assistance.
• AI output is information for you to evaluate. It is not a decision about you.
• We do not make decisions about you based solely on automated processing that have legal effects on you or affect you in a similarly significant way.
• Some protective steps are automatic: the bot check at sign-up and sign-in, a short lock of an account after repeated failed sign-ins, blocking of disposable e-mail addresses, and usage limits. Directory listings are reviewed by a person. If an automatic step affects you, write to us and a person will review it.

12. KVKK notice (Turkish data protection law)

This section, together with the table in section 3 and the list of recipients in section 7, is our notice under Article 10 of Law No. 6698 on the Protection of Personal Data (KVKK). Because the controller is established in Türkiye, we are subject to KVKK; this section applies to you wherever you live. The Turkish version of this policy is the authoritative text of this notice. This notice is for information only; it does not ask for your approval or consent. Where processing relies on explicit consent, we ask for it separately, with its own text.

12.1 Controller

Dr. Kerem AL, sole proprietorship, operator of qiboo.ai. Address: Hacı İsa Mah., 75. Yıl Cumhuriyet Cad. No: 31/1, Urla Plaza, Urla, İzmir, Türkiye. Tax number: 0470462351. E-mail: [email protected].

12.2 Purposes and legal grounds

Each purpose is listed in its own row in the table in section 3, and the "KVKK" column gives its legal ground. In summary:

• Art. 5(2)(c), establishing or performing a contract: your account, the AI tools, your chat history and documents, your profile and saved items, documents generated without an account, the verified badge, the directory, the subscription, service e-mails and answering your messages.
• Art. 5(2)(ç), legal obligation: records proving consents and this notice, answering applications under KVKK, and requests from competent authorities.
• Art. 5(2)(e), establishing, exercising or protecting a right: agreement and consent records, the record of the notice confirmed before generating a document, the proof record kept after you unsubscribe from the newsletter, correspondence and legal claims.
• Art. 5(2)(f), legitimate interest: preventing abuse, usage limits, bot protection, security logs, visit statistics, backups, the record of sent e-mails, and reports about directory listings and our decisions on them.
• Art. 5(1), explicit consent: the weekly evidence newsletter.
• Art. 6(3)(a), explicit consent: information about your own health that you type into the AI tools.

For information practitioners enter about their patients, the practitioner is the controller and is responsible for informing the patient (section 4.3).

We do not process your personal data for any purpose that is not in the table.

12.3 How we collect your data

We collect your data electronically through the website: by fully automated means from the forms, settings and AI tools you use and from our server records; from the services listed in section 2.2 (Google, Paddle, Cloudflare); and by partly automated means when you write to us by e-mail.

12.4 Who receives your data and why

• Service providers that act on our instructions: Hetzner (hosting, Germany); Google (AI answers through Google Cloud Vertex AI, USA); Cloudflare (domain name system and forwarding of e-mails sent to @qiboo.ai addresses, USA; bot check at sign-up and sign-in: Cloudflare processes part of the signals collected in this check under its own responsibility, to improve bot detection).
• Services we use under their own general terms: Google (sending e-mails through Gmail; receiving the e-mails sent to @qiboo.ai addresses in a Gmail mailbox; encrypted backups in Google Drive; USA). There is no data processing agreement with Google for these services.
• Companies that act as independent controllers: Paddle (sale of the subscription, payment, invoice and tax, United Kingdom); Google ("Continue with Google").
• Services your browser connects to only when you use them: YouTube (Google) when you play a video; podcast hosting services when you play an episode.
• Visitors to the site: your directory listing, once we have published it; the verification page of a document you generated, for anyone who has its QR code or link.
• Administrator access: only the controller has administrator access to personal data, for support, reviewing directory listings, security and fixing errors.
• Authorised public institutions and courts: only when the law requires it.
• A new operator: if qiboo.ai is transferred.

12.5 Transfers abroad (KVKK Art. 9)

Under KVKK, sending personal data to a recipient outside Türkiye, or storing it on a server abroad, is a transfer abroad. Because the controller is in Türkiye and our server is in Germany, all data the service stores is transferred abroad. Data also goes to the United States (Google: AI answers, e-mail, encrypted backups and "Continue with Google"; Cloudflare: bot check and e-mail forwarding; YouTube and podcast hosting services when you play a video or an episode) and to the United Kingdom (Paddle, as an independent controller, for payments).

The Personal Data Protection Board has not issued an adequacy decision for these countries. At present, no standard contract under KVKK Article 9 has been signed with any of these recipients and notified to the Personal Data Protection Authority. Since 2 October 2026 the AI processing runs on Google Cloud Vertex AI, under the Google Cloud Data Processing Addendum. We have asked Google to conclude the standard contract published by the Board for these transfers; it has not been signed yet. Once it is signed, we will notify it to the Personal Data Protection Authority within 5 business days and update this section with the dates.

We do not rely on your consent for these regular transfers. Your optional consent for health information concerns the processing of that information (KVKK Art. 6); it is not a consent to transfer data abroad.

12.6 Your rights (KVKK Art. 11)

You have the right to:

• a) learn whether your personal data is processed;
• b) request information about it if it is processed;
• c) learn the purpose of the processing and whether the data is used in line with that purpose;
• ç) know the third parties in Türkiye or abroad to whom your data is transferred;
• d) ask for incomplete or inaccurate data to be corrected;
• e) ask for your data to be deleted or destroyed under the conditions of KVKK Article 7;
• f) ask that the corrections, deletions and destructions under (d) and (e) be notified to the third parties to whom your data was transferred;
• g) object to a result against you that arises from the analysis of your data exclusively by automated systems;
• ğ) claim compensation for damage you suffer because your data was processed unlawfully.

These rights apply wherever you live, for as long as we process your data.

12.7 How to apply

You can apply in Turkish or English by one of these means:

• in writing, by post or by hand, to Dr. Kerem AL, Hacı İsa Mah., 75. Yıl Cumhuriyet Cad. No: 31/1, Urla Plaza, Urla, İzmir, Türkiye;
• by e-mail signed with a secure electronic signature or a mobile signature, to [email protected];
• by e-mail to [email protected] from the e-mail address registered with your qiboo.ai account.

Your application should include: your name and surname (and your signature if you apply in writing); your Turkish ID number, or, if you are not a Turkish citizen, your nationality and passport or ID number; your address for notifications; your e-mail address and phone number, if any; and what you are asking for. You can attach documents that support your request.

We will answer as soon as possible and within 30 days at the latest, free of charge. If we refuse your request, we will give the reasons. We will reply in writing or by e-mail.

If we refuse your application, if you find our answer insufficient, or if we do not answer in time, you can complain to the Personal Data Protection Board within 30 days of learning our answer, and in any case within 60 days of your application. You must apply to us before you can complain to the Board.

13. Children

qiboo.ai is for adults. You must be at least 18 years old to use the site's AI tools and to open an account. When you sign up, you confirm that you are 18 or older. If we learn that an account belongs to someone under 18, we will delete it. You can tell us at [email protected].

14. Security

• All connections to qiboo.ai are encrypted (TLS).
• Passwords are stored only as one-way bcrypt hashes.
• The sign-in cookie cannot be read by scripts on the page (HttpOnly).
• Administrator access to personal data is limited to the controller. Each time an administrator screen with personal data is opened, for example the member list or the usage log, we record who did it, when, on which screen and with which filter. The data itself is not copied into this record.
• Copies of our backups that leave the server are encrypted first. The decryption key is held only by the controller and is not shared with Google. We test restoring a backup every month.
• The server is protected by a firewall and monitored automatically.
• Chat history is not end-to-end encrypted.

No system is completely secure. If you notice a security problem, write to [email protected].

15. Practitioner directory

If you are a practitioner or clinic, you can apply for a listing from your account on the My clinic listing page. We review each application and decide whether to publish it; publication is our editorial decision. If we publish it, we show the fields you choose: name, clinic, city, region, country, specialties, website, bio and photo. Your phone number and e-mail address are shown only if you tick the box for each. Until we publish it, your application is not shown to the public. You can edit or delete your listing at any time from your account; deleting it removes it from public view at once.

We publish your listing to perform the listing agreement with you (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)). We record which version of the Practitioner Listing Agreement you accepted and when. The directory also lists institutions that we added ourselves (59 at present); these entries contain only the business name, location and public website. Questions about listings: [email protected].

An earlier application form that could be used without an account has been closed; listings can now be created only from an account. The two applications sent through that form were deleted from our server on 2 October 2026; they leave our backups as those expire (within about 3 months at the latest).

16. Changes, versions and languages

We publish each new version of this policy on this page with its date. Before we use your data for a new purpose or send it to a new kind of recipient, we will tell registered users by e-mail or with a notice on the site. If a change needs your consent, we will ask for it separately. Continuing to use the site does not count as consent.

Versions: version 1, 28 May 2026 · version 2, 2 October 2026 · version 3, 2 October 2026 (evening): rewritten to match how the service works today. The AI tool usage log no longer stores the text of questions and answers; earlier content records were deleted on 2 October 2026. On the same day the community features and shared chat links were closed, saved cases were retired, their data was deleted, and the AI processing moved to Google Cloud Vertex AI. Deleted data leaves our backups when those copies expire.

Languages: this version is published in English and Turkish. For the KVKK notice, the Turkish text is authoritative. For every other language, the English text is authoritative until a human-checked translation into that language is published; translations of earlier versions of this policy into other languages are no longer in force. New translations will be listed in this section when they are published. If the English and Turkish texts differ, the meaning more favourable to you applies.