Privacy Policy
This policy explains how personal data is processed in the clinic management software provided by CareXCrm ("the Service", "we") at carexcrm.com and clinic subdomains (clinic.carexcrm.com). It is written with the Turkish Personal Data Protection Law (KVKK) and the GDPR in mind.
1. Roles: controller and processor
- Account holders (clinics and their users): for the clinic name, your name, phone, e-mail and password provided at sign-up, and for subscription and payment details, CareXCrm is the data controller.
- Clinic data (leads, patients, appointments, quotes, messages): your clinic enters this data about its own patients and customers. For this data the clinic is the controller; CareXCrm acts only as a processor on the clinic's instructions under the service agreement.
2. Data we process and why
- Account and contact data: creating the account, authentication, support, invoicing and subscription notices.
- Usage data: login records, IP address, browser information and error logs; used for security, abuse prevention and improving the Service.
- Clinic data: the clinic's lead, patient, appointment, quote, invoice and messaging records; stored and processed solely so the clinic can use the Service. Obtaining the consent required for special categories such as health data is the clinic's responsibility.
- Integration data: when a clinic connects its Facebook page or WhatsApp Business account, the page ID, access tokens (stored encrypted), Lead Ads form responses and WhatsApp messages provided by Meta Platforms; used only to run the clinic's own lead and message flow.
3. Legal bases
We process data to perform the contract with you, to comply with legal obligations, for our legitimate interests (security and service quality) and, where required, on the basis of consent.
4. Storage and security
- Each clinic has its own separate database; no clinic can access another clinic's data.
- Data is transmitted over encrypted connections (HTTPS); passwords are irreversibly hashed; integration tokens are stored encrypted.
- Nightly backups are taken and kept for a limited period. Servers are hosted on a virtual server located in Europe.
- When an account is closed, clinic data is deleted within a reasonable period, subject to legal retention duties. See the Data Deletion page for details.
5. Third parties
We use a small number of sub-processors to deliver the Service: server hosting, e-mail delivery infrastructure and, at the clinic's choice, Meta Platforms services (Facebook, Instagram, WhatsApp). Your data is never sold or shared for advertising purposes.
6. Cookies
Only strictly necessary cookies are used, to keep your session and for security. No tracking cookies are used on the marketing site.
7. Your rights
You may exercise your rights of access, rectification, erasure, objection and portability by writing to info@carexcrm.com. Requests concerning clinic data should first be addressed to the clinic concerned; CareXCrm supports the clinic in fulfilling them.
8. Changes
This policy may be updated; material changes are announced to account holders by e-mail. Questions: info@carexcrm.com.