1. Scope and responsibility
This Privacy Policy explains how ADESSE HEALTH ("we", "us" or "our") collects, uses, stores and discloses personal information when you use the ADESSE HEALTH patient application, the ADESSE HEALTH therapist dashboard, adessehealth.com, our demo and waitlist forms, and related support services (together, the "Services"). It covers patients, therapists and other authorized professional users, website visitors and people who contact us.
The publisher and operator of ADESSE HEALTH is ORVION Dijital Hizmetler Anonim Şirketi. ORVION Dijital Hizmetler Anonim Şirketi is the data controller for processing whose purposes and means it determines in operating ADESSE HEALTH, including platform accounts, security, website inquiries and support. Where a therapist or clinic determines the purposes and means of processing clinical records and instructs ADESSE HEALTH to host or process those records, that therapist or clinic is the controller and the ADESSE HEALTH operator acts as its processor. The allocation of responsibilities depends on the processing activity and the applicable service arrangement; a therapist may also provide a separate privacy notice.
You can contact ADESSE HEALTH about this policy and the responsible party for your records at contact@adessehealth.com. We will help route requests concerning a therapist-controlled record to the appropriate therapist or clinic. This policy describes data handling; it is not consent to treatment, session recording, optional processing or an international transfer.
2. Information we collect and where it comes from
We receive information you enter, information your therapist or clinic enters or shares with you, information returned by our authentication and infrastructure providers, and records generated when the Services operate. The categories actually processed depend on the features you use.
| Category | Examples and source | Purpose |
|---|---|---|
| Account and identity | Name, email, account and authentication identifiers, role, invitation and enrollment status, language, time zone and sign-in records. A therapist may also add your date of birth, gender, phone number and address. | Authenticate users, connect patients with their therapist, manage access and maintain the correct profile. |
| Patient-entered information | Mood scores and notes; journal entries and structured reflections; questionnaire answers and scores; assigned homework, completion records and responses; session preparation topics. | Provide tracking and reflection features, save your work and support the care activities and sharing described below. |
| Therapist and care records | Patient lists, recorded diagnoses and goals, appointment details, clinical notes, uploaded documents, therapist annotations, assessments, assignments, session summaries and review decisions. | Operate the dashboard, organize care, prepare for sessions and make selected materials available to patients. |
| Audio and derived session records | Audio recorded through the therapist dashboard or uploaded for transcription, recording consent acknowledgment, timestamps, speaker labels, transcript text, corrections and AI-generated drafts. | Transcribe sessions, support therapist review and generate session documentation when the recording feature is used. |
| AI interactions and inferences | Patient and therapist messages, generated replies, relevant profile and care context, retrieved memories, numerical representations of text, generated insights, safety classifications and your responses to safety checks. | Provide the AI features, retrieve relevant context, generate reviewable suggestions and operate content safety checks. |
| Website and support information | Contact name, email, professional role, organization, team size, demo interests, messages and support correspondence. | Respond to inquiries, arrange requested demos, administer the waitlist and resolve support or privacy requests. |
| Technical and operational information | IP address, browser or device information available with requests, timestamps, authentication events, request identifiers, error records, security and audit events, and AI usage quantities. | Deliver the Services, prevent unauthorized access, diagnose failures, monitor reliability and manage service capacity and cost. |
3. Health and other sensitive information
Mood, therapy notes, diagnoses, questionnaires, journals, messages, recordings and inferences can reveal mental or physical health, sexual life, beliefs or other sensitive information. We treat this content as sensitive, even when you provide it in a free-text field rather than a medical form. An AI inference may also be personal or health information and may be inaccurate.
Only provide information relevant to the feature or your care. Avoid including unnecessary identifying information about other people. Therapists are responsible for having an appropriate basis to enter information about patients and third parties and for providing the notices and obtaining the permissions their professional activities require.
We do not sell personal information, rent patient lists, or use journal entries, chat content, recordings, diagnoses or other therapy content for targeted advertising or advertising profiles. The current mobile application does not include advertising-network tracking or request the advertising identifier.
5. AI features, context and memory
ADESSE HEALTH uses AI to provide the patient companion and therapist assistant, support session preparation, produce draft summaries and care insights, and assist with retrieval and organization of information. These features use Microsoft Azure-hosted AI services, including Azure OpenAI, text embeddings, Azure AI Content Safety and Prompt Shields. Session transcription uses Azure Speech. Relevant input is sent to these providers for processing; it is not processed exclusively on your device.
Depending on the feature, inputs can include your current message, previous turns, name, language, recorded diagnosis and goals, journal entries, stored memories, shared care information, session preparation, notes or transcripts. The patient companion and therapist assistant use different access scopes. Therapist-facing context includes shared journals and care records available to the therapist; the patient companion can use your own private journal entries when memory is enabled.
The current chatbot-memory setting is stored on your device and defaults to enabled. Turning it off stops subsequent chat turns from retrieving past chat history, journal context and stored memories, and from initiating new memory/insight extraction for those turns. Your current message and basic profile context still need to be processed to answer you, and chat messages and safety records can still be stored. This switch does not delete existing conversations, memories or therapist-visible insights. Signing out resets the device preference; review it when using a new device or signing in again. Contact us to request deletion of previously stored information.
Text embeddings are numerical representations used to find relevant information. They and the associated memory records are treated as personal information while linked to you. Personalization and creating a memory record are distinct from training a general-purpose AI model. ADESSE HEALTH does not use your therapy content to train general-purpose AI models. Microsoft states that inputs and outputs in its Azure-hosted model services are not used to train base models. Provider safety and abuse-monitoring processes may nevertheless process and, in applicable cases, retain or review content; we do not promise zero provider retention or that no authorized human can ever access it.
AI outputs can be incomplete or wrong. They support reflection and professional review; they are not a diagnosis, an autonomous treatment decision or a substitute for a qualified professional. You may request correction of personal information and raise concerns about an inference with your therapist or ADESSE HEALTH. This policy does not itself supply any separate permission required before data is sent to a third-party AI provider.
6. Session recording, transcription and documents
When a therapist uses session recording, the dashboard accesses the microphone after browser permission and records a consent acknowledgment. Audio and associated metadata are uploaded to controlled cloud storage and processed by Azure Speech to produce transcripts; text can then be processed by AI to create draft documentation. The therapist must inform participants and obtain the permission required for recording and associated processing before starting. A browser microphone permission alone is not the patient’s consent.
Transcripts can contain speaker labels, timestamps, spoken health details and information about other people. Therapists can review and correct transcripts and approve or revise summaries. Deleting raw audio does not automatically delete its transcript, summary, clinical note or a legally retained care record. See the retention section for these differences.
Therapists may upload and organize patient documents and make selected PDFs available in the app. File names, type, size, content, ownership and sharing state are processed to provide this feature. If you download or export a document, that copy is governed by your device, chosen storage location and any external service you select.
7. Safety checks and service limitations
Automated safety systems analyze chat inputs and outputs for potentially harmful content, possible immediate danger and attempts to bypass system instructions. The service can store a safety event, classifications, the relevant exchange and your response to a safety question. A safety check may pause ordinary chat until you respond. These are automated signals, not a clinical assessment, and they can be mistaken.
The Services are not continuously monitored emergency services. Sending a message or triggering a safety check does not guarantee that a therapist has been notified, that anyone has read it promptly, or that emergency assistance has been contacted. Seek immediate help through local emergency services if needed. Where disclosure is legally required or permitted to address a serious threat, only information relevant to that purpose should be disclosed.
8. Purposes and legal grounds
We process information to deliver the features you request, maintain accounts and care connections, support therapist workflows, respond to inquiries, protect the Services, investigate incidents, fulfill legal obligations and establish or defend legal claims. We do not treat this policy or continued use of the Services as blanket consent to every processing activity.
For ordinary personal information, the applicable ground may be taking steps at your request before a contract or performing a contract, a legal obligation, a legitimate interest in operating a secure and reliable service where your rights do not override that interest, or consent for a specific optional purpose. A legitimate interest or a service contract alone is not a sufficient basis for processing special-category health information.
Where Turkish law applies, processing must meet the conditions in Articles 5 and, for special-category data, 6 of Law No. 6698. Where the GDPR applies, an Article 6 basis and, for special-category information, an Article 9 condition are required. Depending on the activity and the responsible care provider, this may involve explicit consent or a legally available health-care ground with its professional-confidentiality safeguards. A health-care ground is not assumed to apply to every platform or AI activity.
Optional consent can be withdrawn prospectively without affecting processing that was lawful before withdrawal. If particular information is necessary to provide a requested feature, declining or withdrawing the relevant permission can prevent us from providing that feature. Any clinical consent or additional notice from your therapist remains separate.
9. Recipients and service providers
We disclose information needed for the purposes described in this policy to the recipients below. We require service providers acting on our behalf to protect it, restrict use to their authorized services and comply with the applicable data-protection terms. This does not replace a therapist’s independent professional obligations.
| Recipient | Role and information involved |
|---|---|
| Your assigned therapist or clinic | Care records and the information made available through the sharing and clinical workflows described in section 4. A care provider’s own copies and professional recordkeeping are subject to its responsibilities. |
| Microsoft Azure and Microsoft Entra External ID | Application hosting, database and document/audio storage, authentication, operational monitoring, AI processing, embeddings, content safety and transcription. This can involve identity information and the sensitive content necessary for the selected feature. |
| Vercel | Hosting and delivery of the public website and its request handlers, including technical request data and information submitted through the website where needed for delivery. |
| Resend and email-service providers | Delivery of website demo/waitlist requests and handling correspondence, including the contact and form information you submit. Do not use the public waitlist form to send patient records. |
| Google Fonts | The public website loads fonts from Google. Font requests expose technical connection data such as IP address and browser request headers; they do not intentionally include your app or therapy records. |
| Authorized personnel and professional advisers | Limited access where needed for support, security, operations, legal advice, compliance and dispute handling, subject to the relevant confidentiality responsibilities. |
| Authorities or a successor operator | Information required by a valid legal demand or necessary and lawful to protect rights or safety; or relevant information in a merger, acquisition or business transfer, subject to applicable protections and required notices. |
10. Storage locations and international transfers
The application’s production infrastructure is configured in Microsoft Azure’s Sweden Central region. Azure AI deployments configured for the European Union data zone may process requests in other EU member states. Authentication, website delivery, email, support and provider operations can involve additional locations, including the United States. We do not claim that all data stays in Türkiye, Sweden or one country.
Where a transfer is subject to the GDPR, an applicable adequacy decision or appropriate safeguards such as standard contractual clauses, together with any required assessment and supplementary measures, must support the transfer. Transfers subject to Turkish law must meet the applicable conditions of Article 9 of Law No. 6698, including an available adequacy decision or appropriate safeguards such as the Board’s standard contracts where relevant. A provider’s EU hosting region does not by itself establish a lawful transfer from Türkiye.
Publishing this policy, accepting general terms or providing ordinary feature consent does not by itself establish an international-transfer mechanism. Contact contact@adessehealth.com to request information about the locations and safeguards applicable to your particular service arrangement.
11. How long information is kept
Retention depends on the type of record, the purpose for which it is held, the therapist’s lawful instructions, applicable professional or legal requirements, and any unresolved security incident or legal claim. Ending care, disabling a feature or signing out is not automatically a deletion request. The following describes the current retention design; applicable care-record requirements may differ by provider and jurisdiction.
| Record | Retention approach |
|---|---|
| Accounts and clinical content | Held for the active service/care relationship and any necessary lawful retention period, then deleted or de-identified as appropriate. Clinical notes, transcripts, assessments and summaries do not all expire when a session audio file is removed. Ask us or your clinic for the criteria applying to your record. |
| Raw session audio | The default application cleanup is scheduled after 7 days; a clinic-specific configuration may differ. Processing failures can delay cleanup. Deleted storage objects can remain recoverable for an additional 7-day soft-delete window. |
| Patient erasure requests | Accepted requests entered into the account-closure workflow are scheduled after a 7-day grace window. This runs from the recorded workflow request, not automatically from your first email. Completion also depends on checks, any lawful retention requirements and successful cleanup. |
| Database backups | Production database backups are configured for a 35-day recovery window. Data removed from active records can remain in protected backups until the recovery window expires. Backup recovery must account for previously accepted deletion requests. |
| Operational and audit logs | Production infrastructure is configured for up to 730 days of operational log retention, with selected audit/security tables retained for up to 2,191 days (approximately six years). These records can contain identifiers and activity metadata and are kept separately from ordinary patient views. |
| Support and waitlist correspondence | Kept as needed to address your request, manage the requested relationship and resolve related disputes or obligations. You may request removal when the purpose ends. |
| Provider and device copies | Authentication-directory records, AI or transcription provider copies, email records, browser/device caches and downloaded files have separate lifecycles. A database deletion alone does not erase every such copy; applicable requests require additional handling. |
12. Account closure, deletion and data requests
To request account closure, deletion, access or a copy of your information, email contact@adessehealth.com. Use a subject such as "Privacy request" or "Account deletion" and, when possible, write from your account email. Identify the relevant service and request without sending clinical content. We may ask for proportionate information to verify your identity and protect your records.
A therapist can close a patient’s access and initiate the patient-record erasure workflow. Where your therapist or clinic controls a record, we coordinate with it to determine what may be erased and what must be retained. Closure, service suspension and permanent erasure are different actions. We will explain any applicable retention restriction rather than promising immediate or unconditional deletion of clinical records.
Deletion may require handling active records, linked documents and recordings, identity-provider accounts and other identifiable copies separately. Protected backups, audit records and lawfully retained clinical records may persist as described above. Turning off memory does not remove prior insights; unsharing a journal does not retract an already created clinical record. You can identify these categories in your request so that they are reviewed explicitly.
Uninstalling the app, signing out, clearing local storage or ending therapy does not automatically delete server-side records. Conversely, deleting server records does not remove copies exported to a therapist’s own record system or downloaded to your device. The holder of those copies is responsible for the applicable deletion and retention duties.
13. Your privacy rights
Your rights depend on the law that applies and can be subject to identity verification, the rights of others and lawful exceptions. We do not require sensitive clinical details merely to initiate a request.
- Under Turkish Law No. 6698, you may learn whether your information is processed; request information about processing, its purpose and whether use accords with that purpose; learn the recipients in Türkiye or abroad; request correction of incomplete or inaccurate information; request deletion or destruction when the legal conditions are met; request that relevant corrections or deletion be communicated to recipients; object to an adverse result produced solely by automated analysis; and seek compensation for damage arising from unlawful processing.
- Where the GDPR or comparable law applies, rights may include access, correction, erasure, restriction, portability of eligible data, objection to processing based on legitimate interests, withdrawal of consent, and protections relating to solely automated decisions with legal or similarly significant effects. You may object to direct marketing at any time.
- We respond within the period required by the applicable law: for KVKK applications, as soon as possible and no later than 30 days; under the GDPR, normally within one month, with any permitted extension and its reason communicated to you. If we cannot fulfill a request, we explain the reason and available recourse.
- You may complain to the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) or the competent data-protection authority where you live, work or believe an infringement occurred, as applicable. This policy does not limit your statutory complaint or court rights.
14. Security and confidentiality
The Services use transport encryption, authenticated access, role and patient-ownership checks, controlled cloud storage, infrastructure access restrictions and audit records. Authentication credentials are handled through Microsoft Entra; the app uses operating-system secure storage for authentication material and separate local storage for preferences. Cloud infrastructure provides encryption at rest.
These measures reduce risk but cannot make any service completely secure. The Services are not end-to-end encrypted in a way that prevents necessary server-side processing: authorized systems must be able to process content for storage, transcription and AI features. Access may be necessary for authorized operations, incident investigation, support or legal obligations.
Protect your sign-in credentials and device, use a screen lock, and take care when downloading shared records or using a shared computer. Contact contact@adessehealth.com if you suspect unauthorized access. Where an incident creates a notification obligation, the responsible party must notify affected people and/or authorities as required by applicable law.
15. Device permissions and Apple Health
The current mobile release does not read from or write to Apple Health or HealthKit. Any preview health values are illustrative and are not measurements collected from your device. We do not currently request access to your precise location, contacts or photo library to provide the patient features described here.
Session microphone access is a therapist-dashboard browser feature, not background listening by the patient app. Opening or saving a shared PDF uses the device’s file viewing or saving facilities at your request. Sign-in can open the system browser or Microsoft authentication interface.
If a future release introduces a health integration or additional device access, the applicable notice and permission flow must describe the actual data types and purpose before access begins. This policy does not authorize an inactive integration or grant access to device data.
17. Children and young people
The Services are not designed for children to enroll independently. A therapist must not assume that an invitation to the app authorizes processing a child’s information. Any use involving a minor requires the care provider to establish an appropriate lawful basis, provide age-appropriate information and obtain parent or guardian authorization where required by law.
If you believe a child’s information has been provided without the necessary authority or safeguards, contact contact@adessehealth.com so that we can investigate with the responsible care provider and restrict or remove information where appropriate.
18. Changes, language and contact
We update this policy when our features, data handling or legal obligations change. The effective and updated date appears at the top. Material changes will be brought to users’ attention through an appropriate channel, and a new permission will be requested where required; a policy update is not a substitute for consent.
The English and Turkish versions are intended to describe the same practices. Neither version limits mandatory rights under the law that applies to you. Contact us if you notice a discrepancy or need an accessible explanation.
All privacy, data-rights, security and support inquiries should be addressed to ADESSE HEALTH at contact@adessehealth.com.
Privacy requests & support
Contact ADESSE HEALTH from the email associated with your account when possible. Please do not include journal entries, recordings, passwords or other sensitive content in your first message.
contact@adessehealth.com