Privacy Policy

Data controller

LabNora is business software that manages the order flow between dental laboratories and clinics. Its users are laboratory and clinic staff; patients do not use the app.

Data controller: LabNora. Contact: info@labnora.com

What we collect

The app communicates only with our own server. No third-party analytics, advertising or tracking software is used, and the advertising identifier (IDFA) is never read.

• Account details: first and last name, email, phone number, username
• Business details: laboratory/clinic name, address, phone, email
• Turkish national identity number — only if optionally entered during registration
• Location: verified once at sign-in, and only if your laboratory has enabled the "location lock" feature
• Device information: device registration for notifications (push token, device name, app version)
• Photos and files: intraoral photos and scan files you attach to an order
• Text you write: order notes, closing notes, leave request notes, feedback messages
• Search terms: text you type when searching orders may appear temporarily in server logs

Patient data — a special case

Intraoral photos attached to orders and patient names in order records are special-category personal data under Turkish data protection law (KVKK art. 6) and GDPR art. 9. This data is entered not by the patient but by the clinic or laboratory treating them.

Photos are re-encoded before upload and EXIF data is dropped — the location where a photo was taken is not sent to the server.

The obligation to collect this data lawfully and inform the patient rests with the clinic/laboratory entering it. In this relationship LabNora acts as a data processor.

Why we process it

All data is processed solely to operate the service: creating and verifying your account, creating and tracking orders, running the workflow between laboratory and clinic, delivering notifications, and meeting legal retention obligations.

No data is used for marketing, profiling, advertising, or sold to third parties.

Who we share it with

Your data is never sold or shared for advertising. Only the providers required to run the service are involved:

• Our hosting and backup provider — for operating the servers
• Notification delivery: Apple Push Notification Service and Expo — only the notification text and device token are transmitted; notification content never contains patient names or patient data
• Email delivery: the email provider we use for verification, invitation and password reset messages

How it is stored

The database, uploaded files and backups are held on access-restricted servers. During notification delivery, limited data (device token, notification text) passes through notification providers; this data contains no patient information.

Session keys are stored on the phone in the operating system's secure storage (iOS Keychain).

How long we keep it

When you close your account, your identifying details (email, phone, national identity number, username) are erased and your access is closed.

Order and financial records remain in the laboratory's/clinic's records for the retention periods required by law, because they constitute commercial and medical records. These records contain no contact details of yours; your name is retained because "who produced this work" is part of the record itself.

Your rights

You have the right to learn whether your data is processed, request information about it, ask for correction or deletion, and object to processing.

You can close your account yourself from inside the app: Menu → Profile → Close my account. The action requires two-step confirmation and shows you what will continue to be retained before you confirm.

For any other request, write to info@labnora.com

Children

LabNora is business software and is not directed at anyone under 18. We do not knowingly collect data from children.

Changes

When this policy is updated, the date on this page changes. For significant changes we also notify you inside the app.