Privacy Policy

Effective Date: 21.09.2026
Application: OpData-Drive — Surgery Tracking System (app.oddsoftware.opdata)
Data Controller: ODD Software
Contact: support@opdatadrive.com

We care about your privacy. This Policy explains which data is collected when you use OpData-Drive, how it is used, with whom it is shared, and what your rights are.

1. DATA WE COLLECT

a) Account and profile data: first and last name, e-mail address, authentication provider (Apple / Google), role (e.g. resident), specialty, professional title, institution, contact details and OpData-Drive ID. (The Application does not collect photos; an avatar from your identity provider, if any, is only displayed.)
b) Clinical record data: the surgery and procedure records you enter, case and patient related fields, and date/time information. As structured patient fields, only the initials of the name, the age (in whole years) and the sex are recorded; the Application has no field for a patient's full name, national identification number or date of birth. (The Application has no media or image attachment feature.)
c) Usage and device data: application version, device and operating system information, basic log records and synchronisation status.
d) Payment related data: purchase status (trial/premium). Your card and payment details are processed directly by the Apple App Store or Google Play; the Service Provider neither sees nor stores them.

2. HOW WE COLLECT DATA

We collect data directly from your input while you create an account and use the Application, through the authentication providers (Apple/Google), and automatically during normal operation of the Application (device and log data).

3. PURPOSES OF USE

- To create your account and verify your identity,
- To store and display your records and produce statistics,
- To provide the team features and team search functionality,
- To offer cloud synchronisation and backup,
- To manage subscription and trial entitlements,
- To ensure security, prevent abuse and meet legal obligations.

4. TEAM SEARCH VISIBILITY

All users who register for OpData-Drive can be found by other OpData-Drive users in team searches by their first and last name, and can be added to a team as a member. This visibility is an inseparable part of creating an account and cannot be turned off from within the Application. Searches reveal only first name, last name and OpData-Drive ID matches; your patient or case details are not shared in this scope.

Blocking and reporting: When you block a user, that choice is stored against your account; the block is mutual — the person you block cannot add you as a team member, you cannot add them either, and any records currently shared between you stop being shared. When you report a user or a record, the reason you choose, any details you write and the target of the report are stored for abuse review. When you are added to a record as a team member, an in-app notification row is created for you containing the operation name, its date and the name of the person who added you. These records are deleted together with your account.

5. SHARING WITH THIRD PARTIES

We do not sell your data for advertising. We share it with the following service providers only to the extent necessary to deliver the service, and we expect those parties to protect your data at a level equivalent to this Policy:
- Supabase (authentication, database, storage / cloud infrastructure),
- Google (Sign in with Google; if you choose it, synchronisation with Google Sheets — in which case your record data is written to a spreadsheet in your own Google account),
- Apple (Sign in with Apple),
- Apple App Store / Google Play (subscription and payment processing),
- RevenueCat (management and verification of subscription status; your user ID, device identifier and purchase history are transmitted),
- Resend (delivery of notification e-mails; your e-mail address and name are transmitted),
- Google Firebase Cloud Messaging and Apple Push Notification service (delivery of phone notifications; your device's notification token and a text that only states the kind of notification are transmitted — no operation name, date or person's name),
- OpenAI (in-app AI assistants; only the questions you type into the assistant chat, the form-field context you select, and — for statistics questions — AGGREGATE numbers computed on your device are transmitted; your patient records and identifiers are not transmitted, and the AI feature additionally asks for your consent on first use. The app sends no images to OpenAI). Data may additionally be shared to the extent required by law or in response to a request from a competent authority.

6. DATA RETENTION AND SECURITY

The local database on your device is protected with encryption (SQLCipher); all transfer to the server is encrypted over TLS/HTTPS. We retain data for as long as your account is active and for the duration of any legal retention obligations. No method is 100% secure; we apply reasonable technical and organisational measures.

7. YOUR RIGHTS (KVKK / GDPR)

Under applicable legislation (Turkish KVKK and, where applicable, EU GDPR) you have the right to access, rectify and erase your data, to restrict processing, to object, and to data portability. Where processing is based on consent, you may withdraw your consent at any time. To exercise these rights, contact support@opdatadrive.com.

8. ACCOUNT AND DATA DELETION

You can delete your account and all associated data FROM WITHIN THE APPLICATION: Profile screen > "Delete My Account". Once confirmed, your surgery and patient records on the server, your profile information and your authentication record are permanently deleted, and the local database on your device is wiped. This action cannot be undone. If you cannot access the Application, you may send a request to support@opdatadrive.com or use the form at https://www.opdatadrive.com/en/account-deletion; your request will be processed within the legally prescribed period. Personal data other than that which must be retained by law is deleted or anonymised. To prevent abuse of the invite programme, when an account that received an invite reward is deleted, a non-reversible digest derived from your e-mail address and your sign-in provider (Apple/Google) identity is kept. The digest cannot be used to identify you; it only prevents the same account from receiving the reward a second time.
Note: your Google Sheets spreadsheet is created in your own Google account and is therefore not under our control; you may delete it from your own Drive. You must also cancel any active subscription from your store account separately.

9. CHILDREN'S PRIVACY

The Application is not directed at persons under 18 and we do not knowingly collect personal data from children.

10. INTERNATIONAL DATA TRANSFERS

The cloud services used may process data on servers in different countries. In such cases we take care to ensure the safeguards required by legislation.

11. CHANGES

This Policy may be updated. Material changes will be announced within the Application or by e-mail and the effective date will be updated.

12. CONTACT

For all privacy questions and requests: support@opdatadrive.com