This policy does not replace the Personal Data Notice.
Minimisation and access
Only data required for accounts, training, examinations, certificates, devices and support is processed. Patient and health data must not be entered. Access is limited by account type, institution and role.
Security
Passwords are stored using a strong one-way hash. The portal uses CSRF protection, secure sessions, rate limiting, institution/role access controls and audit logs. Certificates, device documents and training files are held in access-controlled private storage. Permissions are reviewed and accounts should be disabled when employment ends.
Incidents
Suspected breaches are recorded and assessed. Where required, the Turkish Data Protection Board is notified without delay and no later than 72 hours after awareness, and affected persons are informed as soon as reasonably possible.
Retention and deletion
The periods in the Portal Personal Data Notice apply. When grounds for processing end, data is periodically deleted, destroyed or anonymised. Deletion/destruction records are retained for at least 3 years unless another legal duty applies.
Cookies and third parties
Only a strictly necessary first-party session cookie is used. No advertising or behavioural analytics cookie is used. YouTube is not loaded before a separate choice. See the Cookie Policy and YouTube preference text.