Privacy Notice (GDPR and KVKK)

Version 4 · Effective 12 November 2026

This notice explains how personal data is processed in the Beebird TrueTrend app, in accordance with Article 13 of the EU General Data Protection Regulation (GDPR) and Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK).

1. Data controller

  • Company: Beebird Teknoloji A.Ş.
  • Address: İTÜ Teknokent ARI-8 Binası, Reşitpaşa Mah. Katar Cad., Sarıyer / İstanbul, Türkiye
  • Email: info@beebird.io
  • Availability: the app is currently offered only in Türkiye; no EU representative has been appointed. Contact for requests: info@beebird.io

2. Personal data processed

  • Health data (special category data): heart rate, blood oxygen (SpO2), heart rate variability (HRV), stress score, sleep duration and stages, naps, skin temperature deviation and (only if you turn them on) experimental blood glucose and blood pressure trends.
  • Activity data: steps, distance, calories, active time, inactivity events, breathing exercise sessions.
  • Information generated in the app: readiness score, sleep regularity, personal baselines, badges, streaks, goals, notification and measurement profile preferences.
  • Device data: the ring's Bluetooth name, MAC address, firmware/hardware version, battery level, signal strength, server device ID.
  • Consent records: the document version you accepted, date and time, app language, and the consents you gave and withdrew.
  • Mood journal (optional, entered by you): mood, energy, tags and a short note; the sleep/HRV summary at the time of the entry and (if you turned it on) the weather for your region.
  • Wellness records and preferences: breathing break records (duration, method, how you felt afterwards, optional SDK HRV comparison), break activity check-offs, suggestion and reminder settings, the city/district you chose.

The app does not collect your name, phone number, GPS location, contacts or advertising identifier, and does not track your location. If you turn on environmental context, only the approximate centre coordinate of the region you choose from the list is used (see sections 3 and 5). If you tap the optional "Use my location" button, the app asks for one-time location permission at that moment only; your location is matched on your phone to the nearest region in the list, and the raw coordinate is neither sent to a server nor stored. If you decline, you can choose the region manually. The app contains no advertising, analytics or tracking tools.

3. Purposes and legal bases

  • Processing health data on your device (display, trends, scores and reminders): your explicit consent — GDPR Art. 9(2)(a) and 6(1)(a); KVKK Art. 6(2). This is the app's core function; without consent the app cannot be used.
  • Sending and storing daily measurement data on the server (once your account is linked, to provide the service and cross-device access): your separate, optional explicit consent — GDPR Art. 9(2)(a); KVKK Art. 6(2).
  • Keeping consent records: compliance with a legal obligation and proof of consent — GDPR Art. 6(1)(c) and 7(1); KVKK Art. 5(2)(ç).
  • Answering support and rights requests: performance of a contract and legal obligation — GDPR Art. 6(1)(b), (c); KVKK Art. 5(2)(c), (ç).
  • Processing mood journal and breathing break records on your device: because these may count as health data, they are covered by your explicit consent above (GDPR Art. 9(2)(a); KVKK Art. 6(2)). They are not sent to the server or any other service; the app does not infer emotions from them.
  • Environmental context (optional, off by default): when you turn it on, the ID and approximate coordinate (about 1 km) of the region you chose are sent to our weather service and from there to the weather provider (OpenWeather) to provide the feature you requested — GDPR Art. 6(1)(b); KVKK Art. 5(2)(c). No health data, mood, notes or ring identifier are added to this request.

Your data is not sold, not used for advertising or profiling, and not shared with third parties for marketing.

4. Where and how long data is stored

  • On your phone: measurements and daily summaries are stored only in this app's container under iOS file protection (encrypted while the device is locked). Daily history is kept for at most 180 days; older data is deleted automatically.
  • On the ring: the ring keeps roughly the last 7 days of data in its own memory; you can erase it with a factory reset.
  • On the server (only if you consented): stored on servers located in Europe – Microsoft Azure North Europe (Ireland) for as long as your account is open; deleted within 30 days of your deletion request or of deleting your account. Backup copies are deleted when the backup cycle completes and are not processed again in the meantime. When you withdraw consent, new uploads stop; you can request deletion of your server data at info@beebird.io.
  • Consent records: kept for the duration of the relationship and applicable limitation periods to prove consent.
  • Mood journal and wellness records: on your phone only, for at most 180 days. The environmental data cache is kept on your phone for at most 48 hours.
  • Weather service requests: request logs on our server are kept for up to 30 days.

5. Transfers and recipients

  • Hosting and technical service providers (processors): if you consented to server upload, your data is transferred only to the hosting provider bound by a written data processing agreement, solely to provide the service.
  • International transfers: Our servers are not in Türkiye; they are in Europe (Microsoft Azure, Ireland). If you give server consent, your data is transferred outside Türkiye. Under KVKK Art. 9, and unless the Turkish Data Protection Board has issued an adequacy decision, the transfer takes place under a standard contract, which is notified to the Authority within five business days of signing. Microsoft acts only as a data processor on our instructions under a written data processing agreement and may not use your data for its own purposes. Your data is not moved outside the EU/EEA beyond this transfer.
  • Apple Health: only if you turn it on; steps, heart rate, SpO2 and sleep data are written to the Apple Health app on your phone. This data is subject to Apple's privacy terms and stays under your control. Experimental trends, HRV and stress are not written to Apple Health.
  • Public authorities: only where required by law.
  • Weather provider: OpenWeather; receives only the region coordinate, through our weather service.

6. How data is collected

Data is collected electronically and automatically from the ring via Bluetooth Low Energy, and from the preferences you enter in the app.

7. Your rights

Under GDPR Art. 15–22 and KVKK Art. 11 you have the right to:

  • Know whether your data is processed and access it (get it immediately in the app with Export my data),
  • Request rectification, erasure or destruction (in the app: Delete all my data),
  • Data portability (the exported file is machine-readable JSON),
  • Request restriction of processing and object to processing,
  • Know the third parties to whom data was transferred and request that they be notified,
  • Object to a result against you arising exclusively from automated analysis,
  • Claim compensation for damage caused by unlawful processing,
  • Withdraw your consent at any time (Ring → Privacy and Legal). Withdrawal does not affect the lawfulness of processing carried out before it.

Send requests to info@beebird.io; we respond within 30 days at the latest. You also have the right to lodge a complaint with the data protection supervisory authority of your EU country, or with the Turkish Personal Data Protection Board.

8. Automated assessment

Readiness, sleep and regularity scores are calculated on your device by comparing only with your own past data. These scores are not decisions producing legal or similarly significant effects concerning you (they are not covered by GDPR Art. 22).

9. Security

Data is protected by iOS file encryption, server communication uses encrypted (HTTPS/TLS) connections, and access to server data is limited to authorized staff. If we learn of a data breach, we notify the Turkish Personal Data Protection Board within 72 hours at the latest, and affected persons without undue delay.

10. Children

The app is not designed for people under 18 and we do not knowingly collect data from children.

11. Changes

If this notice changes, the app shows the new version; if the purposes of processing change materially, your consent will be requested again.

12. Users in the US and other countries (HIPAA)

Beebird TrueTrend is a consumer wellness app. Beebird Teknoloji A.Ş. is not a "covered entity" or "business associate" under the US HIPAA, so HIPAA does not apply directly. We nevertheless protect your health data in line with the core principles of the HIPAA Security Rule: minimum data, encryption in transit, file encryption on the device, role-based access and breach notification. The app is currently offered only in Türkiye.