Who we are
KeepDr is operated by an individual developer registered in Türkiye, and is the data controller for the information described here under the GDPR and Türkiye’s KVKK. For anything on this page, write to [email protected].
There is no account
There is no sign-up, no password and no Sign in with Apple. The first time you open the app it generates a random identifier and stores it in the iOS Keychain. That identifier is how our server recognises your phone, and it is what everything below is linked to. It is not an advertising identifier, and it is never used to follow you anywhere.
What we collect
- What you put on your site — your name and title, specialty, biography, opening hours, services, practice address and map link, phone and WhatsApp number, social and academic links, and for students the school and year. This is published on your site; it is public because that is the point of it.
- Your photo, if you add one. The app resizes it on your phone and re-encodes it, which strips the EXIF metadata — location, camera and capture time do not leave your device.
- Your forwarding address — the personal email address that mail to
info@is delivered to. This is never published on your site. - Your device identifier — the random Keychain value described above.
- Your subscription — product, transaction identifiers, status and renewal date, received from Apple. Card numbers and billing details stay with Apple and never reach us.
- Appointment requests left by visitors to your site: a name, a phone number and a preferred day. See below.
- Abuse reports — what a reporter writes about a site, and the email address they choose to leave.
This is the same list as the App Store privacy label: Name, Email Address, Phone Number, Physical Address, Photos or Videos, Other User Content, Purchase History and Device ID. All of it is collected for app functionality, all of it is linked to you through that device identifier, and none of it is used for tracking.
What we do not do
- No tracking, no advertising, no ad networks, no data brokers.
- No analytics SDK — not in the app, and not on the sites it publishes. Nobody is counting your visitors.
- We do not sell, rent or share your data for anyone else’s purposes.
- We do not store your mail. Messages to
info@are relayed to your inbox and are not kept by us. - Visitor IP addresses are held in memory only, to rate-limit the public forms. They are never written to our database.
Who processes it with us
- Apple sells and bills the subscription and tells us whether it is active.
- RevenueCat keeps the subscription state. All it receives about you is the anonymous device identifier and the purchase attached to it.
- Cloudflare registers your domain and runs its DNS and its email routing. The registration is held in KeepDr’s own registrar account, so no registrant details of yours are sent to a registrar and none appear in the public WHOIS record. Your forwarding address is registered with Cloudflare, which emails it a confirmation link, and mail to
info@passes through Cloudflare on its way to your inbox. - KeepDr — everything else runs on servers operated by KeepDr, and only the developer named above has access to them.
One thing worth naming: published sites load their web fonts from Google Fonts, so a visitor’s browser contacts Google when it draws the page. That is a request for a font file, not an analytics call, but it is a third party and you should know it is there.
Your patients’ data
The appointment form collects a name, a phone number and a preferred day, and nothing else. It deliberately has no free-text or health field, so please do not ask patients for health information through it. For those requests you are the controller and KeepDr is your processor: they are stored so you can read them in the app, and they are deleted automatically after 90 days.
How long we keep it
- Your site and its content — while your subscription is active, and afterwards until you delete it.
- Appointment requests — 90 days, then permanently deleted.
- Sign-in sessions — 180 days. We store a hash of the token, never the token.
- Backups — nightly snapshots, kept for 14 days and then overwritten.
- Subscription records — kept after deletion, because refunds and Apple’s rules depend on them.
Deleting your data
Delete your site from the app, or write to [email protected] and we will do it. Your sessions, the link between your phone and your data, and every appointment request are erased immediately, and the site stops answering at once.
Two things are not covered by that. The subscription record stays, because we are required to keep it. And the domain registration is not part of your data — it is held in KeepDr’s registrar account, and deleting your site neither cancels nor releases it. If you want to keep the name, ask us to transfer it to you before you delete (see the Terms).
Your rights
You can ask for access to your data, correction, deletion, restriction or objection, and a copy in a portable form. Most of it you can do yourself in the app in a few seconds; for the rest, write to [email protected] and we will answer within 30 days. If you think we have handled your data badly you can complain to your data protection authority — in Türkiye that is the KVKK Board, and in the EU your national supervisory authority.
Children
KeepDr is for practising doctors and dentists and for medical and dental students. It is not directed at children and we do not knowingly collect their data.
Changes
If this policy changes, the date at the top of the page changes with it, and anything material is announced in the app before it takes effect.