1. Who is responsible
The extension is provided by MediTechLabs Yazılım Anonim Şirketi (MERSİS 0614169719700001; Çifte Havuzlar Mah. Eski Londra Asfaltı Cad. Kuluçka Mrk. A1 Blok No:151/1C İç Kapı No: B34 Esenler/İstanbul, Türkiye; kvkk@meditechlabs.ai). If you use the extension on behalf of a healthcare organisation, the party responsible for the patient data you dictate and report is your institution; we process this data within the contract we have signed with your institution and on your institution's instructions. For your account and usage details, we are the responsible party.
2. Which data we collect and process
- Account details: full name, e-mail, institution name, your role, profile picture.
- Login details: your password is sent to the server over an encrypted connection and is not stored in the browser; after login, a session token is kept in your browser.
- Dictation audio: only when you start dictation, the audio captured from your microphone is sent to the server to be transcribed.
- Dictation text and reports: the text you dictate, the reports you create and edit, your templates, your personal dictionary, your abbreviations and your writing preferences. These may contain patient health information.
- Usage and error logs: the name, result, duration and length of login/logout, report creation, auto-save, speech recognition connection and page-writing operations; unexpected errors. These logs do not contain patient text, report content or the address of the page you visit.
- Preferences: the panel's position and size, theme, extension settings.
The extension does not collect: the content of the pages you visit, your browsing history, your location, your payment details.
3. What we use it for
To transcribe the audio you dictate; to create, store and present the report to you; to verify your account and maintain your session; to keep the service secure and running, and to fix errors.
We process patient data for the purposes and under the conditions set by your institution, on your institution's instructions. We process your account and usage details to provide the service and keep it secure.
Your audio recordings, dictation texts and reports are not used for model training by default. Such use can start only if it is separately agreed with your institution, all necessary legal conditions and notices are met, and retention/deletion processes are defined; the setting in your institution administrator's panel is an on/off switch used after these conditions are met, and is not permission on its own. Audio recordings not used for training are deleted within 30 days after the report is completed.
Your data is not used for advertising, not transferred for personalised advertising and not sold; it is not used for determining creditworthiness or for lending purposes.
4. What is stored in your browser
Your session information, panel layout and preferences are stored in the browser's extension storage area (chrome.storage.local); when you log out of your account, the application deletes the session information. Unfinished drafts are kept in memory (chrome.storage.session); this area is cleared when the extension is disabled, reloaded or updated, and when the browser is restarted.
5. Where your data is and how it is protected
Data is transmitted between your browser and our servers over an encrypted connection (HTTPS and WSS). Our servers run on cloud providers located in the United Kingdom, the United States or Türkiye, depending on the contract with your institution; when a location outside Türkiye is chosen, your data is processed and stored outside Türkiye. We work with local cloud companies in each country: production deployments in Türkiye run on DT Cloud (DT İletişim Hizmetleri A.Ş.; data centres in İstanbul and Ankara), deployments in the United Kingdom on GIGAGPU, and deployments in the United States on Microsoft Azure. Our demo environments run on Microsoft Azure servers in the United States. Data at rest is protected with industry-standard encryption (AES-256). Retention periods: account details for as long as your account is open and 1 year after it is closed; reports and dictation texts for the period set in your institution's contract; audio recordings for at most 30 days after the report is completed; usage logs for 12 months.
6. Who we share it with
Your data is processed, to the extent necessary to provide the service and within the contract we have with your institution, through the infrastructure of the cloud providers specified in the contract (United Kingdom, United States or Türkiye): hosting of our servers and database, backups and service monitoring take place on this infrastructure. Beyond that, we share data only when a legal obligation requires it, or when it is necessary to protect against malware, fraud, abuse and security breaches; in every case of sharing we comply with the personal data protection and transfer requirements. In a company merger, acquisition or sale of assets, the transfer of user data is subject to your prior explicit consent under the Chrome Web Store Limited Use Policy; this consent does not replace the conditions required for patient data.
Our employees may read your data only when you give explicit consent for access to a specific piece of data, when it is necessary for security, for a legal obligation, or in internal operations carried out on aggregated and anonymised data. Access to patient data additionally requires your institution's authorisation and the legal conditions. Access is limited to the task and is logged.
7. Browser permissions
Because the addresses of hospital systems cannot be known in advance, the extension asks for permission to run on all websites. The panel opens only when you click the extension icon or use the keyboard shortcut. So that the panel can use the microphone, the extension adds only the address of the V2R panel to the permission header (Permissions-Policy) of the page you open; it does not change any other setting of the page and does not read its content.
8. Your rights
You can find out whether your data is being processed, request information, ask for it to be corrected or deleted, and object to processing. Send your request to kvkk@meditechlabs.ai or via the Data Subject Request Form; we reply within 30 days at the latest. We forward requests concerning patient data to your institution as the responsible party. You can ask for your account to be deleted at the same address.
9. Chrome Web Store Limited Use disclosure
V2R Radiology's use of user data complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.
10. Changes
When we update this notice, we publish it on this page and refresh the "Last updated" date.
Legal basis (KVKK)
| Processing | Basis |
|---|---|
| Patient data | The ground under art. 6 determined, and whose conditions are met, by your institution as data controller; we are the data processor within the meaning of art. 3 |
| Account and usage data | art. 5/2-c performance of a contract; art. 5/2-f legitimate interest |
| Model training | Only on a valid basis separately determined; not done by default |
| Your rights | art. 11, art. 13 |