This policy explains how personal data is processed through the DietWAP website (dietwap.com) and the DietWAP mobile apps (iOS and Android).
1. Controller
Gülten Ensari – Prozen Dış Ticaret (sole proprietorship), Kartaltepe Mah. Cicozyolu Cad. No:74 K:2 D:2, 34040 Bayrampaşa / İstanbul, Türkiye. Email: destek@dietwap.com · Data protection requests: kvkk@dietwap.com · Phone: +90 532 413 45 33.
For client data that dietitians enter on the platform, the dietitian is the controller and DietWAP acts as processor (see the Data Processing Agreement).
2. Data we process
Account and contact: name, email, phone (optional), hashed password, language and time zone preferences.
Health and nutrition data (special category): height, weight, body measurements, year of birth, sex, health notes, allergies and dietary restrictions, lab values, food diary, water, activity, sleep and fasting logs, diet plans.
Genetic data (only if DNAWAP is used): DNA variant results selected by the dietitian and recommendations based on them. Raw DNA files are not stored.
User content: meal photos, voice commands, questions to the AI assistant, messages with your dietitian, recipes.
Purchase data: packages, amounts, dates, App Store / Google Play transaction IDs; for web invoices, name, address and tax or national ID number. We never receive card details; they are processed by the payment provider on the web and by Apple or Google in the apps.
Technical data: IP address, device and browser information, session and error logs; on the website, Google Analytics data only with your consent.
3. Mobile app permissions
Camera: barcode scanning and meal photos. Microphone: voice logging and the AI assistant. Photo library: choosing photos for analysis.
Permissions are requested only when you use the feature and can be revoked in your device settings at any time.
The apps do not collect location, contacts or advertising identifiers, show no ads and do not track you across other apps or websites.
4. Purposes and legal bases
Creating your account and providing the service: performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
Processing health and genetic data, AI analysis and transfers to service providers abroad: your explicit consent (GDPR Art. 9(2)(a); KVKK Art. 6 and 9). You can withdraw consent at any time; features relying on that data then stop working.
Payments, invoicing and accounting records: legal obligation (GDPR Art. 6(1)(c)).
Marketing emails and analytics cookies: only with your consent, which you can withdraw at any time.
5. AI processing
Meal photos, voice commands and what you type to the AI assistant are sent to our AI service provider (OpenAI, USA) for analysis. Photos and voice recordings are not stored on our servers. The provider does not use API data to train its models and may keep it for a limited time for abuse monitoring under its own policy.
AI output is generated automatically, may be inaccurate and is not medical advice. No decision producing legal or similarly significant effects is made about you based solely on automated processing.
6. Who we share data with
If you are a client, the dietitian you are connected to.
Service providers: hosting, email delivery (Mailgun), AI (OpenAI), payments (web payment provider, Apple, Google), Google Sign-In and, with consent, web analytics (Google Analytics). They process data only on our behalf and under contract.
Some providers are located outside your country (USA, EU). International transfers rely on the safeguards in GDPR Chapter V and KVKK Art. 9 (such as standard contractual clauses or your explicit consent).
Public authorities and courts where required by law.
We do not sell or rent your data or share it for advertising.
7. Retention
Account and health data are kept while your account is open.
When you delete your account, personal and health data are deleted immediately and purged from backups within 30 days.
Invoice and payment records are kept for the period required by tax and commercial law (up to 10 years).
Security and access logs are kept for the legally required period and then deleted.
8. Your rights
Under GDPR Art. 15-22 and KVKK Art. 11: access, rectification, erasure, restriction, objection, data portability, withdrawal of consent and not being subject to solely automated decisions.
You can lodge a complaint with your local data protection authority (in Türkiye, the Personal Data Protection Authority).
California (CCPA/CPRA): rights to know, delete and correct. We do not sell or share personal information for cross-context behavioral advertising.
Send requests to kvkk@dietwap.com; we reply free of charge within 30 days. You can delete your account yourself in the app under More → Delete My Account or at dietwap.com/account/delete.
9. Security
We use encrypted HTTPS connections, hashed passwords, role-based access, separation of each dietitian's data and regular backups. If a personal data breach occurs, we notify affected users and the competent authority within the legally required time.
10. Children
The service is not directed at children under 18. Minors may use it only with the consent of a parent or guardian and under a dietitian's supervision. If we learn that a child's data was processed without such consent, we delete it.
11. Cookies and changes
Cookies on the website are described in the Cookie Policy. We may update this policy and will announce material changes in the app and on the website. Last updated: 1 November 2026.