Privacy notice

This monitor is operated by Yavuz Selim Kıyak as an independent, non-commercial pilot. Yavuz Selim Kıyak is the data controller for your personal data.

For any question about your data, or to exercise your rights, contact yskiyak@gazi.edu.tr (LinkedIn: yavuzselimkiyak).

We deliberately keep this to a minimum:

• your Google-provided name and verified email address
• the country you select, and optionally your institution
• the journals you choose to follow
• your seen / unseen history
• any journal requests you submit

We do not ask for — and you must not enter — patient information, protected health information, or other special-category data.

We process your personal data on the basis of your consent (GDPR Art 6(1)(a)), given when you create your account and choose your journals.

You can withdraw consent at any time by editing your data or deleting your account in Account settings, or by emailing us. Withdrawing consent does not affect processing already carried out before withdrawal.

Only to operate your personalised monitor: to sign you in, remember your journals, keep your seen history in sync across your devices, and handle your journal requests.

We do not use your data for advertising or profiling, and we never sell it. It is not transferred to the AI MedEd Observatory. Newsletter signup is handled separately by Substack under Substack's own terms.

A small number of service providers process data strictly to run the service, only on our instructions:

• Supabase — authentication and database storage
• OpenAI / ChatGPT Sites — hosting
• Google — sign-in and email verification

If you subscribe to the newsletter, Substack acts as an independent controller for that subscription.

Our providers (Supabase, OpenAI / ChatGPT Sites, and Google) are based in the United States, so your data may be processed outside the EEA and Türkiye. Where this happens we rely on appropriate safeguards — the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses. You can ask us for more detail on the safeguards in place.

We keep your personal data for as long as your account exists. If you delete your account, your profile, journal list, seen history, and requests are removed from the live database promptly — within 30 days — and any copies held in routine encrypted backups are purged on the normal backup cycle, within 90 days.

Shared journal and publication catalog records are not personal to you and remain in the system. Limited authentication logs may be kept briefly for security.

Under the GDPR you have the right to: access your data; correct it; have it erased; restrict or object to processing; receive it in a portable format; and withdraw consent at any time. You also have the right to lodge a complaint with your local supervisory authority — in the EU/EEA, your national Data Protection Authority.

We do not carry out automated decision-making. To exercise any right, use Account settings or email yskiyak@gazi.edu.tr.

We use only strictly-necessary cookies — a session cookie set by Supabase to keep you signed in. We use no analytics, advertising, or tracking cookies, so no cookie-consent banner is required.

We rely on our providers' industry-standard security, including encryption in transit and at rest and access controls. No system is perfectly secure; if a breach affects your data and poses a risk to you, we will notify you and the relevant authority as required by law.

If we change how we handle your data, we will update this page and the "last updated" date above, and surface material changes to pilot users in the product.