MediByte

UPDATED 10 OCTOBER 2026

iOS Privacy Policy

Who is responsible

MediByte for iOS is provided by SOLVAR YAZILIM VE BILISIM DANISMANLIK LIMITED SIRKETI, trading as SOLVAR YAZILIM VE DANIŞMANLIK. Address: B D:20, NO:4-1 ATATURK MAHALLESI, NERGIS 1 SOKAK, BUYUKCEKMECE, Istanbul (Europe) 34536, Türkiye. Contact admin@solvarcompany.com for privacy, account and support requests. This notice covers the iOS application; Android features and data handling can differ.

Your account and identity

Email registration sends your email address, password and optional name to Google Firebase Authentication. MediByte does not save your password; sign-in tokens are kept in iOS Keychain. Apple and Google supply the identifiers and profile information you authorize. Guest sign-in creates an anonymous Firebase account and server identifier; it is not anonymous browsing. Device-only study features can be used without an account. Deletion confirmation is sent to the authentication provider; Apple authorization codes are sent securely to our deletion service and Firebase for revocation, without being saved in the deletion receipt.

Study records and calendar

Exam preferences, goals, lesson progress, practice answers, recall history, bookmarks and study sessions generally stay on this device and are shared by the app installation. Signing in does not synchronize all learning records. Calendar Cloud sync uploads the study sessions you choose to synchronize under your account, using Google Firestore. iPhone Calendar access is optional and separate; copies of events sent there remain in that calendar until you remove them. Study activity is not a measure of medical competence or a guaranteed exam result.

Content delivery and technical data

The app downloads lessons, question-bank content, illustrations and recordings from Firebase-hosted services. Download requests expose network information such as your IP address and request metadata to the hosting provider. Downloaded media may be cached on your device. Authentication and enabled security services also process the technical information needed to deliver requests and protect the service. This notice does not describe downloads as data-free or promise that provider logs are anonymous.

Apple purchases

Apple handles iOS payments and payment-card details. MediByte uses verified StoreKit transactions, subscription status and revocation information to determine Plus access. Purchases belong to the Apple Account; MediByte sign-in does not transfer a Google Play purchase to Apple or promise cross-platform access. The app does not send Apple purchase transactions to advertising services. Cancel renewal separately in Apple subscription settings.

Advertising and permissions

Free access may display Google AdMob banners and optional rewarded ads. Google Mobile Ads and its consent service can process IP addresses, approximate location inferred from IP, device identifiers, app/ad interactions, diagnostics and performance information for advertising, measurement and fraud prevention. This iOS release requests non-personalized ads, disables publisher first-party ID, and does not request permission to track you across other companies’ apps and websites. This does not mean no ad data is collected. Consent choices are shown where required and Advertising privacy choices lets you reopen applicable choices. MediByte does not supply account email, study answers or learner notes as ad-targeting fields. Verified Plus stops new MediByte ad requests. Registration acknowledgement does not authorize personalized ads or marketing. Notification, microphone, speech recognition and calendar permissions are separate choices.

Educational cases and microphone

MediByte is for education, not a patient record. Do not enter identifiable patient details, real medical records or confidential information. OSCE dictation requests microphone and speech permission only when you choose it, requires supported on-device recognition and does not silently fall back to cloud recognition. This feature does not save audio recordings or upload them to a MediByte server. Typed input remains available. Simulated cases and locally evaluated text are educational; the app does not send learner text or audio to a generative-AI service for this feature. System sharing sends your selected text to the app you choose.

Why information is processed

Account information delivers the account services you request. Technical data delivers content and protects services. Verified store purchases determine paid access. Advertising supports free access, measurement and fraud prevention, subject to applicable consent choices. Where a legal basis is required, requested services rely on the applicable service/contract basis; necessary security relies on legitimate interests subject to your rights; obligations and legal claims apply where actually required; optional processing requiring consent uses its separate choice. Acknowledgement of this notice is not blanket consent.

Recipients and international processing

Google/Firebase provides authentication, hosted content and backend infrastructure; Apple provides sign-in, billing and operating-system services; Google Sign-In and AdMob provide the optional services described here. Ad providers are identified in the applicable consent interface. Authorized personnel handle support and deletion requests. Disclosure to public authorities requires an applicable lawful request or obligation. Providers may process data outside Türkiye or your country of residence. Provider privacy and service terms describe their processing and safeguards; contact us about the arrangements applicable to your data. A privacy acknowledgement is not blanket consent to an international transfer.

Retention and account deletion

Open Account → Delete account to request deletion of your sign-in account and associated cloud profile and study data. Confirm ownership using the same sign-in account; linked Apple authorization is revoked before the iOS request is accepted. A receipt confirms intake, not completed erasure. Supported accounts are disabled, refresh sessions revoked, and mapped cloud data and the Auth account erased after at least 65 minutes for existing tokens to expire. Older accounts or unmapped shared records require individual review. Contact admin@solvarcompany.com with your receipt for status. The raw identity is removed from verified completion receipts; a hashed identifier, reference, timestamps and limited evidence are scheduled for deletion after 90 days, with provider expiry processing possibly later. Pending review records remain until handled. Necessary legal or security retention exceptions are explained during handling. Local progress, caches and exported iPhone Calendar entries are separate. Delete the app using iPhone Storage to remove its local learning records; offloading retains app data. iOS Keychain and operating-system backups have separate lifecycles, so use Sign out to remove the stored account session before deleting the app. Account deletion, sign-out and uninstalling do not cancel Apple subscriptions. Provider logs follow their configured and service lifecycles. HTTPS/TLS, Keychain and server access controls protect data but do not eliminate every risk.

Your KVKK rights

Under Article 11, you may ask whether your data is processed, obtain information about processing and its purposes, learn the recipients in Türkiye or abroad, request correction of incomplete or inaccurate information and request erasure or destruction when legal conditions apply. You may also request notification of relevant correction or erasure to recipients, object to an adverse result produced exclusively by automated analysis, and seek compensation for damage caused by unlawful processing. Submit requests to the controller through an applicable lawful channel. Identity verification may be necessary; do not send passwords or payment-card details. Applicable response periods and complaint rights remain unchanged.

What your acknowledgement records

The app records the notice version, language, platform and acknowledgement time with your signed-in account credentials on this device after a successful account operation. This is a local record, not a centrally retained or independently verified consent certificate. It does not enable ads, notifications, tracking, marketing or data exports. You can reopen this notice without changing your choices. Material processing changes require updated information and separate consent where the law requires it.

Optional usage measurement

Usage measurement is off unless you enable it in Profile > Data & privacy. When enabled, Google Analytics for Firebase receives an installation identifier, device and app information, engagement events and counts of practice answers. We do not attach your account identity, name, email, question or answer text, scores or notes to these events. Analytics advertising storage, advertising identifier collection and advertising personalization are disabled. You can withdraw permission in Data & privacy; this stops further collection and resets the local Analytics identifier. It does not automatically erase data previously processed by Google. Contact admin@solvarcompany.com for a privacy request. Usage measurement is separate from advertising preferences and does not unlock or restrict study features.