Derman Privacy Policy

Effective date: October 20, 2026

Derman is a home medicine-cabinet app for iPhone. It helps you keep track of the medicines in your home, their boxes' expiry dates and when they were opened. What you enter in Derman stays on your iPhone and, if iCloud is on, in your own iCloud account. It never reaches us; we never sell it and never share it with anyone. Derman has no accounts, analytics, ads or tracking, and we run no server. We receive personal data only when you contact us (section 11).

This policy covers the Derman app, its widget, its Siri and Shortcuts action and its Spotlight search (together, "Derman"). It is also the notice required by Article 13 of the EU and UK General Data Protection Regulation (GDPR), Article 10 of Turkey's Law No. 6698 on the Protection of Personal Data (KVKK), and US state privacy laws, including the California Consumer Privacy Act as amended (CCPA).

Who we are
Data the app collects
What Derman stores and where
Health information and household sharing
Camera and box codes
Reminders
Purchases
Apple features: widget, Siri and Spotlight
Medicine information and medical notice
Deleting your data
When you contact us
Legal bases (GDPR and KVKK)
Sharing and international transfers
Retention
Security
Your rights
Notice to US residents
Children
Changes to this policy
Contact

1. Who we are

For the personal data that reaches us (section 11), the controller is the developer of Derman ("we"), a natural-person developer based in Turkey, shown as the seller on the App Store.

You can reach us at support@melyro.app.

Derman is an independent app. We are not affiliated with the Turkish Medicines and Medical Devices Agency (TİTCK), the Ministry of Health, any pharmaceutical company or Apple, and none of them endorses or sponsors Derman. iPhone, iCloud, Siri and Spotlight are trademarks of Apple Inc.; medicine names are trademarks of their owners.

2. Data the app collects

None. Derman sends no information about you to us or to any third party. The app talks only to Apple services (iCloud and CloudKit, the App Store, Siri). We have no access to this data.

Our App Store privacy label says "Data Not Collected" and "No tracking". Derman contains no third-party code: no analytics, crash-reporting, advertising or attribution SDKs. It does not use the advertising identifier (IDFA) and does not ask for App Tracking Transparency permission.

Derman asks for only two permissions, both optional:

Camera: to read the code on a medicine box (section 5).
Notifications: for expiry reminders (section 6).

It does not use your location, microphone, contacts, photos or your data in the Health app.

3. What Derman stores and where

To work, Derman stores:

Household: its name and whether Premium is on for it.
Medicines: name, brand, barcode, active ingredient, ATC code, the "Kimin" (whose) tag (for example Mother, Father, Child or a tag you type), shelf life after opening, date added, and the name of the person who added it. That name is the name in your iCloud account, used when Apple makes it available to Derman.
Boxes: expiry date, state (closed, open, finished), dates opened, closed and finished, date added, and the serial and lot numbers read from the box code.

Where the data is kept:

Your iPhone. The data is kept in a database on your device, in the app group (App Group) area that Derman and its widget share.
Your own iCloud account. If iCloud is on, Derman syncs this data to the private database in your iCloud account using Apple's CloudKit. This keeps your devices signed in to the same Apple Account in sync and brings your data back on a new iPhone. The data is held on Apple's servers, in your iCloud account and your iCloud storage; we cannot access it. Apple's privacy policy applies to your use of iCloud: https://www.apple.com/legal/privacy/. Apple may use its own push service to wake the app in the background when something changes in iCloud.
If iCloud is off, the data stays only on this iPhone and the household can't be shared.

Data that stays on your device only and is not synced to iCloud:

your recent searches;
app settings such as whether reminders are on, a pending Ask to Buy request, and which household you are a member of;
the summary the widget shows (section 8).

Logs. To help troubleshoot, Derman writes short technical messages (for example an error text or the number of pending reminders) to the device's system log. The log stays on your device and does not reach us.

4. Health information and household sharing

The list of medicines in your home can reveal information about your or your family's health. Under the GDPR and KVKK this may count as special-category (health) data. That is why Derman is built so that this information is never sent to us: it exists only on your devices, in your iCloud account and with the people you share with. We do not receive, see or process it.

Sharing a household. The household's founder can invite others in Settings › Ev › "Kişi davet et" (Invite person). The invitation is sent with Apple's iCloud sharing (CloudKit sharing), and only the people you invite can join; anyone else who gets the link cannot. You choose how the invitation is sent (Messages, Mail and so on).

Everyone who joins a household sees and can edit all of its information: medicines, boxes, expiry dates, "Kimin" tags and the name of the person who added each medicine. Household members can also see each other's iCloud name and the contact detail Apple shares (email address or phone number) under Settings › Ev › Üyeler (Members). A shared household lives in the founder's iCloud account and uses the founder's iCloud storage. Share a household only with people you want to see this information.

5. Camera and box codes

Derman uses the camera only when you open the "Karekod okut" (scan code) screen, to read the DataMatrix code (karekod) or barcode on a medicine box. Reading is done by Apple's on-device scanning feature. Derman does not save photos or video, and the camera image never leaves the device. Only the product number (GTIN), expiry date, serial number and lot number are taken from the code and stored as box details (section 3). If you don't allow the camera, you can add medicines by hand.

6. Reminders

Reminders (Premium) are set up on your iPhone as local notifications. They appear at 10:00, 30 days and 7 days before expiry, on the expiry day, and when the shelf life after opening runs out. No server is used to send them. A notification can include the medicine's name and its "Kimin" tag, so anyone who can see your Lock Screen can see them. You can turn reminders off in Settings › Bildirimler › Hatırlatmalar.

7. Purchases

"Derman Premium" is a one-time purchase sold by Apple through the App Store and available with Family Sharing. Apple handles all payments. We do not receive your payment details, name or email address from Apple. Derman checks your purchase status on your device using Apple's StoreKit. If the household's founder has Premium, Derman records this as a flag in the shared household so that household members can use Premium features too. Apple's privacy policy applies to your purchase: https://www.apple.com/legal/privacy/.

Apple gives developers sales reports and, if you allow it in your device settings, aggregated app analytics and crash reports. These reports do not identify you to us.

8. Apple features: widget, Siri and Spotlight

Widget. Derman's Home Screen and Lock Screen widget shows a summary of medicines that need attention. The widget reads this summary from a file in the app group area; the file stays on your device. Anyone who can see your screen can see what the widget shows.

Siri and Shortcuts. If you use the "Evde var mı?" (Is it at home?) action, Apple processes your voice request under Apple's privacy policy. Derman receives only the medicine name you say, finds the answer on your device and hands it back to Siri.

Spotlight. So you can find your medicines in iPhone search, Derman adds medicine names and active ingredients to the on-device Spotlight index. This index is kept on your device. When you leave a household or it is deleted, Derman removes these entries from the index.

9. Medicine information and medical notice

Derman does not give medical advice; consult your doctor or pharmacist for any decision. Derman is a reminder and organizing tool. It does not decide whether you should take a medicine, the dose, whether one medicine can replace another, or whether a medicine is still safe to use. "Aynı etken madde" (same active ingredient) results are only a list based on active ingredient and ATC code; they do not mean the medicines are interchangeable. Always check expiry and shelf-life information against the box and the package leaflet.

Derman's medicine catalog is built from the "Ruhsatlı Beşeri Tıbbi Ürünler Listesi" (list of licensed medicinal products for human use) published publicly by the Turkish Medicines and Medical Devices Agency (TİTCK). The catalog ships inside the app and searches run on your device; when you search for a medicine or scan a box, nothing is sent anywhere. The catalog is updated with app updates; the date of the list you are using is shown in Settings › Hakkında › İlaç verisi. The list may be out of date or contain errors. Derman is not affiliated with TİTCK, and TİTCK does not endorse or sponsor Derman.

10. Deleting your data

A box or a medicine: "Kutuyu sil" (Delete box) on the box screen, "İlacı sil" (Delete medicine) on the medicine screen.
The whole household (founder): Settings › Ev › "Evi sil" (Delete household). The household and all its medicines are deleted from your iCloud and all your devices; if it is shared, members lose it too.
Stop sharing (founder): Settings › Ev › "Paylaşımı durdur" (Stop sharing). The medicines stay with you; members lose the household. You can remove a single member with "Çıkar" (Remove).
Leave a household (member): Settings › Ev › "Evden ayrıl" (Leave household). The household's medicines are deleted from your devices; the household stays in the founder's iCloud.
Deleting the app: deleting Derman from your iPhone deletes the data on the device, its reminders and its Spotlight entries. Data in iCloud is not deleted and comes back if you reinstall Derman.
Data in iCloud: on your iPhone, go to Settings › [your name] › iCloud › Manage Storage (or Manage Account Storage) › Derman to delete Derman's iCloud data. Menu names can vary by iOS version.

11. When you contact us

Contacting us is optional. We need your contact details only to reply to you.

If you write to support@melyro.app, we receive what you send (such as your email address, your message and any attachments). We collect this data electronically when you email us. We use it only to reply to you and fix the issues you report.

Please don't send us information about your health or your list of medicines; we can solve your issue without it. If a message does include such information, we use it only to reply to you and delete it within the period in section 14.

12. Legal bases (GDPR and KVKK)

We process personal data only in these cases.

Purpose	Data	GDPR legal basis	KVKK legal ground
Replying to your message and fixing reported issues	Contact details, message, attachments	Legitimate interests (Art. 6(1)(f)): replying to you and keeping the app working. When you ask about your purchase or your use of the app: contract (Art. 6(1)(b))	Art. 5(2)(f) legitimate interest of the controller; Art. 5(2)(c) where necessary for our contract with you
Establishing or defending legal claims	Relevant messages	Legitimate interests (Art. 6(1)(f))	Art. 5(2)(e) establishing, exercising or protecting a right

The data Derman keeps on your device and in your iCloud account (sections 3 and 4), including any health information, never reaches us and is not processed by us. Derman uses it only to provide, on your device, the medicine-cabinet service you ask for.

We do not make automated decisions about you and do not profile you.

13. Sharing and international transfers

We do not sell, rent or disclose personal data for advertising. Your messages are stored only by the provider of our email service, and only so that we can reply to you. We may also disclose a message you sent us where the law requires it (for example, under a court order).

When you write to us, you send your message to a developer in Turkey, outside the European Economic Area and the UK. The provider that carries and stores the message may keep it on servers in other countries (for example, the United States). That provider's own transfer safeguards apply to the data it holds. We have not signed separate standard contractual clauses with that provider.

Under KVKK, this transfer abroad happens only incidentally, when you choose to write to us. For it we rely on the incidental-transfer exceptions in Article 9(6) of KVKK: the transfer is necessary to handle the request you started with us, or you give your explicit consent by sending your message. We do not use this route for regular or routine transfers. You can ask us for details at support@melyro.app.

We transfer none of the data Derman keeps on your device and in your iCloud. Apple decides where iCloud data is stored. When you share a household, the data reaches the people you invite, by your choice.

This site is published on GitHub Pages. When you open it, GitHub may process information such as your IP address for technical reasons; GitHub's privacy statement applies. This site has no cookies, analytics or tracking code.

14. Retention

We delete support messages 12 months after the conversation ends, unless they are needed for a legal claim. In that case we keep only the relevant messages until the claim is resolved. Data on your device and in your iCloud stays there until you delete it (section 10).

15. Security

Derman keeps data on your device under iOS data protection. The widget file becomes readable after you first unlock the device following a restart. Apple encrypts iCloud data in transit and on its servers. Derman does not additionally use CloudKit's end-to-end encrypted fields for its records, so even with Advanced Data Protection turned on, Apple's standard iCloud protections apply to Derman's data. Protect your iPhone with a passcode and share a household only with people you trust.

16. Your rights

European Economic Area and United Kingdom. You have the right to access, correct, erase, restrict and port your personal data, and to object to processing based on legitimate interests. You can also complain to the data protection authority where you live or work. EEA authorities: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en. UK: Information Commissioner's Office, https://ico.org.uk. Because we process personal data only occasionally, when you write to us, we have not appointed an EU or UK representative (GDPR Art. 27(2)).

Turkey (KVKK Art. 11). As a data subject you have the right to learn whether your personal data is processed; to request information if it is; to learn the purpose of processing and whether it is used for that purpose; to know the third parties in Turkey or abroad to whom it is transferred; to request correction if it is incomplete or inaccurate; to request erasure or destruction under the conditions of Article 7 of KVKK; to request that corrections or erasures be notified to third parties to whom the data was transferred; to object to an outcome against you that arises from analysis of the data exclusively by automated systems; and to claim compensation if you suffer damage from unlawful processing.

To apply under KVKK, write to support@melyro.app from an email address you have used with us before, or use another method set out in the Communiqué on the Procedures and Principles of Application to the Data Controller. In your application, include your name and surname, your Turkish ID number (if you are not a Turkish citizen, your nationality and passport or ID number), your address or email address for our reply, and the subject of your request. We reply free of charge within 30 days at most (KVKK Art. 13). If your application is rejected, you find our reply insufficient, or we do not reply in time, you can complain to the Personal Data Protection Board (https://www.kvkk.gov.tr) within 30 days of learning of our reply and in any case within 60 days of your application.

How to exercise your rights. Write to support@melyro.app. We may ask you for some information to confirm the request comes from you. Because the app sends us no data, requests will usually concern only the messages you sent us. For data on your device and in your iCloud, follow the steps in section 10; since we cannot access that data, we cannot view or delete it for you.

17. Notice to US residents

This section applies to residents of California and other US states with consumer privacy or consumer health data laws (for example, Washington).

Personal information collected in the last 12 months: only identifiers and message content you give us when you contact us (section 11). Source: you. Purpose: replying to you and fixing issues.
Disclosed for a business purpose: identifiers and message content, only to our email service provider, to store and deliver messages.
Sale and sharing: We do not sell personal information and do not "share" it for cross-context behavioral advertising. We do not use it for targeted advertising or profiling.
Sensitive personal information and consumer health data: We do not collect them. The medicine information you enter in Derman stays on your device and in your iCloud account and does not reach us.
Your rights: Depending on your state, you may have the right to know, access, correct or delete your personal information, and to opt out of sale, sharing, targeted advertising and profiling. We do none of these, so there is nothing to opt out of. You may use an authorized agent; we may ask the agent for proof of your permission. If we deny a request, you can appeal by replying to our answer at support@melyro.app. We will not discriminate against you for exercising these rights.

18. Children

Derman is designed for adults who manage a home medicine cabinet. The app collects no personal data from anyone, including children under 13 (or the age of digital consent in your country). You can record a child's medicines with a "Kimin" tag; that information also stays on your device and in your iCloud. If you believe a child has sent us personal data (for example, in a message), contact us and we will delete it.

19. Changes to this policy

If we change this policy, we will post the new version on this page and update the effective date. If a change materially affects how we handle your data, we will also mention it in the App Store release notes for the next version of Derman.

This policy is published in Turkish (Türkçe) and English. If the Turkish and English texts differ, the Turkish text governs, unless the law of your country requires the text in your own language to govern.

20. Contact

The developer of Derman; a natural-person developer based in Turkey, shown as the seller on the App Store. Contact: support@melyro.app

Based on CC0-licensed templates by General Legal (general.legal).