Who is responsible?
Medon is operated by Mustafa Fatih Ogunclu, who is the data controller for the personal data described in this notice. Contact info@medon.com.tr or write to the address on this page.
This notice covers the Medon iPhone app and the website medon.co.uk. Medon is for adults aged 18 or older. We do not knowingly create accounts for children; if we learn that a child has an account, we delete it.
Wellness support, not medical advice
Medon helps you track nutrition, movement, sleep and general wellness. It does not provide medical advice, diagnosis or treatment, and it is not an emergency monitoring service.
Nutrition, energy and body-composition figures are estimates, not clinical measurements. Medication and supplement features only record a plan you already have and send reminders. They do not prescribe, suggest doses or check interactions. Talk to a qualified healthcare professional before making medical decisions.
What we collect and where it comes from
We collect only what the app needs to work. Most of it you enter yourself.
| Type of data | What it includes | Required? | Where it comes from |
|---|---|---|---|
| Account details | First name, surname, date of birth, email, password (stored only as a secure hash by our authentication provider), account ID | Yes | You, at registration |
| Profile | Height, weight, goal | No | You |
| Diary entries | Meals and macro targets, activity, sleep, water, habits, day reviews, body measurements and body-fat estimates, medication and supplement schedules, notes | No | You |
| Photos | Profile and progress photos you choose | No | You, through the iPhone photo picker |
| Apple Health data | The read-only data types listed under “Apple Health” | No | Apple Health on your iPhone, only if you connect it |
| Previously imported workouts | Workouts imported from Strava before that integration ended in September 2026: activity name, sport, dates, duration, distance, calories, average heart rate, speed and cadence. No new Strava data is collected. | No | Your earlier Strava connection, now ended |
| Consent records | Version and time of your health-data choice, and any withdrawal | Yes, if you use health tracking | The app |
| Support messages | What you write to us | No | You |
| Technical records | IP address, device or browser details, sign-in, email-delivery and security logs | Yes | Our service providers, automatically |
| App diagnostics | Crash reports and, for TestFlight testers, beta feedback | No | Apple, only if you allow sharing with developers |
Diary entries, photos, Apple Health data and imported workouts may reveal health information. We treat all of it as health data.
Please do not send passwords, sign-in links or medical records that are not needed to support.
How we use your data and our legal grounds
We use your data only to run Medon for you.
| Purpose | Data used | Legal ground (Türkiye, KVKK) | Legal ground (EU/UK GDPR, where it applies) |
|---|---|---|---|
| Create and run your account, sign-in and recovery | Account details, technical records | Necessary to provide the service you asked for (Art. 5(2)(c)) | Performance of a contract (Art. 6(1)(b)) |
| Diary, estimates, reminders, progress graphs and sync | Profile, diary entries, photos, Apple Health data, imported workouts | Your separate explicit consent (Art. 6(3)(a)) | Explicit consent (Art. 6(1)(a) and 9(2)(a)) |
| Answer support requests | Support messages and the records you ask us to look at | Necessary for the service (Art. 5(2)(c)) | Contract; explicit consent for health records |
| Keep the service secure and prevent misuse | Technical records | Legitimate interest (Art. 5(2)(f)) | Legitimate interest (Art. 6(1)(f)) |
| Meet legal duties and handle legal claims | Only what the duty or claim requires | Art. 5(2)(ç) and (e) | Art. 6(1)(c) and (f) |
Withdrawing consent does not affect processing that happened before you withdrew. Read the law.
What Medon never does
- We do not sell personal data.
- We do not track you across other companies’ apps or websites, and we do not share data with data brokers.
- The app contains no third-party advertising or analytics SDKs.
- We do not use health data, including Apple Health data, for advertising, marketing or data mining.
- We do not store Apple Health data in iCloud.
- We do not use AI to analyse meal photos.
- We do not use your data to make decisions with legal or similarly significant effects, such as eligibility for healthcare or insurance.
Apple Health
Apple Health (optional, read-only)
Connecting Apple Health is optional. After reading the explanation in the app, you choose which data types to share on Apple’s own permission screen. Medon never writes data to Apple Health.
Depending on your permissions, Medon reads:
- sleep intervals and sleep stages
- weight
- workouts: type, dates, duration, active energy and distance
- heart rate during workouts, used only to calculate the workout’s average heart rate
- resting heart rate, heart-rate variability (SDNN) and cardio fitness (VO₂ max)
- step counts; steps during a run may be used to estimate cadence, and the app shows when a value is an estimate
We also keep record IDs, source information and sync markers, so entries update correctly and are not duplicated.
Medon does not request workout routes, ECGs or clinical health records. It does not send Apple Health data to any third party for their own use.
We use Apple Health data only for your diary, energy estimates and progress graphs. The first import covers up to the last 90 days. Later imports happen when you open the app or when iOS allows a background update. Raw workout heart-rate samples are used to calculate an average and are not kept as a continuous heart-rate history.
Imported entries are stored on your iPhone and synced to your account in Medon’s cloud database (Supabase, Frankfurt, Germany).
To stop: pause imports in Profile → Settings → Apple Health, or remove Medon’s access in the iPhone Health app (Apple Health sharing controls). Stopping does not delete entries already imported; delete them as described under “How long we keep data, and deleting it”. Deleting data in Medon never deletes the originals in Apple Health.
Previously imported Strava workouts
Medon’s Strava integration ended in September 2026. Stored Strava connection tokens have been deleted and no new Strava data is collected. Workouts imported before then stay in your diary as saved workouts; you can edit or delete them there.
Who can access your data?
Medon staff
Only authorized Medon administrators can access your synced data. They do so only to provide support you request, fix a technical problem affecting your account, or meet a legal duty. They look at only what that task needs. Administrators do not change your diary, targets or measurements, and they do not give medical advice. Every administrator access is logged.
Service providers
We share data only with the providers below, and only so they can run Medon for us.
| Provider | What it does for Medon | Data involved |
|---|---|---|
| Supabase | Authentication, diary database, private photo storage, server functions | Account details, diary, photos, Apple Health data, technical records |
| Hostinger | Hosts medon.co.uk and the account and support email service | Email address, support messages, website technical records |
| Apple | Distributes the app; provides Apple Health, TestFlight and crash reports | Only what Apple’s own services handle, under Apple’s privacy policy (TestFlight privacy) |
Every provider we share personal data with is bound by a written agreement or its published data-processing terms. These require it to use the data only to provide its service to Medon, keep it confidential and secure, and protect it at least as well as this policy and applicable law require. Providers may not use your data for their own advertising or sell it.
We disclose data to authorities or professional advisers only where the law requires it or where it is necessary for a specific legal claim. If Medon’s operations are ever transferred to another operator, this policy will continue to apply to your data and we will tell you in advance.
Processing outside Türkiye
Our main database is in Frankfurt, Germany (EU). Hosting, email delivery and authentication may also involve processing in other countries through our providers and their subprocessors. We transfer data abroad only with the safeguards the law allows, such as standard contractual clauses under KVKK Article 9 and, where GDPR applies, the EU’s standard contractual clauses. Email info@medon.com.tr for details of the recipients and safeguards that apply to your account.
How we protect your data
- All data travels over encrypted connections (HTTPS/TLS).
- The database and photo storage are encrypted at rest by our provider.
- Each account can reach only its own records; photos are stored privately, not publicly.
- On your iPhone, sign-in credentials are stored in the iOS Keychain.
- Administrator access is limited to named staff and logged.
Your data is not end-to-end encrypted, so authorized administrators can technically see it under the limits described above. No system is perfectly secure; if a breach affects your data, we will notify you and the authorities as the law requires.
Your choices and consent
- Health tracking needs a separate consent, shown with an unticked box, before your cloud diary opens. You can say no and still sign out or delete your account.
- Apple Health needs its own connection, which you choose to turn on.
- Photos are only uploaded when you pick them in the photo picker. Reminders use local notifications, which you can turn off in iPhone Settings.
- To withdraw consent, go to Profile → Settings → Privacy and your choices. This pauses Apple Health imports on this device and stops diary sync. It does not delete saved data; to erase it, delete your account or contact us. Sign out of older app versions on your other devices too.
How long we keep data, and deleting it
| Data | How long we keep it |
|---|---|
| Diary, profile, photos, Apple Health data and previously imported workouts | While your account is open, until you delete them |
| Support messages | Up to 12 months after your request is resolved, unless a legal duty or dispute requires longer |
| Consent records and minimal deletion records | As long as needed to show we met our legal duties |
| Provider security logs and backups | Deleted on the provider’s normal cycle after account deletion |
Delete your account in the app: Profile → Settings → Your data → Delete account. This permanently removes your cloud diary, photos, sign-in account and the copy on the device you use. If the process is interrupted, follow the “Continue deletion” prompt. You can also ask us by email.
Delete a single entry: the entry disappears from your diary straight away. To have the underlying record or a photo erased completely, contact us.
Copies on other signed-in devices and any exports you saved elsewhere must be removed separately. Deleting data in Medon does not delete the originals in Apple Health or Strava. Medon does not offer a backup service to restore deleted data.
Your rights and how to use them
You can ask us to:
- tell you whether and how we process your data, for what purposes and who receives it
- give you a copy (you can also export it yourself in Profile → Settings → Your data)
- correct or delete your data, and tell recipients about it
- restrict or stop processing, or move your data to another service, where the law gives you this right
- review a decision made only by automated means that affects you negatively
- compensate you for damage caused by unlawful processing
To make a request, email info@medon.com.tr from the address on your Medon account, or send a signed letter to the address on this page. Include your name, your request and where to reply. We may ask for reasonable proof of identity. Never send your password.
We reply as soon as possible and within 30 days, normally free of charge. See your rights under KVKK. You can also complain to the Personal Data Protection Authority (KVKK) in Türkiye or to your local data protection authority.
Our website and changes to this policy
medon.co.uk has no account forms, advertising trackers or analytics scripts. Our host may use strictly necessary technical cookies, access logs and security checks.
We post changes here with a new date. If a change affects how we use health data or needs your consent, we tell you in the app and ask for your choice before it applies.
Last updated: 27 September 2026.