Security & Compliance

Patient data, legally protected.

Vega keeps patient data legally protected through certified data centers, KVKK-aligned processes and regular security audits. The technical details run in the background — you stay focused on practicing medicine.

The real risks around patient data — and how they're closed

As long as patient data lives on a single PC, behind a shared password or on a paper consent form, the risk is there. Vega closes each gap with a defined process.

Risk

Multiple people share the same user account; it's unclear who saw or changed what.
KVKK disclosure and consent are handled on paper; missing or lost forms become legal risk.
Patient files live on a local PC; a lost or broken device wipes the entire history.
Responding to a patient's "export/delete my data" request is manual and slow.

In Vega

Per-user accounts and role-based permissions — everyone reaches only the data they're authorized for.
Disclosure and explicit consent are captured digitally and archived via digital signature.
Data is stored encrypted in certified data centers in Türkiye, backed up regularly.
Patient-record export and deletion are handled from a single point in the system.

Three Pillars of Security

When patient data is involved, there are no shortcuts — every layer works together.

End-to-End Encryption

Data is protected with strong encryption both in transit and at rest. Backups follow the same standard.

End-to-end encryption in transit
Encrypted data at rest
Certified encryption standards

KVKK & Legal Compliance

Personal data processing, retention and deletion are designed around KVKK regulations. Disclosure texts and consent forms ship out of the box.

KVKK-compliant processes
Disclosure & consent infrastructure
Data retention and deletion policies

Access Control

Role-based permissions ensure each user only sees the data they need. Sensitive fields and actions are off by default.

Role-based permissions
Per-user password management
Sensitive fields off by default

Certified Infrastructure

Vega runs on Estesoft's certified data centers and processes.

ISO 27001

Confirms information-security management is audited against an international standard.

ISO 27701

Confirms personal-data privacy is managed to an international standard.

ISO 15504 (SPICE)

Confirms the software is built on an independently audited, mature process.

Hosting in Türkiye

All patient data is stored in certified data centers in Türkiye.

KVKK & Consent Process

From disclosure to explicit consent — a digital approval flow

The KVKK flow starts the moment a patient record is created and covers disclosure, consent and data-subject rights end to end.

Disclosure Text

A KVKK-compliant disclosure is presented to the patient digitally and recorded.

Digital Explicit Consent

Consent and treatment forms are captured with digital signature and archived as PDF on the patient record.

Data Subject Rights

Patient export and deletion requests are handled from a single point in the system.

Continuous Monitoring and Maintenance

Defined monitoring, backup and update processes keep the system running safely and without interruption.

24/7 Continuous Monitoring

The system is monitored continuously; if anything goes wrong, our technical team steps in before you notice.

Regular backups, verified

Patient data is backed up regularly, and we periodically test that backups actually restore — so you're not left with a backup that doesn't work.

Up-to-date and secure

When new security issues emerge, the system is updated in time — nothing extra is required from you or your clinic.

Want more detail?

Reach out for our security policies, KVKK disclosure text and data-retention processes.