Skip to content

Stokontrol

Provider transparency

You should know which provider is used and why.

The names below are providers the product can support. Inclusion does not mean a provider is active for every workspace.

Supabase

A potential core provider for authentication, workspace database and private file storage. Real clinical data is not activated until project region, backup scope, processing agreement and transfer mechanism are verified.

Vercel

A potential core provider for the web application, server functions, security and performance delivery. Execution region and contract are verified. Optional measurement runs only with consent and on public pages.

Google

Used as an identity provider only when a user chooses Google sign-in, for account identifier, email and basic profile details. Google sign-in is optional and does not receive clinic patient files.

Cloudflare Turnstile

If the public question form is enabled, it processes client IP address, TLS fingerprint, User-Agent, sitekey and origin plus browser-security signals to distinguish bots and abuse; it does not receive question-form fields. The form stays off until the provider contract, region and applicable transfer safeguard are verified.

Resend

May deliver the single-use public-question verification email and, for clinic features, only a separately enabled email channel. The recipient and message are sent to Resend. The verified stokontrol.com sender routes and sends email from Tokyo (ap-northeast-1); this choice does not change data residency, and account metadata, logs and API records are stored in the United States. Live delivery stays off until the contract, the applicable transfer safeguard under Article 9 of Türkiye's Personal Data Protection Law, retention, production-account ownership and sender domain are evidenced.

Twilio and Meta

May deliver SMS or WhatsApp only after the clinic connects and verifies that channel. The recipient and message may be sent to that provider. Live delivery stays off until channel, patient preference, template, contract and region are verified.

OpenAI

If the server-side Stoko AI feature is separately enabled, text submitted to that feature may be processed. Users must not enter unnecessary patient identity or health text. The feature is off by default and clinical content is not enabled until model, region, retention and processing terms are verified.

Payment and fulfilment parties

PayTR processes card data in its secure iframe when a plan payment is started; card number and CVV are not stored in Stokontrol's database. A Marketplace fulfilment party and its role are disclosed before order approval. Patient health data is not sent to these parties.

Mux · Academy broadcasting and recording

Academy technical broadcasts use Mux Video. Broadcaster picture/sound, media requests, IP and device/browser information may be processed. The separately versioned Academy addendum below records verified DPA/subprocessor information and the pending Mux response / standard-contract process. Document review does not confirm transfer compliance; this pending item is tracked separately from technical tests.

Change notice

Adding or replacing an active subprocessor, or changing its region, creates a new notice version. Workspace administrators receive applicable notice and objection time; if an objection cannot be resolved, the affected feature is disabled or a contractual exit is offered.

English captions · direct Google Cloud processing

ACADEMY-CAPTION-PROVIDER-2026-10-03-V1. The broadcaster's speech audio and derived transcript are processed by Google Cloud Speech-to-Text and Cloud Translation to produce live English captions. The current configuration uses eu-speech.googleapis.com in eu for recognition and translation.googleapis.com with a us-central1 translation resource and dental glossary. The global translation endpoint does not guarantee processing exclusively in one region; we do not claim that all caption data stays within the EU. The account's data-logging preference has not been verified in this test; provider documentation is not account-specific confirmation. AI captions may contain errors; Turkish audio remains authoritative. Viewers' microphones are not activated for captions. This direct flow is separate from Google's role as a Mux subprocessor. Turkey-specific cross-border contractual and legal review is pending. This disclosure does not confirm legal compliance or completed transfer arrangements; technical rehearsal and quality verification remain separate.

Academy broadcast notice

ACADEMY-PROVIDER-2026-10-01-V1 · 1 October 2026. Controller: Doğuş Sevinç; contact: info@stokontrol.com. Academy technical broadcasts use Mux Video for the broadcaster's picture and sound. Recordings may be created at Mux and locally in OBS. Merely watching does not activate a viewer's camera or microphone. Do not include patient or third-party private information.

International transfer · pending

Awaiting Mux response / standard-contract process. Existing DPA and EU/UK/Swiss mechanisms do not establish completion of Stokontrol's Turkish KVKK transfer process. Account-specific steps remain pending separately from technical broadcasting, recording and development tests. Publishing this notice or passing a technical test is not confirmation of legal compliance.

Test broadcast · questions

The operating policy selected for the technical Test broadcast retains questions for 7 days from submission; this is not a statutory minimum or a Mux retention claim. The configured period is shown in the question area. Account-linked questions and timestamps reach moderation; approved questions and answers may be shown to participants. Expired questions become inaccessible and eligible for periodic cleanup. Content-free deletion evidence may remain separately. Provider video/logs are not deleted by this process. Other events use their own published policy.

Viewing, recording and retention

Stokontrol uses participant names, event records and viewing time for access and attendance certificates. Mux may process IP addresses, device/browser information and media requests. The up-to-100-day Mux Data pseudonymous-view period is not a retention promise for video, OBS files, questions or certificates. Account-specific recording/log retention awaits verification. A captured recording is not automatically published.

Attendance and certificates

Monthly Clinic Pro covers one calendar month and annual Clinic Pro covers one calendar year; the event date must fall within the active membership term for live training access. One participant is registered per event; different events may have different participants. The confirmed name appears on the certificate; contact support for spelling corrections. Participants with valid event access, a completed event registration and a confirmed, locked name can receive a personal QR-verifiable certificate after the training ends. A test-broadcast certificate records technical-test participation only. Optional public name visibility is separate from the private certificate. Questions have their own notice and retention configuration.