Security & KVKK
Clinical data stays in the clinic.
We made our architectural decisions around KVKK and clinical audit needs from the start. Encryption, isolation and audit are laid down as three layers.
Legal position
Not a diagnostic or treatment device — clinical support software.
Remnema is a support software platform designed for licensed clinicians who practise clinical EMDR. The party who delivers the clinical EMDR protocol is the clinician; Remnema provides the tooling layer that makes that delivery easier: bilateral stimulation, records, licence management, KVKK compliance and an audit trail.
The software is not positioned as a medical diagnostic or treatment device before the Turkish Medicines and Medical Devices Agency (TİTCK). Diagnosis, treatment planning, clinical judgement and delivery always remain the responsibility of the licensed clinician. Remnema carries the clinical data flow in that process; it does not take the clinician's place.
We provide, at the software layer, the bilateral stimulation function that hardware-based EMDR tools (light bar, buzzers, tone headphones) deliver. The output is recorded to be interpreted by the clinic; there is no automated clinical decision-making.
Encryption
Sensitive data is never at rest in plaintext.
- Algorithm
- AES-256-GCM (envelope encryption)
- Layout
- A single blob: 12-byte IV ‖ ciphertext ‖ 16-byte tag
- AAD
- Bound to the row id (forgery resistance)
- Key version
- Separate for client and clinical text, open to rotation
- PII fields
- First name, surname, date of birth, phone and email in one envelope
- Clinical text
- Target memory, cognition, body location and therapist notes in a separate envelope
Isolation
Every clinic is its own tenant.
- Row-Level Security
- Active on every tenant-bound table (Organization, Profile, License, Patient, Session, …)
- GUC binding
- A per-request SET LOCAL app.current_org_id
- Fail-closed
- Without the GUC the policy refuses; zero leakage
- Super-admin bypass
- Only with the app.is_super_admin GUC set to true
- Double enforcement
- ORM layer + database layer — two lines of defence
- Closed onboarding
- No public /signup. Membership by invitation only.
KVKK compliance
Everything the law asks for, in the system architecture.
- Disclosure consent
- Taken during client registration and recorded with a timestamp
- Audit log
- Append-only — UPDATE/DELETE revoked at the database level
- Access trace
- Client detail, session view, list — each one is logged
- Right to erasure
- Client soft-delete plus a scheduled hard delete; the audit trail is preserved
- Retention
- Configured per clinic agreement, with an automatic sweep
- Data locality
- Infrastructure located in Türkiye is preferred and written into the clinic agreement
Contracts
The clinic agreement plus data-processing authority.
Remnema is a service provided on the basis of a clinic-level agreement. During onboarding the clinic administrator signs the clinic contract and the KVKK data-processing authorisation.
No additional contract is needed for individual therapists working on behalf of the clinic — their authorisation derives from the clinic agreement. Client data is processed only within that framework.
For a sample contract and copies of the authorisation documents you can ask through the contact form.
Would you like to run a security review?
We can share our architecture diagrams and encryption report with your clinical auditors.
Get in touch →