This Terms of Service, Privacy Policy and Data Protection Agreement (collectively "Agreement") is entered into between the following parties:

OculaWork — employee eye health and fatigue analysis platform operating at oculawork.com ("OculaWork", "Platform", "We").

Any individual or legal entity, company, institution or organization subscribing to OculaWork and using the Platform for their employees ("Customer", "Employer", "You").

Persons employed by the Customer, registered in the system by the Customer, and performing measurements via the Platform ("Employee", "End User").

OculaWork is a SaaS platform that produces measurable behavioural and ergonomic indicators from eye and facial movements via a standard webcam — using methods found in the scientific literature — in order to support the assessment of working conditions, ergonomic exposure and operational risk in the workplace, and provides risk-based reports to employers and occupational physicians. The Platform does not perform medical diagnosis, disease screening or medical-condition monitoring, does not propose treatment, and does not make medical decisions.

• A 30-second active measurement captures EAR, PERCLOS, blink rate, reaction time, and 4 additional physiological/behavioural indicators
• Camera footage is processed exclusively in the browser (client-side); raw video is never sent to any server
• Only computed numerical metrics are transmitted to servers
• The management panel shows only aggregated department-level statistics that have passed the thresholds in §11; individual results are not displayed. Individual data is accessible only to the employee themselves and the authorised occupational physician

OculaWork operates with a high-availability target but cannot be held liable for planned maintenance, force majeure, or infrastructure provider outages. Planned downtime is announced 48 hours in advance. This is a general target, not a numeric percentage commitment; it does not constitute a service level agreement (SLA) or a service-credit program. When assessing availability: the total time in the relevant month is used as the base; scheduled maintenance windows (below) and outages attributable to Google Firebase/Google Cloud infrastructure are excluded from this assessment (see §10.3).

The subscription fee in effect will not change during the current pricing period (see §12); any price change may only take effect from the next renewal period onward.

Planned maintenance is scheduled, where possible, during weekends or nighttime hours, and is limited to a maximum of 4 hours per occurrence. Where an urgent situation threatens the security or integrity of the Platform (e.g., an active attack), emergency maintenance may be performed without prior notice.

The response times above indicate only that a support request has been received and is being processed; they do not constitute a resolution-time commitment.

Features on the Platform marked "beta," "preview," or "experimental" (including newly developed AI modules) are provided on a preview basis; they may be interrupted, changed unexpectedly, or removed. No outcome is guaranteed for these features, and the Agreement's general service-continuity/SLA commitments do not cover them. Beta features may result in data loss or erroneous data output; the Customer should not rely on beta features for critical or single-source data.

OculaWork may in the future offer integrations with third-party systems (identity/directory services, enterprise communication tools, ERP/HR software, etc.). Such integrations, when released, will be subject to additional terms announced at that time; this Agreement does not commit to any integration that does not currently exist. Likewise, should a general-purpose API be released in the future, usage limits (rate limits), API key management, and abuse policies will be governed by a separate API Terms of Use document.

• Camera permission is required: If the user denies or revokes camera access permission, camera-based scanning features will not function; this portion of the service cannot be provided in that case
• Supported browsers: Current versions of Google Chrome, Microsoft Edge, Mozilla Firefox, and Safari; Internet Explorer is not supported
• Minimum hardware: A webcam capable of at least 640×480 resolution, adequate ambient lighting, and a stable internet connection

The Platform offers a feature enabling a direct video call with an employee, which only the occupational physician may initiate (one-directional). The connection is established directly between two devices (WebRTC, using Google's free public STUN server) without passing through any third-party server; audio/video is never recorded or stored on any server. The technical connection data (SDP/ICE) required to establish the call is automatically deleted a few seconds after the call ends. During the call, an approximate camera-based pulse estimate and an instantaneous blink/PERCLOS-based fatigue-stress indicator are computed from the employee's camera feed — shown only to the physician on that call, only for the call's duration. These indicators are not a medical measurement or diagnosis, do not replace a clinical device, and are never added to or stored in the employee's permanent scan history. As no TURN server is used, the connection may occasionally fail to establish under very strict corporate network/firewall configurations.

Google Firebase is an independent cloud infrastructure and data hosting service owned by Google LLC. Firebase's data processing terms and security measures are governed by Google's Privacy Policy and Firebase Data Processing Terms.

• Google Firebase is infrastructure that holds international security standards such as ISO/IEC 27001 and SOC 2 Type II, and its data processing operations are governed by Google's current published Data Processing Terms (DPA)
• Data is stored in the European region (eur3 — Belgium/Netherlands)
• Firebase, as an entity independent of OculaWork, protects data under its own policies

All Customer data (scan results, reports, account information) remains the property of the Customer; OculaWork asserts no rights over such data beyond those granted under this Agreement. Personal data is not a subject of ownership in the classical sense; this provision governs the rights of use and disposition over data supplied by, and processed on behalf of, the Customer, and does not affect data subjects’ rights under KVKK. Upon request, data export is provided; export is made only in formats OculaWork supports at that time (e.g., JSON/CSV), and no other format is guaranteed. Data integrity is maintained on OculaWork's side during export; however, no guarantee is made regarding compatibility with, or the integrity of the data after import into, third-party systems (e.g., the Customer's own ERP/HR software). Upon contract termination, data is permanently deleted within 90 days. This 90-day period concerns the deletion of operational data that remains accessible after termination; the retention periods set out in §7.2 and any retention obligations arising from legislation are reserved. Even if the account is closed/data is deleted, certain records (e.g., invoicing data) may be separately retained for the legally required retention period due to accounting regulations (e.g., Turkish Tax Procedure Law), transaction logs, and KVKK-related legal retention obligations.

The Customer exclusively holds the status of Data Controller under KVKK Law No. 6698 with respect to the processing of its employees' personal data. The Customer is independently responsible for:

• Notification (KVKK Art. 10): Providing employees with a disclosure notice about the data to be processed and its purposes
• Explicit consent (KVKK Art. 5-6): Establishing the appropriate legal basis for processing health/biometric data
• Data subject rights (KVKK Art. 11): Handling employees' requests for access, correction, deletion and objection
• VERBİS registration: Registering with Turkey's Data Controllers Registry if within scope
• Data inventory: Maintaining records and inventory of personal data processed

• The Platform may be used in support of the employer’s OSH processes under Law No. 6331. Article 15 of that Law regulates the health-surveillance obligation; it cannot be read as making the Platform’s camera-based measurement mandatory (see §8.1)
• A valid contract with an occupational physician must exist; Platform data does not replace mandatory medical examinations
• Action plans and follow-up after risk detection are the Customer's responsibility

• Prevent unauthorized third-party access to the system
• Use the Platform solely for occupational safety purposes; do not use it for employee monitoring, disciplinary action or discrimination
• Do not reverse-engineer or copy the Platform for competing products
• Maintain current and accurate contact information throughout the contract period

OculaWork is a software provider and processes Customer data solely within the scope of this Agreement and the Customer's instructions. Data is not used for OculaWork's own benefit, third-party marketing, or any other purpose.

• All data transmission is encrypted via TLS 1.3; HTTP access is blocked
• Firebase Firestore security rules enforce role-based access control (RBAC)
• Camera footage is processed client-side; raw video is not transmitted to servers
• Individual results are not displayed in the management panel; only aggregated statistics that have passed the thresholds in §11 are shown. Individual details are accessible only to the employee themselves and the authorised occupational physician
• In the event of a security breach the Customer is notified without undue delay and in any event within 24 hours; notification to the KVKK Authority is made within the period the controller is subject to under applicable law

OculaWork may engage sub-processors providing infrastructure, hosting, email, security, analytics or support services in order to deliver the Service. The current sub-processor list, processing purposes and data locations are set out above and are available to the Customer.

Changes requiring a new sub-processor to access personal data are notified to the Customer at least 30 days before they take effect. The Customer may object on justified and reasonable data-protection grounds; in that case the parties will discuss a reasonable solution in good faith.

OculaWork shares Customer data with third parties only:

• With Customer's explicit written consent
• Where duly requested by a competent court or a legally authorized administrative body; OculaWork complies with such a request under applicable law and, unless legally prohibited from doing so, notifies the Customer within a reasonable time

The parties agree to provide each other with reasonable assistance in official inquiries, audits, or judicial proceedings related to personal data or information security.

In respect of employee-data processing carried out within the purposes and means determined by the Customer, the Customer is the Data Controller and OculaWork holds the status of Data Processor under KVKK Art. 3. For activities OculaWork carries out for its own purposes (account management, billing, security logs), its status is determined separately as set out in §7.5. In activities where it acts as processor, OculaWork:

• Processes personal data only per the Customer's instructions and for the purposes stated in this Agreement; it does not process data for a different purpose on its own initiative (for anonymous/aggregate processing, see §7.4)
• Maintains the confidentiality of personal data; binds personnel with data access under confidentiality obligations
• Engages only those service providers identified in this Agreement and in the current sub-processor list in §6.3 (see §4.2, §6.3). Engaging a new sub-processor that requires access to personal data is subject to the prior notice and objection mechanism in §6.3
• Assists the Customer in fulfilling employees' KVKK Article 11 requests (see §7.3)
• Notifies the Customer without undue delay and in any event within 24 hours upon becoming aware of a security breach (see §9.3)
• Returns or deletes data upon contract termination, per the Customer's instruction (see §4.3, §13)
• Shares information and documentation demonstrating compliance with the data-processing commitments in this Agreement upon the Customer's reasonable request

Employees exercise their KVKK rights through their employer (Customer). OculaWork fulfills these requests upon Customer direction within 30 days:

• The right to learn whether personal data is being processed
• The right to request information about processing
• The right to request correction of inaccurate data
• The right to request deletion where conditions are met
• The right to object to decisions made solely by automated processing
• The right to seek compensation for damages from unlawful processing

For the objection right above to be exercised meaningfully, the Platform's automated/semi-automated processing points that may produce a result concerning an employee are identified explicitly: (i) the fatigue risk level produced by the daily scan (low/medium/high/critical), (ii) statistical anomaly-detection alerts based on CUSUM and Isolation Forest, and (iii) the sector-context score (owoContextScore, see §7.4) that the "OwO" sector-wide learning model produces, based on that scan's anonymous numeric profile, shown solely for informational purposes — all three are shown only to the occupational physician and none of them alone translates into an automated personnel decision. OwO's training data and model weights contain no identity information; they are identity-stripped data that has been subjected to technical and administrative measures aimed at anonymisation. The application of those measures does not, on its own, mean the data is legally anonymous; anonymity is assessed separately in light of the concrete circumstances (see §7.4). however, the sector-context score the consult layer produces for informational purposes is a scan-specific, informational indicator and constitutes processing point (iii) above. If an employee believes a risk level, an anomaly alert, or the sector-context score has been used as the sole basis for an adverse personnel decision concerning them (reassignment, discipline, etc.), they may object to their employer; the employer is responsible for ensuring such an objection is reviewed by a human (occupational physician/HR) before being acted upon.

Under KVKK Art. 3/1-d, personal data means any information relating to an identified or identifiable natural person. Data that has been irreversibly anonymized falls outside this definition, and KVKK provisions do not apply to it. OculaWork trains a sector-wide statistical learning model ("OwO") using scan and self-assessment data from Customers, regardless of whether they use shared or self-hosted infrastructure (see item 5 below); that training draws on numerical features that have been technically separated and minimised so as to contain no direct identity or company identifiers.

This processing is limited by the following technical and legal safeguards:

1. Identifying information (name, surname, email, employee ID) is never included as model input or associated with model output in any way.
2. Free-text fields (health history, medication/allergy/illness anamnesis) are never read, processed, or stored; only a binary (present/absent) indicator of whether the field was filled in is used.
3. Mental-health and attention/alertness self-assessment results (GAD-7, PHQ-9, CBI, WHO-5, Epworth, Karolinska, PSS-4, a reaction-time-based alertness test, a breathing/calming exercise module, and the self-rated accuracy feedback on the character/personality test) are used only as a reduced total-severity score or a binary (yes/no) accuracy indicator. These reduced numeric scores may be included, as a purely numeric vector carrying no identity or company information, in OwO's training samples (a {0-1 numbers} vector plus a single 0/1 label) and retained for the 180-day period stated in §7.2; however, the raw/free-text answers behind these scales, or the underlying test record itself (see §9.4 — the personalCoach record, accessible only to the employee themselves), are never sent to or stored by OwO at any stage of this processing. The PHQ-9 item that screens for self-harm risk (item 9) is entirely excluded from this process and is used only for the employee's unconditional crisis-resource routing.
4. The final output of this processing consists solely of numerical model weights formed by statistically blending thousands of data points; it is not technically possible to reconstruct a specific employee's identity or answers from this output.
5. Where OwO runs, by deployment model. This item applies differently depending on which deployment model the Customer selects:
   • (a) Self-hosted Firebase deployment. The Customer sets up its own Firebase project. Identity data (email, password hash, role, tenant assignment) is held in OculaWork's central Firebase project, and OwO's consult function runs in that central project. Operational data (scan and self-assessment results) remains in the Customer's own cloud project; only the part that must enter this processing (the identity-stripped numeric profile defined in items 1-3) is transmitted to the central project momentarily and transiently, and is never permanently stored together with identity.
   • (b) Enterprise (on-premise) deployment — layered model. The Customer runs the Platform on its own server. Routine evaluation — risk level, threshold classification and anomaly detection — is performed entirely on the Customer's own server and requires no connection to OculaWork. In this processing, no individual employee data is transmitted to OculaWork's central infrastructure, including the individual numeric profile defined in items 1-3.
     
     By contrast, OwO's psychosocial evaluation layer, which relies on sector-wide comparison, runs at OculaWork's centre and is invoked only with aggregated input: sector code, an employee-count band (not an exact figure), distributions derived from at least 50 measurements, and the noise scale applied. This transmission contains no individual record, identity, department name, free text or timestamp; every cell below the threshold is suppressed (set to zero) before transmission. This channel is likewise off by default. Where OculaWork's central infrastructure is unreachable, this layer is disabled and routine evaluation continues uninterrupted on the Customer's server (see APP-0.3.3).
     
     A model-development contribution may additionally be sent, again only where the Customer has expressly enabled it (default: off); it carries only the four fields listed in the allowlist in APP-0.3C (modelSurumu, ornekSayisi, gradyan, gurultuOlcegi) and is not generated unless derived from at least 50 measurements, with privacy-enhancing noise applied and its magnitude capped. Every field outside the allowlist is rejected server-side. Identity data likewise remains within the Customer's own infrastructure. The application of these techniques does not mean the data reaching the centre is legally anonymous; anonymity is assessed separately in light of the concrete circumstances.
   In both models, the safeguards in items 1-4 and 6-13 apply unchanged. In the enterprise deployment, the application of privacy-enhancing techniques does not mean the contribution reaching the central infrastructure is legally anonymous (see APP-0.3C); anonymity is assessed separately in light of the concrete circumstances.
6. No human user — including management, the employer, or OculaWork personnel — has access to the raw data subject to this processing (the free-text and raw test answers referenced in items 2 and 3); access is limited to the automated processing function, and is instantaneous and transient.
7. OwO's output, as described in items 4 and 7, is solely a single set of sector-wide model weights — no readable sub-statistic broken down by sector, company size, or any other grouping is produced. This structurally limits the risk of singling out any one small company or employee group even absent a separate k-anonymity threshold; nonetheless, for large-scale, automated processing involving special-category data of this kind, conducting a Data Protection Impact Assessment (DPIA-equivalent) is recommended as good practice. This assessment has not yet been formally completed; a preparation process can be initiated for Customers who request it.
8. The sector-context score produced by OwO may be presented alongside any scan result solely as an informational, supplementary indicator; this score does not replace or alter the existing rule-based risk level (see §7.3.1). Externally sourced, documented information — such as academic scales or known medical/physiological fatigue factors — may also be added by OculaWork to OwO's training as a limited, low-weight calibration; such external information is likewise anonymous and general/statistical in nature, not specific to any individual employee or event.
9. Company-Internal Survey Signal: An employee's answer to a single-question, two-option survey published by Customer management may be converted into a binary (0/1) signal — management decides in advance which answer counts as "positive" — and included in OwO's training vector. The survey itself and the employee's answer remain visible, with identity, in the Customer's own management panel (see §9.4); only this derived 0/1 signal is transmitted to OwO, subject to the same de-identification rules as items 1-3.
10. Physician's Clinical Verdict Feedback: An occupational physician may rate a scan's algorithmic risk level as "accurate / higher than warranted / lower than warranted / referral needed / follow-up." Like item 3 above, this assessment — together with that scan's identity-stripped numeric profile — may be included in OwO's training samples as a corrected label; this does not alter the guarantee in item 1 that identity is never included as model input — the physician's assessment only corrects the OUTCOME label (high-risk or not) of that scan, identity is still never sent to OwO. The physician's assessment itself (and which scan, and therefore which employee, it relates to) continues to be stored, with identity, in the Customer's own tenant (see §7.1, §9.4) — only the derived signal sent to OwO is anonymized.
11. Character–Role Fit Index: The Customer's management panel never has access to any employee's individual Character Analysis result (this data is accessible only to the employee themselves; see §9.4). Instead, once at least 10 employees have completed the Character Analysis, a single aggregate percentage (the share of employees showing academically verified traits associated with safety behavior/fatigue resilience) and a statistical confidence value are shown; below this threshold the statistic is fully hidden. No individual result, name, or identity is ever visible or reverse-derivable at any stage of this statistic.
12. Feedback Loop: Alongside any information OwO produces (sector context, drug sedation match, Character–Role Fit Index), the user viewing it (physician/management) may optionally submit "was this useful" feedback (👍/👎). This feedback is never linked to any identity — only the type of information (e.g., "sector context") and whether it was helpful is recorded; which scan/employee/user it relates to is never stored. The accumulated feedback ratio feeds into the confidence percentage OwO displays for that type of information; this data cannot be read by anyone (including admin) — only the aggregate ratio is computed server-side.
13. Shared Knowledge Pool: OwO's consult layer (owoConsult), drug consult (owoDrugCheck), and Character–Role Fit Index (getCharacterFitStats) all draw on the same pool of external knowledge sources (owoExternalFactors). This means a new, genuinely relevant factor added to this pool can automatically contribute — as a low-weight, aggregate, anonymous indicator only — at every point it is relevant to, without any additional software change. This automatic contribution is always low-weight and bounded; it never single-handedly determines a final result or replaces the existing rule-based/academic-threshold calculations at any point.

Transparency: The full technical detail of this processing — including which data source is reduced to which signal — is documented in the OculaWork Technical Methodology Document (in the section titled "OwO Training Model") and is available to the Customer and data subjects upon request.

KVKK legislation and Board precedent may change over time. In the event of a regulatory change, the parties will cooperate in good faith, within a reasonable time, to bring this Agreement and related practices into compliance with the updated legislation.

In respect of the measurement activities carried out through the Platform in relation to employees, to the extent that the Customer determines the purposes and the essential means of processing, the Customer acts as data controller and OculaWork as data processor acting on the Customer's behalf.

In respect of separate processing activities that OculaWork carries out for its own purposes (such as its own customer account and subscription records, billing, support, its own marketing communications, and its own security logs), the status of data controller or data processor is determined separately for the activity concerned.

The status of the parties is assessed not merely by the label used in the contract, but by the actual nature of the specific processing activity and by who determines the purposes and means.

Depending on the nature of the processing, EAR, PERCLOS and fatigue scores may fall to be assessed as sensitive personal data under KVKK Article 6, in which case they require additional protection.

The processing of sensitive personal data relies on whichever of the conditions set out in KVKK Art. 6/3 is applicable to the specific case. Explicit consent is only one of those conditions; the structural power imbalance in the employment relationship and the necessity and proportionality of the processing are assessed separately.

1. Explicit consent (KVKK Art. 6/3): Written or electronic consent obtained from the employee — specific, informed, freely given and revocable. Explicit consent is not an automatic, general legal basis for every processing activity.
2. Employment and OSH obligation (KVKK Art. 6/3-f): Conditional upon the processing being necessary for the fulfilment of legal obligations in the fields of employment and occupational health and safety.

The Platform's optional facial biometric (face-embedding) feature used for login/identity verification is a distinct risk category from fatigue-scan metrics (EAR/PERCLOS etc.): it is a biometric identity capture mandated by the employer directly. In its Decision No. 2022/797 of 04.08.2022, the KVKK Board found facial-recognition-based entry/exit tracking unlawful for lacking any valid processing condition under Art. 6; more significantly, in its Principle Decision No. 2026/921 of 29.04.2026, the Board held that biometric data processing for attendance-tracking purposes is unlawful even where the employee's explicit consent has been obtained — reasoning that the structural power imbalance in the employment relationship undermines whether such consent is truly "freely given." That principle decision concerns biometric identification for attendance-tracking purposes and does not apply directly to the Platform's fatigue measurement; it nonetheless reflects the Board's current approach that employee consent is not automatically a safe harbour in every case. Accordingly, relying on explicit consent alone may not by itself render biometric processing lawful. Before enabling this feature, the Customer should assess (i) proportionality, necessity, and data minimization, (ii) whether a less intrusive alternative (e.g., encrypted card/PIN, RFID/NFC ID card, or device binding) would suffice, and (iii) consult its own legal counsel. OculaWork does not perform this assessment on the Customer's behalf and assumes no legal risk in this regard.

• All data transmission encrypted via TLS 1.3; HTTP access is blocked
• Firebase Firestore security rules enforce role-based access control (RBAC)
• Camera footage is processed client-side; raw video is not transmitted to servers
• Firebase Authentication manages sessions; token lifespan 1 hour
• Management panel shows only aggregated department statistics that have passed the thresholds in §11
• Access to the OculaWork admin panel is protected by two-step verification consisting of a password and a separate security-question answer; the security question is periodically rotated

• ISO/IEC 27001 Information Security Management System
• SOC 2 Type II
• Data centers are governed by Google's own security and data-processing terms; OculaWork does not separately warrant Google's legal compliance

Where OculaWork becomes aware of an event that may affect the security of personal data, it will notify the Customer in writing without undue delay and in any event within 24 hours. This contractual notification period does not alter the parties' statutory notification deadlines under KVKK and other applicable legislation (including the controller's obligation to notify the Board under KVKK Art. 12/5). The Customer is likewise obligated to notify OculaWork without delay upon becoming aware of a security incident on its own side (its own accounts, network, or systems) that could affect Platform data.

To fulfill its Data Controller obligations under KVKK, the Customer may request information and documentation regarding OculaWork's data processing practices. OculaWork will provide such information at a reasonable frequency and upon at least 15 days' prior written notice, without disclosing its own trade secrets or information belonging to other Customers. On-site audits or independent third-party audits are possible only under scope, duration, and confidentiality terms agreed in writing in advance by both parties; unless otherwise agreed, audit costs are borne by the requesting Customer.

Anyone who identifies a security vulnerability on the Platform may report it only to info@oculawork.com, under the principles of Responsible Disclosure. Active penetration testing, load testing, fuzzing, or similar activity carried out without OculaWork's prior written consent is not covered by this provision and remains subject to the Prohibited Uses clause in §11.1.

Should OculaWork incur liability for any reason, its total liability is limited to the subscription fees paid in the 12 months preceding the breach. This limitation does not apply in cases of willful misconduct, gross negligence, intellectual property infringement, or breach of confidentiality/data-security obligations.

• Fines and damages arising from Customer's failure to fulfill KVKK obligations
• Administrative and legal sanctions from failure to obtain employee explicit consent
• Legal consequences of personnel decisions made solely on the basis of Platform data
• Data breaches resulting from Customer sharing credentials with unauthorized persons
• Force majeure (natural disaster, war, government decision, cyberattack, power outage, internet backbone failures, internet service provider/DNS/DNSSEC/CDN outage, root certificate issues, global internet outage, cloud infrastructure provider outage, unexpected changes to browser or camera API policies by platform providers such as Apple/Google/Microsoft, or outage of third-party AI service providers)
• Indirect, unforeseen or punitive damages; this specifically includes loss of revenue, loss of profit, loss of reputation, loss of business, and loss of data attributable to the Customer's own backup obligations, the Customer's own infrastructure, or third-party infrastructure — no compensation is paid for these items. Losses arising from OculaWork's own fault or from the carve-outs listed in §10.2 (including a data-security breach) fall outside the scope of this provision. (except for the willful misconduct/gross negligence/IP/confidentiality carve-outs stated in §10.2)
• Outages or data loss attributable to Google Firebase / Google Cloud infrastructure

Neither party shall be liable for failure to perform its obligations under this Agreement for the duration of, and to the extent directly caused by, a force majeure event.

If any employee files a claim against the employer (Customer) related to Platform data, OculaWork is not a party to that dispute. The Customer agrees to indemnify OculaWork and cover any resulting costs.

The user is personally responsible for all actions taken from their own account. If a password is shared with a third party, all resulting consequences (including data access, unauthorized transactions, or data breaches) are the responsibility of the sharing user and/or the Customer; OculaWork cannot be held liable for this. User accounts are personal to the individual user; shared use of an account by multiple people constitutes a license violation, and OculaWork reserves the right to suspend the account in such a case.

OculaWork does not carry professional liability (errors & omissions) insurance or any other insurance coverage for the services under this Agreement.

Except as expressly stated in this Agreement, the Platform is provided "as-is" and "as-available." OculaWork makes no express or implied warranty that the Platform will operate uninterrupted, error-free, or entirely free of security vulnerabilities, or that it will be fit for a particular purpose, merchantable, or meet the Customer's expectations.

The Evacuation Drill module is a decision-support tool that produces spatial audit findings, a requirements list, scenarios and drill records on a floor plan drawn by the Customer. No output of the module — including findings, requirements, the OHS Compliance Score, the Risk Score or any drill report — constitutes a certificate of compliance, a fire-safety design, an approved escape plan or an official inspection report, and none of them alone forms a legal basis before the competent authorities.

Responsibility for inputs rests with the Customer. The building outline, room dimensions, clear door widths, floor occupancy, facility type and equipment positions are entered by the Customer; OculaWork does not and cannot verify that this information matches the actual structure. Outputs are valid only to the extent that the entered data is accurate. OculaWork cannot be held liable for results arising from incorrect or incomplete measurements.

Measurement and regulatory limit are distinct. The system always displays the measurements it computes from the plan; by contrast, it states a numeric limit from a regulation only where the source can be verified. Where the source cannot be verified, no limit is stated, the measurement is given and the Customer is asked to confirm it; such items are also excluded from the score. Determining factors such as hazard class, building use class, the presence of sprinklers, building height and the building permit are not known to the system and may change the outcome.

The OHS Compliance Score and Risk Score are estimative indicators. They cover only the items the system can check; the weighting method is a design choice that OculaWork declares openly and does not derive from regulation. A high compliance score does not mean regulatory compliance; a low risk score does not mean a safe workplace. The final compliance assessment rests solely with the employer and the occupational safety specialist / occupational physician they appoint.

Drill records and the attendance ledger. Behavioural records collected during a drill (the route drawn, duration, efficiency, answers) contain no identity and are reported only in aggregate; they may not be used to measure individual performance. The attendance ledger does contain identity for administrative purposes and is never merged with the behavioural records. The attendance record produced by the module does not by itself constitute proof that the drill obligation under Law No. 6331 Art. 11 and the Emergency Situations Regulation has been fulfilled; an official drill report depends on the drill actually being carried out on site and duly recorded by the employer.

Scenarios generated by the module (fire, gas leak, chemical spill, etc.) are constructs for training and awareness; they do not constitute an engineering prediction of how a real incident would develop, nor a fire model or smoke-propagation simulation.

Anonymous transfer of compliance and risk scores. When a floor plan is saved, the OHS Compliance Score and Risk Score computed from that plan, together with derived measures of the plan (area, counts of rooms, doors and equipment, audit finding codes), are transferred to the OculaWork server and used for sector-level comparison. This transfer contains no data relating to any natural person; no identity, name, user id or department is sent. The data relates to a floor plan, not to a person, and therefore does not constitute personal data within the meaning of Law No. 6698.

The plan name is not sent. The name you give a floor plan is free text and may contain the name of the workplace, building or floor; it is transmitted to the server neither as it is nor as a hash. So that records of the same plan can be related to one another over time, a random identifier with no content is generated and stored only in your browser; the link between that identifier and the plan name never leaves your device. A plan with the same name receives a different identifier on a different device.

The transferred data is commercial information belonging to your workplace. A k-anonymity threshold is applied in sector-level comparisons to prevent an individual workplace from being re-identified; no comparison is shown for groups below the threshold. The module can also run standalone: in that case no data is transferred and all records remain solely on your device. The transfer is not retroactive — only records made while the transfer is active are sent.

This clause applies to the attendance ledger of the Evacuation Drill module. The attendance ledger is the only record in the module that contains identity; the behavioural records collected during a drill (route, duration, efficiency, answers) contain no identity and are never merged with this ledger.

Controller and processor. The controller of the attendance record is the employer; OculaWork hosts this data as a processor acting on the employer's instructions.

Data processed. Only the following are stored on the server: the worker's user id (uid), the date of the drill and the attendance status (completed / left unfinished / time expired). Name, surname and department are not written to the server — they already exist in the worker record, so no second copy is created. This ledger contains no route, score or answer; the system also rejects such fields technically.

Purpose and legal basis. The data is processed to evidence fulfilment of the drill obligation under Occupational Health and Safety Law No. 6331 and the Regulation on Emergency Situations in Workplaces. The legal basis is compliance with a legal obligation of the controller under Art. 5/2-ç of Law No. 6698; explicit consent is therefore not required. The data may not be used to measure individual performance.

Retention and erasure. The attendance record is retained for the period during which the employer is obliged to keep OHS records under the applicable legislation; upon expiry it is erased or anonymised. Determining that period and recording it in the personal data inventory is the employer's responsibility.

Transfer. The attendance record is not transferred to third parties and is not included in the anonymous dataset OculaWork uses for sector-level comparison (see 10.10).

Your rights. Under Art. 11 of Law No. 6698 you have the right to access your data, to request its correction or erasure and to object to its processing. You may address your request to your employer.

This text accurately describes the data the system actually processes and its technical limits; preparing the workplace-specific privacy notice and personal data inventory, and verifying legal compliance, rests with the employer.

OculaLearn is a remote occupational health and safety (OHS) training module, hosted on separate Firebase infrastructure (oculalearn.web.app), based on the Annex-1 (Ek-1) curriculum of Turkish Law No. 6331 Art. 17 and the "Implementation Guide for Employees' Occupational Health and Safety Training" (Official Gazette No. 33212, April 2, 2026). OculaWork is responsible for the content and accuracy of the official Annex-1 curriculum. The accuracy, currency, and regulatory compliance of any workplace-specific Topic-4 content and/or fully custom additional trainings entered by the Customer via the "Develop Content" interface is the Customer's sole responsibility; such content is only recorded after the Customer accepts a mandatory liability acknowledgment (with identity, timestamp, and IP address logged) prior to saving. This custom content is never counted toward the official 60/100 pass score or the certificate — only the official Annex-1 curriculum is scored and certified. OculaWork cannot be held liable for any legal, administrative, or criminal consequence arising from Customer-entered custom content.

The Platform's software, source code, algorithms, design and brand are the exclusive intellectual property of OculaWork. Customers are granted a non-exclusive, revocable, limited, worldwide usage license scoped to their subscribed number of users. This license may not be transferred, rented out to another company, or sub-licensed; the Platform may not be copied or reverse-engineered under any circumstances. The license is valid only for the number of active users (seats) actually purchased/subscribed to; if usage exceeds the licensed quota, the Customer will be asked to purchase additional seats. If the licensed number of users is systematically exceeded, OculaWork may retroactively invoice for the excess usage or suspend the account. This Agreement does not transfer any right in the OculaWork brand, trade name, algorithms, or any pending patent applications to the Customer.

Raw scan results and reports belonging to the Customer and its employees remain the Customer's property. OculaWork processes this data solely within the scope of this Agreement; anonymized and aggregated statistics may be used for Platform improvement.

The Platform may incorporate third-party open source software. License rights to such software belong to the respective license holders. Use of open source components does not diminish OculaWork's intellectual property rights under this Agreement.

The Customer may not use OculaWork's brand, logo, or trade name for advertising, reference, or promotional purposes without OculaWork's prior written consent.

Unless otherwise agreed in writing, OculaWork may use the Customer's trade name solely in its reference customer list. The Customer may withdraw this permission at any time by written notice.

• The Platform is offered on a monthly or annual subscription basis; current pricing is published at oculawork.com
• New Customers are granted a 15-day free trial period; if no paid subscription is started by the end of the trial, the account is automatically frozen and no payment card is required
• OculaWork reserves the right to change its published pricing; price changes are communicated to the Customer at least 30 days in advance. The new price takes effect only from the next renewal period onward; it is never applied retroactively to an already-paid, ongoing subscription period of an existing Customer
• Payments are collected in advance at the start of each period; VAT and applicable taxes are included on invoices
• In the event of late payment, late-payment interest may be charged on the overdue amount at the commercial default interest rate prescribed under Turkish Commercial Code No. 6102 and applicable law; this is in addition to, not in lieu of, the 15-day cure process described in §13.3
• New taxes, fees, or similar financial obligations resulting from changes in tax law may be passed through to pricing from their effective date
• Cancellation notice must be provided in writing at least 15 days before the end of the period
• Prepaid subscription fees are non-refundable; no partial refund is given for the unused portion of a period upon cancellation/termination
• This Agreement governs a B2B relationship; consumer withdrawal rights do not apply
• The Platform is ad-free.

Before terminating the Agreement, OculaWork reserves the right to temporarily suspend the Customer's account in the following cases: (i) the Platform or its infrastructure is under an active cyberattack, (ii) suspected unauthorized access/misuse originating from the account, (iii) payment delay (see §13.3), (iv) API abuse, bot traffic, denial-of-service (DDoS) attempts, unauthorized automation, or an unusually high volume of requests (see §11.1 Prohibited Uses). In case (iv), the account may be suspended without prior notice in order to protect the integrity of the Platform or of other Customers. During suspension, access to Customer data is temporarily restricted but not deleted; access is restored once the situation is resolved.

Either party may terminate the Agreement with 30 days' prior written notice.

OculaWork reserves the right to terminate immediately and without compensation in the following cases:

• Persistent and clear violation of KVKK by the Customer
• Use of the Platform for illegal purposes
• Payment delay — the Customer is given a 15-day written cure notice; if payment is not made or the delay is not remedied within this period, the account may be suspended and/or the Agreement terminated
• Actions threatening the security of the Platform

Where a competent court order exists, or where an administrative/legal regulation legally requires it, OculaWork may partially or fully suspend/remove the Platform. To the extent this arises from a legal requirement outside OculaWork's control, it is treated as an exclusion from liability under §10.3.

• Customer may export their data within 90 days of contract termination
• After 90 days, all personal data is permanently and irreversibly deleted, confirmed in writing to the Customer
• The license automatically terminates upon expiration of the subscription; the Customer and its employees lose access to the Platform from that date

As of today, the Platform does not set a classic HTTP cookie; the following technical storage mechanisms are kept in the browser's local storage (localStorage):

Data protection requests are responded to within 30 days. To file a complaint with the Turkish Personal Data Protection Authority: kvkk.gov.tr

Notices sent to the email address provided by the parties under this Agreement are deemed delivered on the date sent. The Customer is responsible for keeping its contact information up to date. A message being routed to the recipient's spam/junk folder results from the recipient's own email provider filtering settings; OculaWork cannot be held liable for this. The parties are obligated to notify each other in writing of any change to their contact information within 7 days; the party that fails to do so is responsible for any consequences arising from the failure.

Invoices are issued as e-Invoice or e-Archive Invoice, as permitted by applicable regulations, and are sent and deemed delivered via email.

• This Agreement is governed by the laws of the Republic of Turkey
• KVKK Law No. 6698, OSH Law No. 6331, Commercial Code No. 6102, and Code of Obligations No. 6098 apply to disputes
• Ankara Courts and Enforcement Offices have exclusive jurisdiction over disputes
• Invalidity of any provision does not affect the remaining provisions (severability); the invalid provision shall be replaced, to the extent possible, with a lawful provision that most closely reflects the commercial purpose and intent the parties sought to achieve with that provision
• OculaWork reserves the right to update this Agreement with 30 days' prior notice
• Claims arising from this Agreement are subject to the statute of limitations periods prescribed by applicable law

The Customer represents and warrants that it will not use the Platform in violation of applicable export control and sanctions laws of Turkey or of international bodies/jurisdictions such as the United Nations, European Union, or United States; and that it will not access the Platform on behalf of a person/entity on a sanctions list or from a sanctioned country.

The Customer may not assign this Agreement without OculaWork's prior written consent. In the event of a merger, share transfer, asset sale, or similar corporate restructuring, OculaWork may assign this Agreement and the rights and obligations arising from it to a third party, provided the Customer is notified in advance.

In the event of a conflict between the text of this Agreement and its appendices (Appendix-1 Data Processing Agreement, Privacy Policy, KVKK Disclosure Notices, Consent Form), the following order of precedence applies: (i) Appendix-1 Data Processing Agreement (solely with respect to data-processing provisions), (ii) the main text of this Agreement, (iii) other appendices and separate documents. Notices are given in Turkish unless otherwise specified; in the event of a conflict between the TR/EN texts, the Turkish text prevails.

Each party agrees not to disclose to third parties, and to use solely for the performance of this Agreement, the other party's trade secrets, pricing information, algorithm and software architecture details, customer/employee lists, and other information expressly marked as confidential that it learns of or gains access to under this Agreement. This obligation does not extend to information that is publicly available, must be disclosed under legal requirement, or is independently developed; it survives termination of this Agreement for a reasonable period.

A party's failure to exercise, or delay in exercising, any right arising from this Agreement in a given instance does not constitute a waiver of that right, whether in that instance or in any future instance of the same or a similar nature.

This Agreement and its appendices (Appendix-1 Data Processing Agreement, together with the other documents referenced in §16.3) constitute the entire agreement between the parties regarding their subject matter and supersede all prior written or oral discussions, proposals, and agreements on the same subject. This Agreement may only be amended in writing by OculaWork (see the update-notice provision in §16).

Regardless of the reason this Agreement terminates, provisions that by their nature are intended to remain in effect after termination continue to survive; these include, in particular, Confidential Information (§16.6), Intellectual Property (§11), Indemnification (§16.5), the personal-data-protection provisions (§7), and the Evidentiary Agreement (§16.4).

This appendix applies only to Customers running the Platform on their own infrastructure and their own database. It does not apply to the self-hosted Firebase deployment. In case of conflict, the provisions of this appendix prevail over the main text.

In an enterprise deployment, employee scan records and the health indicators derived from them are held exclusively on the Customer's own server and database. Hosting, backup and availability of this data, and all costs relating to it, belong to the Customer.

Raw camera images, video frames and facial landmark data never leave the employee's device under any circumstances; they are transmitted neither to OculaWork nor to the Customer's server, and are not stored anywhere. The only data leaving the device is numerical measurement results.

The following remain on OculaWork's infrastructure even in an enterprise deployment, because they are required in order to perform the service, and the Customer accepts this:

• Company configuration records and account preferences,
• De-identified model training data — employee identity and company identity are not stored in these records,
• The entire e-mail delivery infrastructure (including new membership, password operations, personnel and occupational physician notifications),
• The analysis and decision-support core (sector model, benchmarking, hypothesis engine) and the licence issuing infrastructure.

These components are not included in the licensed software; they are provided as a service and are not delivered to the Customer.

APP-0.3.1 — The enterprise licence is a time-limited right of use; it does not transfer ownership and does not create a perpetual right of use. The Customer's right to use the Software is limited to the licence term stated in the Agreement and terminates automatically upon expiry of that term. Technical restriction or cessation of access upon expiry of the licence term cannot be characterised as a defect, default, or breach of contract.

APP-0.3.2 — For as long as the licence term continues, OculaWork may use the licence verification service in order to verify the validity of the licence by technical means.

APP-0.3.3 — Inability to reach the verification server is not expiry of the licence. Temporary unavailability of the licence verification service does not mean that the licence has expired or become invalid. In that case the Software continues to operate offline on the basis of the last verified status of the valid licence; where a verification problem persists, a warning is displayed to the Customer's administrator.

APP-0.3.4 — Access to the Software by a Customer whose licence term is still running may not be stopped by reason of a technical outage originating from OculaWork's infrastructure, planned maintenance, infrastructure failure, or unavailability of the licence verification service, and the licence term shall not be treated as shortened without fault on the Customer's part.

APP-0.3.5 — Where the Customer fails to pay the licence fee when due, OculaWork will give written notice and allow an additional period of at least 15 days for payment. If payment is not made by the end of that period and the default continues, OculaWork may temporarily suspend use of the Software. Suspension does not constitute termination of the Agreement and does not extinguish the Customer's other rights and obligations.

APP-0.3.6 — Before any suspension, OculaWork will send the Customer written notice stating the suspension date and the amount due. Where a payment dispute reasonably requires examination, access will not be suspended until the dispute has been resolved. During a valid licence period, the Service will not be technically disabled solely on the ground that a payment dispute exists, without operating the notices and periods set out above.

APP-0.3.7 — Access to data. Even where access is suspended or the licence expires, the Customer retains the right to export its own data on the terms and within the periods set out in APP-0.8.

In an enterprise deployment, personal data relating to the Customer's employees is processed without being removed from the Customer's own IT infrastructure. OculaWork carries out the analysis activity within the Customer's infrastructure, through software components authorised by the Customer.

In an enterprise deployment, the fields that may be sent from the Customer's server to OculaWork's central system are technically restricted. This is not merely an undertaking but the maximum the system permits: any field outside the allowlist is rejected server-side.

Model development contributions are further subject to: being derived from at least 50 measurements, having privacy-enhancing noise applied, and having the contribution magnitude bounded. The application of these techniques does not mean the data is legally anonymous; anonymity is assessed separately on the concrete circumstances.

Release of the source code to the Customer is possible only upon the occurrence of trigger events defined in a separately executed source code escrow agreement between the parties. The purpose of escrow is not to give the Customer access to the source code at will, but to protect the Customer's operational continuity in exceptional circumstances.

Trigger events are limited and expressly defined: OculaWork permanently ceasing operations, the conditions specified in the agreement arising in the context of bankruptcy/composition proceedings, or the permanent discontinuation of support and maintenance services. A temporary service interruption is not a trigger event.

The component on the Customer's server accepts only model packages signed with OculaWork's valid private key and whose integrity has been verified. An unsigned package, or one whose signature cannot be verified, is not executed.

The signing private key is under no circumstances sent to the Customer environment; only the verification (public) key resides on the Customer side. This separation prevents the Customer from introducing a self-produced model and prevents distribution of forged models should the central infrastructure be compromised.

OculaWork's remote administrative access to the Customer's infrastructure is disabled by default. Where support requires it, access is authorised by the Customer temporarily and limited to the purpose.

Every authorised access is logged with who, when, for what purpose and to which resource. OculaWork support personnel have no default access to employee content.

Where a standard contract is used for a cross-border transfer, it must be notified to the Authority within 5 business days of signature. Which party performs the notification is expressly determined in the relevant Order Form or transfer agreement, according to the transfer scenario and the parties' status.

The standard contract text is used without modification, as required by law; commercial terms specific to the parties are set out in a separate agreement.

The Customer may not disable, modify or circumvent the licence check. Any attempt to run the software without connecting to OculaWork's licence service constitutes a material breach and entitles OculaWork to terminate the Agreement immediately for cause.

The fact that client-side components of the software are technically readable does not grant the Customer any right of reproduction, creation of derivative works, transfer or sub-licensing.

OculaWork reserves the right to audit the number of installations and licence compliance, upon reasonable notice and without disrupting the Customer's operations. The parties agree that the signed licence and access records produced by the software have evidentiary value. If non-compliance is found, the costs of the audit are borne by the Customer.

The reporting thresholds (at least 5 employees per department, at least 10 company-wide) are a contractual undertaking. The Customer may not request that these thresholds be lowered or that the aggregation/suppression protection be circumvented. Managers cannot access an employee's health data; such data is visible only to the employee themselves and the authorised occupational physician.

Installation, updating, backup and operation of the server are the Customer's responsibility; these obligations are defined in the Operations Guide provided by OculaWork, which is deemed an annex to this Agreement. OculaWork's service level undertaking is limited solely to the services it provides (licence, analysis, e-mail); outages, data loss or performance issues within the Customer's infrastructure are out of scope.

Upon termination, the Customer's data remains with the Customer, as it already resides on their own server; no separate obligation of return arises for OculaWork. The de-identified model training data held at OculaWork is irreversibly anonymous and is therefore not deleted, and the Customer consents to this in advance.

This appendix is an integral part of this Service Agreement and governs the data-processing relationship between the Customer and OculaWork under KVKK Art. 3. It is a consolidated summary of the relevant provisions within the main text; in case of conflict, the corresponding section of the main text prevails.