Ethics, data protection and compliance
Opinion AI does not take institutions' healthcare data into its own systems or store it. All patient and clinical data remains in the institution's own infrastructure, under the institution's control. The model runs inside the institution's environment, and the data does not leave that environment. Our other measures for meeting ethical and legal obligations also rest on this commitment.
By design, patient data
never enters our systems
Opinion AI does not take patient data, clinical records, identifiers or files into its own systems, and we do not process, store or repurpose them on our own infrastructure. The model is installed in the institution's environment, and the data does not leave the institution. This commitment is made in addition to the obligations set out in KVKK and the GDPR.
Data stays in the institution
All patient, clinical, laboratory and operational data remains on the institution's own servers, under its control. No data flows to the Opinion AI environment.
The institution is the data controller
Under KVKK and the GDPR, the institution is the data controller. If installation, maintenance or support requires access to data, we act only on the institution's instructions, under a data processing agreement and as a data processor.
Data is not used for other purposes
The institution's data cannot be used to train MINA's shared model, be offered to another customer or serve any other secondary purpose; this is also guaranteed by contract. Where an institution-specific LoRA adapter is used, it is trained inside the institution's own environment on its own data and stays there.
Computation happens inside the institution
MINA's clinical decision-support computations run on the institution's infrastructure, either on its own servers (on-premise) or in an isolated cloud dedicated to the institution. The output also stays within the institution.
Data is processed in Türkiye or the EU
If the institution chooses a cloud deployment, its data is processed only in Türkiye or in the EU region and is not transferred outside that region.
The architecture is openly documented
Data flows, access points and isolation boundaries are documented. The institution's auditors and IT team receive complete documentation.
Security architecture
Data that stays in the institution is protected by several layers at the platform level, in addition to the institution's own security measures.
Encryption with AES-256
Data travels over HTTPS and is kept on AES-256-encrypted disks. Encryption keys are open to oversight through the institution's key management system (KMS).
Local network isolation
The database can be reached only from the institution's local network. There is no externally exposed network endpoint; administrators get remote access through an SSH tunnel.
Role-based access
Each user is given only the permissions their work requires (the least-privilege principle). Authentication is multi-factor, and every action is recorded in an auditable log.
Our responsible
AI principles
Beyond our legal obligations, we are bound by international AI ethics frameworks. Our core principles are transparency, fairness, accountability and human oversight.
Explainability
MINA presents every output with its source reference, confidence score and rationale. It is always clear how an answer was produced.
Human oversight
People make every critical decision, such as an approval, a request for missing documents, a rejection or a prescription. MINA only provides support for these decisions.
Bias awareness
The Physician Ethics and Advisory Board regularly reviews model outputs, and fairness and consistency tests are applied across clinical domains.
Hallucination control
The GraphRAG architecture ties answers to reference sources. Information drawn from sources and the model's own inference are shown separately in every answer.
International ethical frameworks
In our work we take into account the World Health Organization's (WHO) guidance on the ethics of AI for health, the EU AI Act, the OECD AI Principles and the IEEE Ethically Aligned Design framework.
Enterprise certifications
We hold ISO/IEC 27001 for information security, ISO/IEC 27701 for privacy, ISO 9001 for quality, ISO 14001 for environmental management and ISO 45001 for occupational health and safety.
Documents, inference and
decisions are kept apart
To trust an answer, you need to see where the information came from and where the decision was made. Every MINA answer makes this distinction visible.
Documents and inference are shown separately
Every answer shows clearly which information comes from the institution's documents and which is MINA's inference.
Rules are evaluated in the rule engine
The rule engine produces the result of a rule check, and the AI only explains it. People make the final decision.
Verified data
The model works with the institution's verified data; personal data is masked inside the institution in line with KVKK. Data does not leave the institution.
The board that oversees the model
and the team in the field
A board of physicians oversees MINA's clinical accuracy and ethical boundaries. Our technical, operations and partner team works in the field alongside insurers and healthcare institutions.
Related guides and articles
Talk to us about
ethics and compliance
If you would like detailed information on data protection, KVKK and our ethics policies, our team will answer your questions.
Contact Us