Map first
A text written without knowing the real flow does not protect the institution.
Medical-tourism guide
Privacy and Patient Confidentiality
Under Turkish data protection law health data is special-category personal data and subject to stricter conditions. Because it can be collected unknowingly through digital communication channels, institutions must first produce a data-flow map.
In medical tourism first contact often begins with a message and an image. When a patient sends an X-ray, a medicine photograph or a picture of themselves, institutional data responsibility effectively begins — usually with no notice given.
Why the data-flow map comes first
Updating a privacy notice without knowing the real data flow makes it non-functional. Where the channels named in the text do not match the ones actually used, the document does not protect the institution.
Mapping answers, for each channel: what data is collected, where it is stored, who has access, how long it is kept and how it is deleted.
Channels that must be mapped
- Website enquiry and quotation forms
- WhatsApp, Instagram and other messaging channels
- Call centre and telephone records
- CRM, email and file-sharing environments
- Advertising platforms' own form products
- Referrals arriving through facilitators
Notice and explicit consent are different
The notice obligation means informing the individual while data is processed and applies in every case. Explicit consent is a specific, informed and freely given approval for a defined processing activity.
Combining them in a single checkbox is a common error. Notice informs; consent must be separate, optional and withdrawable, with a working route for withdrawal.
Imagery and promotional use
Promotional use of patient imagery intersects two regimes: the promotion regulation restricts patient-satisfaction content while data protection law requires explicit consent for health data.
Because of that intersection, image use must be assessed separately under both. Having obtained consent does not by itself make the use compliant with promotion rules.
Separate consent
Notice informs; explicit consent must be separate, optional and withdrawable.
Behaviour guide
Team habits matter more than the policy document.
Working sequence
How we move, step by step
- 01Channel inventory
All data-collecting channels listed.
- 02Flow map
The path from entry through storage to deletion drawn.
- 03Text structure
Notice, consent and image consent texts separated.
- 04Technical implementation
Consent flow applied across forms, cookies and messaging.
- 05Team hand-over
A short, workable behaviour guide shared.
Frequently asked questions
What institutions ask most about this
Why is health data special-category?
Turkish data protection law defines health data as special-category personal data, subject to stricter processing conditions and additional security measures.
What do we do with images arriving on WhatsApp?
Images arriving on WhatsApp must move into an institutional, access-controlled environment, must not sit on personal devices, and the patient must be informed. Define the process with your data protection lead.
Is a single checkbox enough?
Usually not. Combining notice and explicit consent is a common error; consent must be separate, optional and subject-specific.
What if consent is withdrawn?
A working route for withdrawal must exist and the consequences — including removal of the relevant content — must be agreed in advance.
Are advertising platform forms a problem?
Platform forms collect data on the platform side, raising additional notice and transfer questions. Treat them as a separate heading when mapping.
Can an agency process data on our behalf?
That requires a scope assessment. We do not request or process patient data; our work runs at anonymous flow level.
Next step
Let us make your data flow visible
Share the channels you use and we will begin the mapping together.