--- title: "Personal Data and Patient Privacy Guide | Sağlık Ajansı" description: "How health data is protected as special-category data, how it flows through digital channels and how notice and consent should be structured." canonical: https://saglikajansi.com.tr/en/knowledge/privacy-and-patient-confidentiality.html language: en last_modified: 2026-08-22 alternates: - en: https://saglikajansi.com.tr/en/knowledge/privacy-and-patient-confidentiality.html - tr: https://saglikajansi.com.tr/bilgi-merkezi/kvkk-ve-hasta-mahremiyeti.html publisher: "Sağlık Ajansı — Marka Studio Dijital Reklam Tasarım Ajansı" note: "Bu dosya, kanonik HTML sayfasının makine-okunur alternatifidir. Kanonik kaynak yukarıdaki canonical URL'dir." --- *Medical-tourism guide* # Privacy and Patient Confidentiality Under Turkish data protection law health data is special-category personal data and subject to stricter conditions. Because it can be collected unknowingly through digital communication channels, institutions must first produce a data-flow map. Sağlık Ajansı editorial team·Last reviewed: 22 August 2026 In medical tourism first contact often begins with a message and an image. When a patient sends an X-ray, a medicine photograph or a picture of themselves, institutional data responsibility effectively begins — usually with no notice given. > Health data flow through digital channels shown with its consent structure ## Why the data-flow map comes first Updating a privacy notice without knowing the real data flow makes it non-functional. Where the channels named in the text do not match the ones actually used, the document does not protect the institution. Mapping answers, for each channel: what data is collected, where it is stored, who has access, how long it is kept and how it is deleted. Channels that must be mapped - Website enquiry and quotation forms - WhatsApp, Instagram and other messaging channels - Call centre and telephone records - CRM, email and file-sharing environments - Advertising platforms' own form products - Referrals arriving through facilitators ## Notice and explicit consent are different The notice obligation means informing the individual while data is processed and applies in every case. Explicit consent is a specific, informed and freely given approval for a defined processing activity. Combining them in a single checkbox is a common error. Notice informs; consent must be separate, optional and withdrawable, with a working route for withdrawal. ## Imagery and promotional use Promotional use of patient imagery intersects two regimes: the promotion regulation restricts patient-satisfaction content while data protection law requires explicit consent for health data. Because of that intersection, image use must be assessed separately under both. Having obtained consent does not by itself make the use compliant with promotion rules. Cross-border transfer Processing the data of a patient abroad, and the conditions for transferring it outside Türkiye, require separate assessment with your data protection advisor. ### Map first A text written without knowing the real flow does not protect the institution. ### Separate consent Notice informs; explicit consent must be separate, optional and withdrawable. ### Behaviour guide Team habits matter more than the policy document. *Working sequence* ## How we move, step by step 1. 01**Channel inventory**All data-collecting channels listed. 2. 02**Flow map**The path from entry through storage to deletion drawn. 3. 03**Text structure**Notice, consent and image consent texts separated. 4. 04**Technical implementation**Consent flow applied across forms, cookies and messaging. 5. 05**Team hand-over**A short, workable behaviour guide shared. *Official sources* ## Primary sources for Personal Data and Patient Privacy Guide These links are general orientation; review the current text with your legal team. *Frequently asked questions* ## What institutions ask most about this ### Why is health data special-category? Turkish data protection law defines health data as special-category personal data, subject to stricter processing conditions and additional security measures. ### What do we do with images arriving on WhatsApp? Images arriving on WhatsApp must move into an institutional, access-controlled environment, must not sit on personal devices, and the patient must be informed. Define the process with your data protection lead. ### Is a single checkbox enough? Usually not. Combining notice and explicit consent is a common error; consent must be separate, optional and subject-specific. ### What if consent is withdrawn? A working route for withdrawal must exist and the consequences — including removal of the relevant content — must be agreed in advance. ### Are advertising platform forms a problem? Platform forms collect data on the platform side, raising additional notice and transfer questions. Treat them as a separate heading when mapping. ### Can an agency process data on our behalf? That requires a scope assessment. We do not request or process patient data; our work runs at anonymous flow level. *Next step* ## Let us make your data flow visible Share the channels you use and we will begin the mapping together. *Related topics* ## Continue with the next relevant topic --- Kanonik sayfa / Canonical page: https://saglikajansi.com.tr/en/knowledge/privacy-and-patient-confidentiality.html Site haritası / Site map: https://saglikajansi.com.tr/llms.txt