--- title: "Topic: Patient Data and Privacy | Sağlık Ajansı" description: "How health data flows through digital channels, separating notice from explicit consent, image consent, and building workable team behaviour rules." canonical: https://saglikajansi.com.tr/en/topics/patient-data-and-privacy.html language: en last_modified: 2026-08-22 alternates: - en: https://saglikajansi.com.tr/en/topics/patient-data-and-privacy.html - tr: https://saglikajansi.com.tr/konular/hasta-verisi-ve-mahremiyet.html publisher: "Sağlık Ajansı — Marka Studio Dijital Reklam Tasarım Ajansı" note: "Bu dosya, kanonik HTML sayfasının makine-okunur alternatifidir. Kanonik kaynak yukarıdaki canonical URL'dir." --- *TOPIC* # Patient Data and Privacy Health data is special-category personal data and can be collected unknowingly through digital communication channels. This topic brings together the pages covering the data-flow map, the consent structure and team behaviour. In medical tourism first contact often begins with a message and an image. The moment a patient sends an X-ray, institutional data responsibility has effectively begun, usually with no notice given. ## The data-flow map comes first Most institutions do not know precisely which data arrives through which channel. Web form, WhatsApp, Instagram messages, the call centre, facilitator referrals and advertising-platform forms all operate independently. Mapping makes the sprawl visible: for each channel, the data collected, where it is stored, who can access it, the retention period and the deletion method are written in one table. Without that table, an updated privacy notice does not reflect reality. ## Notice and explicit consent are not the same The notice obligation applies in every case and means informing the individual. Explicit consent is a specific, informed and freely given approval for a defined processing activity. Folding both into one tickbox is where most institutions slip. Informing someone is not the same as obtaining their agreement, and the agreement half has to stand alone, stay optional and be reversible in practice. ## Pages under this topic Services ### [Privacy and Patient Visual Consents](https://saglikajansi.com.tr/en/services/privacy-and-patient-visual-consents.html) Mapping how personal data enters through forms, messaging, CRM and content, and structuring notice and explicit consent around it. Knowledge Centre ### [Privacy and Patient Confidentiality](https://saglikajansi.com.tr/en/knowledge/privacy-and-patient-confidentiality.html) How health data is protected as special-category data, how it flows through digital channels and how notice and consent should be structured. Our Approach ### [Data Security and Patient Privacy](https://saglikajansi.com.tr/en/approach/data-security-and-patient-privacy.html) Which data the agency accesses, which it does not, and the security practices applied when working in institutional systems. ### [CRM and Patient Enquiry Management](https://saglikajansi.com.tr/en/services/crm-and-patient-enquiry-management.html) A tracking system where every enquiry lands in one record with an owner, a defined first-response time, a visible stage and a mandatory loss-reason field. Page ### [Personal Data Notice](https://saglikajansi.com.tr/en/personal-data-notice.html) Data controller identity, processing purposes, legal grounds, transfers and data subject rights under Turkish data protection law. ### [Privacy and Data-Processing Approach](https://saglikajansi.com.tr/en/privacy-and-data-processing.html) What personal data is collected through saglikajansi.com.tr, for what purpose it is processed, with whom it is shared and how long it is kept. ### [Meta Ads Management for Medical Tourism](https://saglikajansi.com.tr/en/services/meta-ads-management.html) Facebook and Instagram advertising for authorised providers: creative limits, the before-and-after decision, form versus WhatsApp, consent and measurement. ### [Healthcare Advertising Compliance Checklist](https://saglikajansi.com.tr/en/knowledge/advertising-compliance-checklist.html) Regulatory and platform risk by claim type, the pre-publication check order, and why explicit consent does not lift the promotion limit. *Frequently asked questions* ## What institutions ask about this topic ### A patient sent us an X-ray on WhatsApp — what do we do? Health data is special-category data. It should move into an institutional, access-controlled environment, must not sit on personal devices, and the patient should be informed. ### Is a single checkbox enough? Rarely. The notice and the agreement serve different purposes, so they need separate controls, and the agreement has to name what it covers. ### Does the agency see patient data? No. Patient names, health records and imagery are neither requested nor processed; the work runs at anonymous flow and process level. ### Are advertising platform forms a problem? Platform forms collect data on the platform side, which raises additional notice and transfer questions. Treat them as a separate heading when mapping. ### We already have a privacy notice — is this still needed? Having the text is not enough; it must reflect the real data flow. The most common problem is that the channels named in the notice do not match the ones actually used. ### How should we obtain image consent? The consent text must be separate, narrow and purpose-bound; which image will be used on which channel and for how long must be written, and a withdrawal route defined. *Next step* ## Not sure where this topic starts for you? Share your current position and we will identify which page in this topic applies to your institution first. *Other topics* ## Continue by topic --- Kanonik sayfa / Canonical page: https://saglikajansi.com.tr/en/topics/patient-data-and-privacy.html Site haritası / Site map: https://saglikajansi.com.tr/llms.txt