Patient privacy notice in Turkey: contents, sample outline and explicit consent

The receptionist hands a new patient a form: “Please sign here for your personal data.” The patient does not ask what they are signing; the receptionist is not quite sure whether the form is a patient privacy notice, explicit consent or treatment consent. The same morning, another patient asking for an appointment on WhatsApp writes their name, phone number and complaint. On whose phone do these messages sit, what was the patient told, which text was accepted? Clinics in Turkey usually look for the answers only when a patient submits a data request.

A patient privacy notice is the notice a clinic gives when it obtains a patient’s personal data, explaining by whom, for what purpose and how the data will be processed. It is required by Article 10 of Turkish Law No. 6698 on the Protection of Personal Data (KVKK, Turkey’s personal data protection law). In this article we read the official texts to separate the privacy notice, explicit consent and consent to medical procedures, and we give a practical checklist.

Privacy notice vs explicit consent: three documents together with the medical consent form

Combining all three in a single signature both misleads the patient and weakens the function of each document. Where processing is based on explicit consent, the Communiqué on the Obligation to Inform requires the duty to inform and explicit consent to be fulfilled separately (Art. 5(1)(f)). Consent to a medical procedure arises from Turkish healthcare legislation and does not replace the KVKK text.

What should a patient privacy notice contain?

Article 10 of KVKK requires the data controller to give information on five points when personal data is obtained. The Communiqué states that these are the minimum content. The list below turns the article into a checklist adapted for a clinic.

• Identity of the data controller: the clinic’s trade name, address and a contact channel for requests.
• Purposes of processing: purposes such as appointment management, reminders and communication should be written one by one and clearly; according to the Communiqué, vague phrases such as “other purposes that may arise” should not be used.
• To whom and for what purpose data may be transferred: the relevant recipient groups and the purpose of the transfer.
• Collection method and legal basis: whether the data comes from a form, the phone, a web page or messaging, and which condition the processing relies on.
• The patient’s rights under KVKK Art. 11: rights such as requesting information, correction and erasure, and how to apply.
• Clear, understandable and plain language: the Communiqué requires this separately; a single page full of legal jargon does not meet it.

Clinic KVKK privacy notice example: an outline

The outline below is not a ready-made text but the order of headings to fill in. Complete the fields in square brackets for your clinic and show the result to your adviser before publishing.

1. Data controller: [Clinic trade name, address, email for requests].
2. What data we process: [name and surname, phone, email, appointment date and time, any information you wrote when contacting us].
3. Why we process it: [to create and manage your appointment, send reminders, communicate with you].
4. Legal basis and collection method: [appointment form, phone and messaging; the processing condition relied on].
5. Who it may be transferred to: [software service providers, competent authorities where there is a legal obligation].
6. Your rights and how to apply: [rights under KVKK Art. 11, how to submit a request].

How do you obtain explicit consent from a patient?

The Law defines explicit consent as consent on a specific matter, based on information and expressed freely (Art. 3(1)(a)). In practice this means not offering the patient a single “I accept everything” box, presenting each purpose as a separate, unticked option, and stating clearly when refusing consent does not prevent the appointment.

One more point to remember: explicit consent is not required for every processing activity. Article 5(2) lists conditions where consent is not needed, such as processing directly related to the formation or performance of a contract; Article 6 treats health data as special category data subject to separate conditions, and also names as a condition that processing is necessary for the provision of healthcare services by persons under a duty of confidentiality. The clinic needs to determine with its own adviser which processing relies on which condition; consent is not the answer to every question.

Is patient data received via WhatsApp covered by KVKK?

The Law treats any information relating to an identified or identifiable natural person as personal data (Art. 3(1)(d)) and covers its processing by fully or partly automated means (Art. 2). A patient’s name, phone number and appointment request fall within this definition; if the message contains a statement about their health, that part falls under the special category data in Article 6. So in practice the answer is yes. The definition in the Turkish Ministry of Health’s Regulation on Personal Health Data is also broad enough to cover information about the healthcare service provided to a person; clarify with your adviser how the regulation applies to your clinic’s appointment records.

The practical questions are these: who can see the message, does it sit on personal phones, is it forwarded to a group, does the first reply give the patient a link to the privacy notice, and what happens to the conversations on the device of a staff member who leaves? The data security article (Art. 12) obliges the data controller to take the necessary technical and administrative measures. The health data regulation requires measures that prevent people being served side by side at counters and desks from hearing or seeing each other’s personal data (Art. 5(4)), and limits staff access to data to what the service requires (Art. 6(1)). Reviewing the reception layout and admin panel permissions from this angle is a good start.

What happens if a patient requests erasure or information?

Under KVKK Art. 11, the patient may ask to learn whether their data is processed, request information, ask for correction and, where the conditions are met, erasure. The data controller must conclude the request as soon as possible and within thirty days at the latest (Art. 13). Provisions on erasure in other laws are reserved (Art. 7(2)); in other words, the clinic must separately assess retention obligations arising from other legislation.

How do you prove the duty to inform? The limits of paper forms, Excel and WhatsApp

The Communiqué places the burden of proving that the duty to inform was fulfilled on the data controller (Art. 5(1)(e)). Paper forms get lost in files, and it is unknown which version of the text was signed; when the text is updated, it cannot be tracked which version earlier patients accepted. A WhatsApp message saying “I have read it” does not show separate consents or the text version either. In a small practice, paper and an orderly archive can work; when the number of channels and patients grows, version, time and approval information need to be kept together with the appointment record.

How does Super Randevu keep privacy notice and consent records?

In Super Randevu, the privacy notice and explicit consent are stored as versioned records: the system keeps which text version was approved and when, and this record applies in all five languages in which the patient page is offered. Erasure and export are done in a single step. Data and backups are kept on servers in Turkey, two-step verification is mandatory at every staff login, each business’s data is separated at database level, and medical records such as diagnoses, treatment notes or prescriptions are never stored. In the customer pool, contact details, appointment history, source and consent records are gathered on a single card; this feature is in the pilot stage.

None of this replaces the clinic’s obligations: the content of the text and the legal basis belong to the clinic, while the software helps keep the records in order. You can review the screens and the pilot programme on the Super Randevu page.