Guide
How do clinics achieve KVKK compliance?
Under Turkey’s Personal Data Protection Law No. 6698 (KVKK), health data counts as a special category of personal data and is subject to stricter rules. This guide explains in plain terms what you need to do. It doesn’t replace legal advice; consult your lawyer about your clinic’s situation.
Why is health data different?
The Personal Data Protection Law No. 6698 defines health data as a “special category of personal data.” For data in this category, both the conditions for processing and the required security measures are stricter. Almost every record kept in a clinic falls within this scope: diagnosis, treatment, prescriptions, images, measurements.
In practice this means you need to know — and be able to show — who sees the data, where it’s kept and how long it’s retained. “It’s on the computer” isn’t a sufficient answer.
Privacy notice and explicit consent
They’re two different things and are often confused.
You explain for what purpose you process the data, to whom you transfer it, how long you keep it and the person’s rights. This is information; it doesn’t depend on the person’s approval.
It’s approval given on a specific matter, informed and of free will. It’s required in some cases when processing health data; however, the law also provides exceptions for processing for treatment purposes.
Having the privacy notice signed and counting it as “consent obtained” is a common mistake. The texts should be separate, and consent should be marked separately.
An appointment reminder relates to delivering the service. A campaign announcement, however, is a commercial electronic message and requires separate permission.
If you have consent forms signed digitally, which version of the form was signed and when must be on record. In Clineo, custom consent forms are available from Clineo Soft up, and the signed form is attached to the patient file.
How long is it kept, and what happens then?
Personal data can’t be kept once the purpose of processing is gone. In healthcare, however, the relevant regulations set retention periods, and these take precedence. Your clinic should create a retention and destruction policy and put in writing how long each type of data is kept.
If a deletion request comes in
A person can ask for their data to be deleted. If you have a retention obligation under the regulations, you explain it with its justification. It’s important to record the request and your response.
Backups are data too
When you delete, you also need to think about what’s in the backups. Ask your provider how long backups are kept and how deletion affects them.
Technical measures you need to take
What the Board’s expected measures look like at clinic scale:
Not everyone should see all data. Permissions should be adjustable by role and, if possible, by module.
Fields like ID numbers and contact details should be stored encrypted and shown on screen only as much as needed.
Who opened which record and when should be logged. In a suspected breach, it’s your only evidence.
A password alone is weak. A second step, such as a one-time code, should be added.
A session left open at an unattended computer is the most common gap. It should close automatically after a set time.
Regular, automatic and verified backups. A backup that’s never been restored doesn’t count as a backup.
On the Clineo side, these translate as follows: ID numbers and phone numbers are stored encrypted and shown masked on screen; permissions are set per module and per person; openings of sensitive records are logged; a one-time code is required at login; the session closes after a period of inactivity; backups run automatically every day.
Is VERBİS registration required?
VERBİS is Turkey’s Data Controllers’ Registry Information System. The registration obligation is determined by annual employee count, financial balance sheet and the nature of the data processed. Different thresholds apply to data controllers whose main activity is processing special categories of data.
Confirm whether your clinic is obliged using the Authority’s current criteria; thresholds can change over time. If you’re obliged, during registration you declare data categories, retention periods and the measures taken — meaning you should already have done the steps above.
Data inventory: know what’s where
The first step of compliance is making a list.
KVKK compliance doesn’t start with drafting a text; it starts with knowing what you process. Without writing down the data your clinic produces item by item, you can’t decide which measures to take.
Identity, contact, health data, payment information, images and recordings. Health data is handled separately because it’s a special category.
Clinic software, accounting program, phones, email, messaging apps and the paper archive. The place people forget is usually photos on phones.
Doctors, front desk, assistants, accounting and any external service providers. You should be able to write down why each person with access has it.
A retention period should be set for each type of data, and what to do with expired data should be decided in advance.
Labs, the accountant, the software provider. The basis and scope of each transfer should be defined.
Once this list is made, every later question gets easier. What to base your privacy notice on, which screens need permission limits and what’s affected in a breach are all read from this list.
The staff side: confidentiality and permissions
This is the side most often overlooked.
The most discussed topic in data security is technical measures, but in practice a significant share of problems arise on the human side. Leaving the screen open, a shared user account or sharing patient information from a personal phone top the list.
With a shared account, you can’t tell who performed an action. Every employee should have their own account.
Having employees sign a written undertaking on the confidentiality of patient data is a common and appropriate practice.
Not everyone needs access to every screen. Payments for the front desk, clinical records for the doctor — open access only as far as the job requires.
A departing person’s access should be closed the same day. When this step is forgotten, the risk continues quietly.
Patient photos left on personal phones are a common gap. Images should be kept in the clinic’s system.
This risk is greater in specialties that work with images. In hair transplant, medical aesthetics and dermatology clinics, before-and-after photos should stay in the patient file. In psychology and psychiatry practice, who can see session notes should be defined separately. Obstetrics and gynecology records need the same care.
What do you do if there’s a breach?
The plan has to be made before anything happens.
A data breach isn’t only a cyberattack. A lost laptop, an email sent to the wrong person or a stolen backup disk is also a breach. That’s why staying unprepared on the assumption that “it won’t happen to us” is the most common mistake.
According to the Personal Data Protection Board’s principle decision, the data controller notifies the Board as soon as possible and without delay from the moment it learns of the breach; a seventy-two-hour benchmark is used for this period. The individuals concerned must also be notified within the shortest reasonable time. Confirm the current procedures and deadlines from the Authority’s own announcements.
Practical preparation comes down to three points: who decides when an incident occurs should be clear, which records to check should be known in advance, and a draft notification text should be ready. Trying to set these up from scratch in the middle of an incident is what wastes the most time.
Your software provider is a data processor
The responsibility stays with you.
When you use clinic software, patient data is technically processed on the provider’s infrastructure. That doesn’t mean you’ve handed over responsibility: the clinic is the data controller, and the provider is in the position of data processor.
That’s why you need to ask the provider for concrete things. Where the data is stored, whether it’s transferred abroad, the backup routine, whether access logs are kept and what happens to the data when the service ends — all of it should be in writing.
On Clineo’s side, we’ve explained our security approach on the security page and our backup routine on the backups page. We recommend asking every product you evaluate for answers this clear.
What do you do if a patient submits a request?
The response time is set by law.
KVKK doesn’t only require measures from the clinic; it also gives patients rights. A patient can ask to learn whether their data is being processed, to have it corrected or, where the conditions are met, deleted. When such a request comes in, the clinic must respond.
Under the law, the data controller concludes the request as soon as possible and within thirty days at the latest, free of charge. If the action involves an additional cost, a fee from the tariff set by the Board may be charged. Check the Authority’s announcements for the current tariff and procedure.
Where the patient should apply must be stated in the privacy notice. An unclear channel is the most common reason for missing the deadline.
You need to be sure the person making the request really is the person concerned; otherwise the response itself turns into a breach.
The incoming request, the response given and their dates should be on record. In an inspection, it’s the first thing asked for.
Health data may be subject to retention periods under the regulations. A deletion request isn’t automatically accepted in every case; a reasoned response is given.
For this process to work, a single person’s responsibility is enough: who the request goes to and what that person does should be clear. The clock starts the moment the request arrives.
Is KVKK compliance mandatory for clinics?
Are the privacy notice and explicit consent the same thing?
Is keeping patient data in the cloud against KVKK?
How do I limit my clinic staff’s access to patient data?
Do I need to register with VERBİS?
Is separate permission needed for appointment reminder messages?
Is preparing a data inventory mandatory?
Can I keep patient photos on my phone?
Whom do I notify of a data breach?
Can the software provider use the data?
Related pages
Read on.
If you’d like to try it
Move your clinic onto one dashboard.
Try it free for 14 days, with your own patients, in your own way.