KVKK for clinics: privacy notices and explicit consent
Published 19 October 2026Reviewed 19 October 20267 min read
On this page
What role does a clinic play under KVKK?
The data controller decides why and how personal data is processed, so a clinic, practice or hospital collecting patients' enquiry, appointment, treatment and payment details for its own work is the controller. Your software provider is a data processor, handling the data on your behalf and on your authority.
Under Article 12 the controller must take the necessary technical and organisational measures and shares that duty with anyone processing data on its behalf. So sign a data processing agreement with your provider and ask which measures it takes.
What is the difference between a privacy notice and explicit consent?
- Legal basis
- Privacy noticeArticle 10 and the Communiqué
- Explicit consent textArticles 3, 5 and 6
- Purpose
- Privacy noticeTells people who processes their data, why, on what ground and who receives it
- Explicit consent textA free agreement to one specific activity
- When is it needed?
- Privacy noticeFor all processing, before it starts
- Explicit consent textOnly when the processing rests on explicit consent
- Statement asked for
- Privacy noticeI have read and understood
- Explicit consent textI give, or do not give, my explicit consent
- Can it be withdrawn?
- Privacy noticeThere is nothing to withdraw
- Explicit consent textYes, at any time, with effect from then on
Why does health data have its own rules?
Article 6 of KVKK, Türkiye's Law No. 6698, classes health data as special category data and allows it to be processed only on one of the grounds it lists. Law No. 7499 rewrote those grounds from 1 June 2024.
For clinics the key ground is Article 6(3)(e): people under a duty of confidentiality, and authorised institutions, may process health data where necessary for purposes such as diagnosis, treatment and care. Explicit consent, an express provision in law and necessity for protecting a right are grounds too. Decide with your lawyer which ground covers activities such as pre-treatment assessment or using photos in promotion.
Which safeguards does health data need?
Special category data also needs the adequate measures the Board sets (Article 6(4)). Board decision 2018/10 lists measures such as:
- Staff training and confidentiality agreements.
- Access rights that are reviewed regularly.
- Encryption.
- Logs showing who accessed the data and when.
- At least two-factor authentication for remote access.
What should a privacy notice cover?
Article 10 and the Communiqué require at least the following. For rights, a reference to ‘your rights under Article 11 of the Law’ is enough.
- The controller: the clinic's legal name, address and contact details.
- Specific, explicit and legitimate purposes of processing.
- The legal ground for each purpose under Article 5 or 6.
- Who may receive the data and why, including any transfer abroad.
- How the data is collected: forms, phone, e-mail, in person.
- The person's rights and how to exercise them.
When and how is explicit consent obtained?
The law defines explicit consent as specific, informed and freely given. The Authority treats blanket consent to ‘all data processing activities’ as invalid. Consent can be given electronically, but the controller must be able to prove it, and the person may withdraw it at any time.
In a clinic it mostly comes up for activities beyond the treatment itself, such as using patient photos in promotion. Marketing messages also fall under Law No. 6563 on the Regulation of Electronic Commerce and need the recipient's prior approval, kept separate from the notice and from any health-data consent.
A KVKK checklist for clinics
- Map every channel data comes in through: forms, phone, WhatsApp, e-mail, intake, photos, appointments, payments.
- Show the privacy notice on each channel before collecting data, and record that it was read.
- Decide your legal ground for health data; if it is explicit consent, use a separate text.
- Get separate consent for promotional photo use and approval for marketing messages.
- Set retention periods and delete or anonymise data when they end (Article 7).
- Answer people's requests within 30 days at the latest (Article 13).
- Sign data processing agreements, limit access by role and check your VERBİS position.
Do you need to register with VERBİS?
Under Article 16, controllers register with the Data Controllers' Registry (VERBİS) before processing, unless the Board exempts them. Under Decision No. 2025/1572, a controller whose main activity is processing special category data is exempt only with fewer than 10 employees a year and an annual balance sheet total below 10 million Turkish lira.
The Authority's announcement of 12 January 2026 adds that exceeding either threshold triggers registration, and that only headcount counts for controllers without balance-sheet accounts. The exemption covers registration only; every other duty remains.
Which mistakes do clinics make most?
- Merging the notice and explicit consent into one text or one tick box.
- Asking people to confirm the notice with ‘I have read and accept’ or ‘I give my explicit consent’.
- Copying another organisation's texts without adapting them.
- Vague wording such as ‘processed under Articles 5 and 6 of the Law’ that names no purpose or ground.
- Claiming a transfer abroad that does not happen, or omitting one that does.
How do you do it in Klinikbook?
Klinikbook gives no legal advice. It helps you prepare and publish your texts and records what people decided.
Start from the templates
The compliance centre's Türkiye pack provides the privacy notice and the health-data consent text as separate templates filled in with your clinic's details. Both are published when you create your workspace.
Publish versions
Edit a text and publish it as a new version. The patient portal shows the current one, and earlier versions stay readable.
Ask for consent separately
Lead forms and the booking page link to your notice; the intake asks for explicit consent on its own. Each decision is stored on the person's consent history with the text's version.
Answer requests on time
Track requests for a copy, correction, erasure, restriction or objection against their deadline. You decide, Klinikbook carries it out and the person is notified.
Klinikbook's servers are in Germany for now, which the Türkiye pack states in your privacy notice as a transfer abroad under Article 9.
Frequently asked questions
Are a privacy notice and explicit consent the same thing?
No. A privacy notice informs people whenever their data is processed and needs no agreement. Explicit consent is collected only when processing rests on it, with a separate text and statement.
Does a clinic need explicit consent to treat a patient?
Article 6(3)(e) lets people under a duty of confidentiality and authorised institutions process health data where necessary for diagnosis and treatment. Decide with a lawyer which activities rest on it and which on consent.
How quickly must I answer a data request?
As soon as possible and within 30 days at most (Article 13), free unless the request involves a separate cost.
Does my clinic have to register with VERBİS?
A controller whose main activity is processing health data is exempt only with fewer than 10 employees and an annual balance sheet total below 10 million lira. Check your figures with your accountant.
Can I send promotional messages to my patients?
Under Law No. 6563, commercial electronic messages need the recipient's prior approval. Collect it separately and check the health promotion rules too.
Sources
- Law No. 6698 on the Protection of Personal Data, consolidated text (in Turkish) — Mevzuat Bilgi Sistemi
- Law No. 7499 amending the Code of Criminal Procedure and certain laws (in Turkish) — Resmî Gazete, 12 March 2024
- Communiqué on the procedures for fulfilling the obligation to inform (in Turkish) — Resmî Gazete, 10 March 2018
- Principle decision 2026/347 on keeping consent and privacy notice texts separate (in Turkish) — Resmî Gazete, 24 March 2026
- Board decision 2025/1572 on the VERBİS exemption (in Turkish) — Resmî Gazete, 1 October 2025
- Announcement on applying decision 2025/1572 (in Turkish) — Personal Data Protection Authority, 12 January 2026
- The obligation to inform (in Turkish) — Personal Data Protection Authority
- Points to note when obtaining explicit consent (in Turkish) — Personal Data Protection Authority
- Guide to processing special category personal data (in Turkish) — Personal Data Protection Authority, February 2025
- Guide to transferring personal data abroad (in Turkish) — Personal Data Protection Authority, January 2025
- Law No. 6563 on the Regulation of Electronic Commerce (in Turkish) — Mevzuat Bilgi Sistemi
Related reading
30-day free trial
Try Klinikbook with your own team
Every feature is open for 30 days, and no card is needed to start.