Taking, storing and sharing patient photos: KVKK and promotion rules
Published 23 October 2026Reviewed 23 October 20266 min read
On this page
The difference between a treatment photo and a promotion photo
A person's image taken in the context of health care counts as health data and falls under the special category rules. A photo taken to carry out treatment and kept in the patient file is handled under the health care condition in Article 6(3) of the law. Using the same photo on social media, on a website or in a brochure is a new purpose; it needs separate explicit consent, and the health-services promotion regulation also comes into play.
Article 7(1)(b) of the Regulation on Promotion and Information Activities in Health Services (12 November 2025, no. 33075) requires explicit consent for using patient visuals and, according to the Ministry's FAQ, this consent is taken on the “Visual Content Recording and Processing Consent Form” in Annex 1; the Patient Rights Regulation must also be followed.
Is consent enough? Board decision 2023/787
In decision 2023/787 of 11 May 2023, a hospital had taken explicit consent to use patients' photos and videos in advertising. The Board found this unlawful because Article 60 of the Private Hospitals Regulation forbids promotion and the processing was disproportionate; it fined the hospital 250,000 TL under Article 18(1)(b) read with Article 12(1) and ordered the processing to stop and the material to be destroyed.
The lesson is that consent does not legitimise processing another rule forbids. First ask whether the promotion itself is lawful, then ask about consent. The regulation applied in that decision is an older version; check the current text.
Before-and-after sharing: the conditions the Ministry states
According to the Ministry's FAQ, although advertising is banned domestically, sharing before-and-after visuals is possible on these conditions:
- Taken in the same setting and with the same technique, with the dates shown.
- Not altered afterwards and not retouched.
- No images taken during the procedure.
- No intimate areas shown, no paid or sponsored distribution, and posted only by the facility or practitioner.
- A real patient of the health professional who shares.
- Interactions such as comments, likes and shares switched off.
- The mandatory warning: “Results may vary from person to person in every surgical or interventional procedure. It is recommended that you get a detailed opinion from your doctor before the procedure.”
How is consent taken, and what happens when it is withdrawn?
According to the Ministry's FAQ, the patient may preview the visual, consent can be withdrawn at any time without conditions, refusing changes neither treatment nor fee, a withdrawal is processed immediately, and no payment, discount or gift may be given for consent. International health tourism facilities may share patient stories on a foreign-facing platform with documented explicit consent.
Personal data violations are handled separately under Law No. 6698. When consent is withdrawn you need to take the photos down, delete the copies and tell the person; if a patient makes an erasure request, the 30-day period in Article 13 of the law runs.
Why is the phone gallery a risk?
- Automatic cloud backup
- What happensThe patient photo goes to the staff member's personal cloud
- MeasureUpload to the recorded channel; switch off personal backup.
- Shared device
- What happensFamily or others see the gallery
- MeasureA separate business device and screen lock.
- Sending through a messaging app
- What happensA copy stays on a third party's servers
- MeasureAttach the photo to the record as a file.
- A staff member leaves
- What happensPhotos stay on their phone
- MeasureA rule on transfer and deletion at departure.
- Lost or stolen device
- What happensSpecial category data falls into other hands; Article 12 notification duty
- MeasureRemote wipe, encrypted device.
Step by step: set up your photo practice
Separate the purposes
The treatment record, patient assessment and promotion are separate purposes, each with its own ground.
Check the promotion is lawful
Domestically, check the health promotion regulation; on a foreign-facing platform, the authorisation and language conditions.
Take consent in writing
The Annex 1 consent form or an equivalent; make clear what will be used, where and for how long.
Keep withdrawal easy
Tell the patient that withdrawing is easy and act on a request immediately.
Keep files in a recorded place
Not on the phone; limit access by role.
Have a deletion plan
Write down which copies are deleted and how when consent is withdrawn, the period ends or a request arrives.
How it is done in Klinikbook
Receive the photo through the portal
In the intake form guided photos come from the patient through the portal; files are private, open through expiring links and are virus scanned.
Take photo consent separately
The compliance centre has a photo and video consent template, offered in the portal at /{slug}/photo-consent. In the Türkiye pack the consent text refers to the health promotion regulation and its consent form.
Keep it apart from the intake consent
The explicit consent for intake is not consent for promotion; photo and marketing consents are separate records, tied to the workspace's published text version.
Process withdrawal as a data request
Choosing objection withdraws marketing and photo consents; an erasure request is tracked against the 30-day period.
Narrow access
Field-level encryption, visibility per role, two-step sign-in and the activity log limit and show who reaches the photo files.
The patient uploads guided photos in the portal
Frequently asked questions
If the patient consents, can I share their before-and-after photos?
Consent is not enough. Domestically the Ministry looks for the conditions above (same setting, dates, no retouching, interactions off, the mandatory warning). In 2023/787 the Board did not treat consent as sufficient.
Do I need separate consent for a photo I take for treatment?
A photo taken to carry out treatment and kept in the patient file is handled under the health care condition. A different purpose such as promotion needs separate explicit consent.
What if the patient withdraws consent?
According to the Ministry, consent can be withdrawn unconditionally and the request is processed immediately. Take the post down, delete the copies and tell the patient.
The patient sent me the photo on WhatsApp. What should I do?
Move it into the record, delete it from the thread and the phone gallery, and use a portal link in future. See the WhatsApp guide for details.
Can I publish foreign patients' stories on my website?
According to the Ministry's FAQ, international health tourism facilities may publish patient stories on a separate foreign-facing platform with documented explicit consent. The authorisation certificate and foreign-language conditions apply.
What penalty is possible?
The promotion regulation provides tiered administrative fines, suspension and cancellation of the certificate; personal data violations are handled separately under Law No. 6698. In 2023/787 the fine was 250,000 TL; amounts are revalued every year.
Sources
- Regulation on Promotion and Information Activities in Health Services (Turkish) — Official Gazette, 12 November 2025, no. 33075
- Promotion in health services: frequently asked questions (Turkish) — General Directorate of Health Services, Department of Inspection and Evaluation, November 2025
- Board decision summary 2023/787 (Turkish) — Personal Data Protection Authority (KVKK), 11 May 2023
- Law No. 6698 on the Protection of Personal Data, Articles 6, 12, 13 and 18 (Turkish text) — Mevzuat Bilgi Sistemi, Official Gazette, 7 April 2016
Manage photos in a recorded channel, with consent
Guided photos, separate consent records and withdrawal in one place.
Related reading
30-day free trial
Try Klinikbook with your own team
Every feature is open for 30 days, and no card is needed to start.