A free example privacy notice and explicit consent text for health data, written for clinics and health-tourism agencies under Türkiye's data protection law (KVKK), to fill in and adapt with your lawyer. It reflects the 2024 amendments by Law No. 7499 and is not legal advice.
On this page
What's inside?
- Notes on use: what to fill in, which option suits whom, keeping notice and consent apart, keeping records
- The privacy notice: controller, data, purposes, legal grounds, collection, recipients, retention, rights and requests
- Two options for health data: article 6(3)(e) for healthcare providers, explicit consent (article 6(3)(a)) for agencies and others that do not provide care
- The explicit consent text, with separate boxes for processing, sharing and transfer abroad, and room to describe the risks
- Signature lines, including one for a parent or guardian
- Sources: KVKK, Law No. 7499 and the communiqué on the obligation to inform
Who is it for, and why?
Every clinic or health-tourism agency collecting patients' contact details, health information, photos and documents must inform them under article 10 of KVKK, Türkiye's Law No. 6698: who the controller is, the purposes, the recipients, how and on what legal basis data is collected, and the person's rights.
Health data is a special category. Since Law No. 7499 took effect on 1 June 2024, it may be processed with explicit consent or under another listed condition, such as diagnosis and treatment by persons bound by professional secrecy. The amendment also replaced the rules on transfers abroad.
Use it in 3 steps
Fill it in and keep your option
Replace the bracketed fields, such as your registered name, address and retention period, and keep the health data option that fits your organisation.
Review it with your lawyer
Have the legal grounds, transfers and retention periods checked against how you work.
Publish, ask for consent separately, keep records
Show the notice wherever you collect data, ask for explicit consent in a separate text, and record who received which version and when.
Klinikbook does this for you
Klinikbook's compliance centre has country packs for Türkiye and the EU and UK. Privacy notice, consent, photo and marketing consent templates come filled in with your details; you edit them and publish versions on the patient portal.
Consents are recorded, data requests are handled in the centre and your retention policy runs daily. You publish the texts as data controller; Klinikbook gives no legal advice.
Frequently asked questions
Can I use this text as it is?
No. It is an example to adapt to the way you work, with a lawyer. It is not legal advice.
Do I need explicit consent if I am a healthcare provider?
Article 6(3) of KVKK lists other conditions besides explicit consent, including medical diagnosis, treatment and care by persons bound by professional secrecy. Decide with your lawyer which one applies.
Can the privacy notice and the consent be one document?
Under the communiqué on the obligation to inform, where processing relies on consent, informing and obtaining consent are done separately, so the template keeps them as two texts on separate pages.
Does it cover patients from abroad?
It is written under KVKK for businesses in Türkiye, including those with patients from abroad. The patient's own country's rules may also apply, and a business in the EU or UK needs a GDPR notice instead. Ask your lawyer.
Sources
- Law No. 6698 on the Protection of Personal Data (English translation; the Turkish text prevails) — Personal Data Protection Authority (KVKK)
- Law No. 7499 amending the Criminal Procedure Code and certain other laws (No. 32487, in Turkish) — Resmî Gazete, 12 March 2024
- Communiqué on the procedures and principles of the obligation to inform (No. 30356, in Turkish) — Resmî Gazete, 10 March 2018
Related reading
30-day free trial
Try Klinikbook with your own team
Every feature is open for 30 days, and no card is needed to start.