Community
Digital Health Data Under Turkish Law: Who Controls Our Most Sensitive Information?
Editor
Imagine checking your smartwatch after a restless night. It has recorded your heart rate, sleep
patterns and physical activity. Now imagine that a hospital uses a patient’s medical images in an
advertisement. These situations may seem unrelated, but they raise a similar question: who can
use our health data, and for what purpose?
As healthcare becomes increasingly digital, health data is collected and processed not only by
hospitals and doctors, but also by mobile applications, wearable devices and technology companies.
While these developments may improve healthcare services, they also create new challenges for
privacy and data protection.
Under Turkish law, health data is classified as a special category of personal data under Law No.
6698 on the Protection of Personal Data (the “KVKK”). This means that its processing is subject to
specific legal conditions. But how does this protection work in practice?
Why Is Health Data Different?
A diagnosis, medical image, prescription or treatment history can reveal deeply private aspects of a
person’s life. As Alçın explains, health data covers more than an existing illness: it can also include
information about a person’s physical or mental health and the healthcare services they receive.
In the digital world, such information may be generated continuously through medical records,
laboratory results, mobile apps and wearable devices. The real concern is not just how sensitive this
information is, but who can access it and what they can do with it.
Does Processing Health Data Always Require Explicit Consent?
The answer is no—but that does not mean health data can be used freely.
Following the amendments introduced by Law No. 7499 in 2024, Article 6 of the KVKK allows
special-category personal data, including health data, to be processed under certain legal conditions
without explicit consent.
For example, health data may be processed without explicit consent when it is necessary for medical
diagnosis or treatment and the processing is carried out by persons under an obligation of
confidentiality or by authorised institutions and organisations. Other legal grounds may apply in
different circumstances, including where processing is necessary to establish, exercise or protect a
legal right.
The key point is that consent is not the only possible legal basis. But whenever another basis is
relied upon, the relevant conditions, general data protection principles and necessary safeguards
must still be respected.
When a Hospital Uses Patient Data for Advertising
1
In Decision No. 2023/787, the Personal Data Protection Board examined a private hospital’s use of
patients’ health data and images for advertising and promotional purposes. Although consent forms
had been obtained, the Board concluded that consent did not make the use lawful in the
circumstances, given the restrictions applicable to private hospitals.
The Board imposed an administrative fine of TRY 250,000 and ordered the cessation and destruction
of the relevant data.
This case illustrates why the purpose of processing matters. A patient may provide health
information to receive medical care, but that does not automatically mean the information can also
be used in advertising. Consent to one use of personal data should not be treated as
blanket permission for every other use.
Who Can Access an Electronic Health Record?
Electronic medical records make it easier for healthcare professionals to access information needed
for treatment. However, digital access also raises questions about who should be permitted to view a
patient’s records.
As Kurt Konca and Badur point out, access to personal health data raises specific legal concerns
because of the sensitive nature of the information and the rules governing its processing and
disclosure.
An attorney’s request for a client’s medical records raises a different question: does holding a power
of attorney automatically entitle the attorney to access that information?
Article 10 of the Regulation on Personal Health Data previously addressed this issue. It required a
specific provision in the power of attorney demonstrating the client’s explicit consent to the
processing and transfer of special-category personal data, rather than relying on a general power of
attorney alone. The provision was repealed by an amendment published on 3 December 2025.
Following the repeal, the specific requirement for an explicit-consent clause in the power of attorney
no longer applies under this Regulation. Attorneys’ access to their clients’ health data must instead
be assessed under the Attorneyship Law, the KVKK and other applicable legislation.
The same principle applies within healthcare organisations: access to medical records should be
limited to those who need the information for legitimate professional purposes.
Can Health Data Be Shared With Third Parties?
Health data may sometimes need to be transferred to another person, institution or public authority.
However, the transfer must have a legal basis and must comply with the applicable data protection
requirements.
Decision No. 2023/1578 provides a practical example. A medical centre sent a patient’s treatment
records to a family court in connection with divorce proceedings. The patient complained that highly
private information, including therapy records, had been disclosed without adequate protection.
The Board concluded that the transfer to the court was based on Article 221 of the Code of Civil
Procedure (Law No. 6100), which concerns the production of documents held by third parties, and
2
Article 8(3) of the KVKK, which preserves provisions on data transfers contained in other laws.
However, the Board separately reminded the medical centre of its obligation to comply with the
safeguards set out in its Decision No. 2018/10, including choosing transfer methods that respect
confidentiality.
The distinction is important: the Board did not conclude that the medical centre had
committed a data security breach merely because the records were transferred. It found a
legal basis for the transfer while separately emphasising the safeguards that must be followed. The
subsequent handling of the records by the court was assessed separately.
The case shows that having a legal obligation to disclose information does not remove the obligation
to handle it carefully.
What About Health Apps and Wearable Devices?
A smartwatch may record sleep patterns, heart rate and activity levels, while a mobile application
may collect information about medication, menstrual cycles or other aspects of health.
As Akkurt’s analysis of health data shared through mobile applications highlights, digital
healthcare creates legal questions that extend beyond the traditional relationship between a doctor
and a patient.
The relevant questions include who collects the information, why it is collected, what legal basis
supports the processing and whether the data is shared with third parties. Information collected to
provide a health-related service should not automatically be assumed to be available for unrelated
commercial purposes.
The same questions become particularly important when technology companies use health-related
information for analytics or other secondary purposes.
Can Health Data Be Used for Artificial Intelligence?
AI can help healthcare providers identify patterns, support diagnoses and improve medical services.
But there is an important distinction between data being useful for AI and its use being legally
permitted.
For example, information collected through a health app for one purpose cannot automatically be
reused to train or develop an AI system for another. Organisations must consider the legal basis for
the new processing, whether the proposed use is compatible with the original purpose and what
safeguards are required.
The question is not simply what AI can do with health data. It is whether the organisation is legally
entitled to use that data in the first place.
What Happens If Health Data Is Exposed?
The disclosure of medical information may have consequences beyond the loss of privacy. A medical
record could reveal a diagnosis, mental health history or other information that may affect a
3
person’s personal or professional life.
Article 12 of the KVKK requires data controllers to take appropriate technical and administrative
measures to ensure data security. Depending on the circumstances, these measures may include
access restrictions, authorisation controls, logging, encryption and employee training.
As the Board’s decision concerning the transfer of medical records demonstrates, security
safeguards remain relevant even where the underlying transfer has a legal basis.
What Can Patients Do?
Article 11 of the KVKK grants data subjects several rights, including the right to learn whether their
personal data is being processed, request information about the processing, learn its purpose and
identify the recipients to whom the data is transferred.
These rights are particularly relevant when health information is stored across multiple digital
systems. Individuals may not always know who can access their data or whether it is being used for
a purpose beyond the one they expected.
Understanding these rights is a first step towards asking more informed questions about how
personal health information is handled.
Who Controls Your Digital Health Data?
A smartwatch recording your sleep, a hospital storing your medical records and an AI system
analysing health information may seem like three separate situations. Yet all raise the same
fundamental issue: how can we benefit from digital healthcare without losing control over
our most private information?
Turkish law provides specific protections for health data, but those protections depend on how the
law is applied in practice. A valid legal basis, clear purpose, appropriate access controls and secure
data handling all matter.
As digital healthcare continues to develop, the challenge is not simply to collect more data or build
better technology. It is to ensure that innovation does not come at the expense of the individual
behind the data.
Sources
Ayşe Aslı Alçın, “Türk Hukukunda Kişisel Sağlık Verileri ve İdarenin Kişisel Sağlık Verilerini Koruma Yükümlülüğü,”
Türkiye Adalet Akademisi Dergisi, 2022.
https://dergipark.org.tr/tr/pub/taad/article/1140182
Nesibe Kurt Konca & Emel Badur, “Avukatın Müvekkilinin Kişisel Sağlık Verilerine Erişimine İlişkin Değerlendirmeler,”
Selçuk Üniversitesi Hukuk Fakültesi Dergisi, 2023.
https://dergipark.org.tr/tr/pub/suhfd/article/1238540
Sinan Sami Akkurt, “Kişisel Sağlık Verilerinin İşlenmesine ve COVID-19 Pandemisi Sürecinde Mobil Uygulamalarla
Paylaşılmasına Hukukî Bir Bakış,” İstanbul Ticaret Üniversitesi Sosyal Bilimler Dergisi, 2020.
https://dergipark.org.tr/tr/pub/iticusbe/article/752760
4
Merve Ayşegül Kulular İbrahim & Elife Filiz Gökdaş, “Büyük Veri ve Mobil Uygulamalarda İşlenen Kişisel Verilerin
(Sağlık Verileri) Hukuka Uygunluk Sorunu,” Adalet Dergisi, 2024.
https://dergipark.org.tr/tr/pub/adaletdergisi/article/1484072
Personal Data Protection Board, Decision No. 2023/787.
https://www.kvkk.gov.tr/Icerik/7692/2023-787
Personal Data Protection Board, Decision No. 2023/1578.
https://www.kvkk.gov.tr/Icerik/7771/2023-1578
Personal Data Protection Board, Decision No. 2018/10.
https://www.kvkk.gov.tr/Icerik/4110/2018-10
Personal Data Protection Authority, “Guideline on the Processing of Special Categories of Personal Data.”
https://www.kvkk.gov.tr/Icerik/8184/Ozel-Nitelikli-Kisisel-Verilerin-Islenmesine-Iliskin-Rehber
Regulation on Personal Health Data, consolidated text.
https://mevzuat.gov.tr/File/GeneratePdf?mevzuatNo=32610&mevzuatTur=KurumVeKurulusYonetmeligi&mevzuatTertip
=5
Law No. 6698 on the Protection of Personal Data (KVKK), particularly Articles 4, 6, 8, 11 and 12.
https://www.mevzuat.gov.tr/mevzuat?MevzuatNo=6698&MevzuatTur=1&MevzuatTertip=5
Law No. 7499, amending the provisions of the KVKK concerning special categories of personal data and international
transfers.
https://www.mevzuat.gov.tr/mevzuat?MevzuatNo=7499&MevzuatTur=1&MevzuatTertip=5
patterns and physical activity. Now imagine that a hospital uses a patient’s medical images in an
advertisement. These situations may seem unrelated, but they raise a similar question: who can
use our health data, and for what purpose?
As healthcare becomes increasingly digital, health data is collected and processed not only by
hospitals and doctors, but also by mobile applications, wearable devices and technology companies.
While these developments may improve healthcare services, they also create new challenges for
privacy and data protection.
Under Turkish law, health data is classified as a special category of personal data under Law No.
6698 on the Protection of Personal Data (the “KVKK”). This means that its processing is subject to
specific legal conditions. But how does this protection work in practice?
Why Is Health Data Different?
A diagnosis, medical image, prescription or treatment history can reveal deeply private aspects of a
person’s life. As Alçın explains, health data covers more than an existing illness: it can also include
information about a person’s physical or mental health and the healthcare services they receive.
In the digital world, such information may be generated continuously through medical records,
laboratory results, mobile apps and wearable devices. The real concern is not just how sensitive this
information is, but who can access it and what they can do with it.
Does Processing Health Data Always Require Explicit Consent?
The answer is no—but that does not mean health data can be used freely.
Following the amendments introduced by Law No. 7499 in 2024, Article 6 of the KVKK allows
special-category personal data, including health data, to be processed under certain legal conditions
without explicit consent.
For example, health data may be processed without explicit consent when it is necessary for medical
diagnosis or treatment and the processing is carried out by persons under an obligation of
confidentiality or by authorised institutions and organisations. Other legal grounds may apply in
different circumstances, including where processing is necessary to establish, exercise or protect a
legal right.
The key point is that consent is not the only possible legal basis. But whenever another basis is
relied upon, the relevant conditions, general data protection principles and necessary safeguards
must still be respected.
When a Hospital Uses Patient Data for Advertising
1
In Decision No. 2023/787, the Personal Data Protection Board examined a private hospital’s use of
patients’ health data and images for advertising and promotional purposes. Although consent forms
had been obtained, the Board concluded that consent did not make the use lawful in the
circumstances, given the restrictions applicable to private hospitals.
The Board imposed an administrative fine of TRY 250,000 and ordered the cessation and destruction
of the relevant data.
This case illustrates why the purpose of processing matters. A patient may provide health
information to receive medical care, but that does not automatically mean the information can also
be used in advertising. Consent to one use of personal data should not be treated as
blanket permission for every other use.
Who Can Access an Electronic Health Record?
Electronic medical records make it easier for healthcare professionals to access information needed
for treatment. However, digital access also raises questions about who should be permitted to view a
patient’s records.
As Kurt Konca and Badur point out, access to personal health data raises specific legal concerns
because of the sensitive nature of the information and the rules governing its processing and
disclosure.
An attorney’s request for a client’s medical records raises a different question: does holding a power
of attorney automatically entitle the attorney to access that information?
Article 10 of the Regulation on Personal Health Data previously addressed this issue. It required a
specific provision in the power of attorney demonstrating the client’s explicit consent to the
processing and transfer of special-category personal data, rather than relying on a general power of
attorney alone. The provision was repealed by an amendment published on 3 December 2025.
Following the repeal, the specific requirement for an explicit-consent clause in the power of attorney
no longer applies under this Regulation. Attorneys’ access to their clients’ health data must instead
be assessed under the Attorneyship Law, the KVKK and other applicable legislation.
The same principle applies within healthcare organisations: access to medical records should be
limited to those who need the information for legitimate professional purposes.
Can Health Data Be Shared With Third Parties?
Health data may sometimes need to be transferred to another person, institution or public authority.
However, the transfer must have a legal basis and must comply with the applicable data protection
requirements.
Decision No. 2023/1578 provides a practical example. A medical centre sent a patient’s treatment
records to a family court in connection with divorce proceedings. The patient complained that highly
private information, including therapy records, had been disclosed without adequate protection.
The Board concluded that the transfer to the court was based on Article 221 of the Code of Civil
Procedure (Law No. 6100), which concerns the production of documents held by third parties, and
2
Article 8(3) of the KVKK, which preserves provisions on data transfers contained in other laws.
However, the Board separately reminded the medical centre of its obligation to comply with the
safeguards set out in its Decision No. 2018/10, including choosing transfer methods that respect
confidentiality.
The distinction is important: the Board did not conclude that the medical centre had
committed a data security breach merely because the records were transferred. It found a
legal basis for the transfer while separately emphasising the safeguards that must be followed. The
subsequent handling of the records by the court was assessed separately.
The case shows that having a legal obligation to disclose information does not remove the obligation
to handle it carefully.
What About Health Apps and Wearable Devices?
A smartwatch may record sleep patterns, heart rate and activity levels, while a mobile application
may collect information about medication, menstrual cycles or other aspects of health.
As Akkurt’s analysis of health data shared through mobile applications highlights, digital
healthcare creates legal questions that extend beyond the traditional relationship between a doctor
and a patient.
The relevant questions include who collects the information, why it is collected, what legal basis
supports the processing and whether the data is shared with third parties. Information collected to
provide a health-related service should not automatically be assumed to be available for unrelated
commercial purposes.
The same questions become particularly important when technology companies use health-related
information for analytics or other secondary purposes.
Can Health Data Be Used for Artificial Intelligence?
AI can help healthcare providers identify patterns, support diagnoses and improve medical services.
But there is an important distinction between data being useful for AI and its use being legally
permitted.
For example, information collected through a health app for one purpose cannot automatically be
reused to train or develop an AI system for another. Organisations must consider the legal basis for
the new processing, whether the proposed use is compatible with the original purpose and what
safeguards are required.
The question is not simply what AI can do with health data. It is whether the organisation is legally
entitled to use that data in the first place.
What Happens If Health Data Is Exposed?
The disclosure of medical information may have consequences beyond the loss of privacy. A medical
record could reveal a diagnosis, mental health history or other information that may affect a
3
person’s personal or professional life.
Article 12 of the KVKK requires data controllers to take appropriate technical and administrative
measures to ensure data security. Depending on the circumstances, these measures may include
access restrictions, authorisation controls, logging, encryption and employee training.
As the Board’s decision concerning the transfer of medical records demonstrates, security
safeguards remain relevant even where the underlying transfer has a legal basis.
What Can Patients Do?
Article 11 of the KVKK grants data subjects several rights, including the right to learn whether their
personal data is being processed, request information about the processing, learn its purpose and
identify the recipients to whom the data is transferred.
These rights are particularly relevant when health information is stored across multiple digital
systems. Individuals may not always know who can access their data or whether it is being used for
a purpose beyond the one they expected.
Understanding these rights is a first step towards asking more informed questions about how
personal health information is handled.
Who Controls Your Digital Health Data?
A smartwatch recording your sleep, a hospital storing your medical records and an AI system
analysing health information may seem like three separate situations. Yet all raise the same
fundamental issue: how can we benefit from digital healthcare without losing control over
our most private information?
Turkish law provides specific protections for health data, but those protections depend on how the
law is applied in practice. A valid legal basis, clear purpose, appropriate access controls and secure
data handling all matter.
As digital healthcare continues to develop, the challenge is not simply to collect more data or build
better technology. It is to ensure that innovation does not come at the expense of the individual
behind the data.
Sources
Ayşe Aslı Alçın, “Türk Hukukunda Kişisel Sağlık Verileri ve İdarenin Kişisel Sağlık Verilerini Koruma Yükümlülüğü,”
Türkiye Adalet Akademisi Dergisi, 2022.
https://dergipark.org.tr/tr/pub/taad/article/1140182
Nesibe Kurt Konca & Emel Badur, “Avukatın Müvekkilinin Kişisel Sağlık Verilerine Erişimine İlişkin Değerlendirmeler,”
Selçuk Üniversitesi Hukuk Fakültesi Dergisi, 2023.
https://dergipark.org.tr/tr/pub/suhfd/article/1238540
Sinan Sami Akkurt, “Kişisel Sağlık Verilerinin İşlenmesine ve COVID-19 Pandemisi Sürecinde Mobil Uygulamalarla
Paylaşılmasına Hukukî Bir Bakış,” İstanbul Ticaret Üniversitesi Sosyal Bilimler Dergisi, 2020.
https://dergipark.org.tr/tr/pub/iticusbe/article/752760
4
Merve Ayşegül Kulular İbrahim & Elife Filiz Gökdaş, “Büyük Veri ve Mobil Uygulamalarda İşlenen Kişisel Verilerin
(Sağlık Verileri) Hukuka Uygunluk Sorunu,” Adalet Dergisi, 2024.
https://dergipark.org.tr/tr/pub/adaletdergisi/article/1484072
Personal Data Protection Board, Decision No. 2023/787.
https://www.kvkk.gov.tr/Icerik/7692/2023-787
Personal Data Protection Board, Decision No. 2023/1578.
https://www.kvkk.gov.tr/Icerik/7771/2023-1578
Personal Data Protection Board, Decision No. 2018/10.
https://www.kvkk.gov.tr/Icerik/4110/2018-10
Personal Data Protection Authority, “Guideline on the Processing of Special Categories of Personal Data.”
https://www.kvkk.gov.tr/Icerik/8184/Ozel-Nitelikli-Kisisel-Verilerin-Islenmesine-Iliskin-Rehber
Regulation on Personal Health Data, consolidated text.
https://mevzuat.gov.tr/File/GeneratePdf?mevzuatNo=32610&mevzuatTur=KurumVeKurulusYonetmeligi&mevzuatTertip
=5
Law No. 6698 on the Protection of Personal Data (KVKK), particularly Articles 4, 6, 8, 11 and 12.
https://www.mevzuat.gov.tr/mevzuat?MevzuatNo=6698&MevzuatTur=1&MevzuatTertip=5
Law No. 7499, amending the provisions of the KVKK concerning special categories of personal data and international
transfers.
https://www.mevzuat.gov.tr/mevzuat?MevzuatNo=7499&MevzuatTur=1&MevzuatTertip=5
Published in Community