Definition
KVKK is Turkey's Personal Data Protection Law (Law No. 6698). It sets the rules for collecting, storing, transferring and deleting personal data in Turkey. Health data is defined as a "special category" of personal data and is subject to stricter conditions.
The law places obligations on data controllers covering transparency notices, explicit consent where required, purpose limitation and proportionality, appropriate security measures and transfers abroad.
Why it matters for clinics
Clinics in Turkey that treat international patients process photos, medical history and identity details. Keeping that data on personal phones and scattered spreadsheets creates both security and compliance risks. Storing it in one system with role-based access is the foundation of compliance. Always consult a legal professional for advice on your specific situation.
Example
A clinic in Istanbul sets roles and permissions so that each agent sees only the patients assigned to them. Patient photos are saved to the patient record rather than personal phones, and access is removed the same day an agent leaves.