Why do your corneal maps require special protection?
Corneal topography, corneal tomography, pachymetry, keratoconus analyses, ocular biometry and raw image files are not merely ordinary image records. They contain direct medical information about your eye structure, refractive error, corneal thickness and potential treatment options.
When undergoing an evaluation in Türkiye, you can find out in advance who collects your data, how it will be used, how long it will be stored and to which countries it may be transferred. A secure process depends not only on the clinic’s technical equipment, but also on informed consent, access permissions, encryption, record-keeping policies and deletion procedures.
If a healthcare provider intends to use your corneal map for purposes other than diagnosis and treatment planning, that purpose must be explained separately. Uses such as education, scientific research, anonymized statistics, advertising or sharing with third parties should be distinguished from one another, and the necessary legal basis should be clearly stated.
Scope of the data collected
- Corneal topography and tomography results
- Corneal thickness measurements and pachymetry records
- Ocular biometry, refraction and visual acuity measurements
- OCT scans, photographs, videos and raw files from devices
- Identification, passport, contact, travel and billing information
- Previous reports, surgical history and remote follow-up notes
Corneal data security and health tourism standards in Türkiye
It is important to check whether the organization providing health tourism services in Türkiye holds a Health Tourism Authorization Certificate issued by the Ministry of Health. This certificate is not, by itself, proof of compliance with data protection requirements; however, it provides a starting point for confirming that the organization is authorized to provide health tourism services and is subject to certain administrative standards.
The institution you choose should explain whether it acts as a data controller or data processor under KVKK. In its privacy notice, the clinic should clearly explain why it collects the data, the legal basis, its retention approach, the parties to whom the data is transferred and the channels available to you as the data subject.
If you fall within the scope of the GDPR, transfers of data outside the European Union should be examined separately. Since Türkiye is not automatically considered an adequate country under the GDPR, the transfer may need to be supported by standard contractual clauses, appropriate safeguards or another valid legal mechanism.
Technical and administrative controls
- Sending corneal maps over secure connections such as TLS during transfer
- Protecting files stored on servers with appropriate encryption methods
- Role-based access for doctors, optometrists, coordinators and technical staff
- Audit logs showing who accessed which file and when
- Strong passwords, multi-factor authentication and device security
- Backup, disaster recovery and data breach response procedures
- Restrictions on the use of unauthorized email, personal messaging applications or publicly accessible file links
When assessing the experience of Turkish physicians in corneal topography, keratoconus evaluation and screening before refractive surgery, do not rely only on general statements such as the number of cases performed. Ask about the measurement protocol used by the device, how raw data is archived, who approves the report and which clinical findings support the surgical decision.
Sharing your corneal map and the process you should be offered
You may not need to send your entire passport and corneal file at the initial contact. The minimum information required for a preliminary assessment should be identified, and unnecessary identification fields should be masked where possible. Before sending your file, verify the recipient’s official corporate email address, data controller information and secure upload method.
A health tourism package may include VIP transfers, accommodation, interpreter support and initial care coordination. If your companion can stay at a hotel near the hospital and is informed in advance about visitor rules, they can plan low-intensity options, such as a quiet walk in a park or a wellness service, while you rest during your examination or surgical assessment.
The length of your stay in Türkiye for corneal tomography or refractive surgery evaluation may vary depending on whether measurements need to be repeated and whether a procedure will be performed. During the initial examination, the ocular surface, tear film, corneal thickness, pupil characteristics and previous contact lens use may be assessed; a definitive schedule should be established after clinical evaluation.
Safety planning when surgery or a procedure is involved
If a procedure is planned, you may ask about fully equipped hospital conditions, sterilization protocols, emergency response infrastructure and device maintenance and calibration records. For corneal laser treatment or another eye procedure, confirm that your measurement file is matched with the final report and that two-step identity verification is used to prevent the wrong file from being used.
After returning to your country, online follow-up may be conducted through secure video consultations or a clinical portal. The process should specify in writing which data will be shared, whether consultations will be recorded, which healthcare provider you should contact in an emergency and how long follow-up notes will be retained.
How should the cost of privacy compliance be assessed?
KVKK or GDPR compliance is not a separate, standardized treatment fee for a corneal map that is the same at every clinic. Therefore, giving a fixed Türkiye price solely for data security services would be misleading; the price cannot be assessed independently of the scope of examination, imaging, surgery or follow-up services.
| Country | Corneal data and privacy assessment | Pricing approach |
|---|---|---|
| Türkiye | KVKK, health tourism requirements and, where necessary, GDPR transfer safeguards are reviewed together | There is no standalone standard fee; request a written scope and quotation |
| United Kingdom | The UK GDPR and Data Protection Act framework is assessed | Varies according to the clinical service and specialized data consultancy |
| Germany | The GDPR and German data protection practices are taken into account | Varies according to the examination and data processing scope |
| United States | Whether HIPAA applies and the relevant state rules are examined | Varies according to the institution and service model |
A quotation that separately explains imaging, reporting, data transfer, interpretation, online follow-up and storage processes promotes transparency. A very low price is not, by itself, an indication of security, just as a high price does not automatically prove GDPR or KVKK compliance.
Key criteria affecting price and the level of data security
- Physician’s expertise and experience: Clinical experience in corneal topography, keratoconus, refractive surgery suitability and corneal transplant assessment may affect the scope of the report, the need for a second opinion and the intensity of follow-up.
- Technology and methods: The use of tools such as Scheimpflug corneal tomography, Placido disk topography, anterior segment OCT, pachymetry and DICOM-compatible archiving is important for data accuracy and traceability. In addition to asking about the device, you should ask where and how raw files are stored.
- Clinic location and infrastructure: Centers in Istanbul, Ankara, İzmir or other cities may differ in hospital infrastructure, data center arrangements, interpretation support, secure transfer methods and online follow-up organization. Location alone is not an indicator of quality.
Documents and questions to check before signing
- KVKK privacy notice and, where necessary, explicit consent form
- Information explaining data subject rights under the GDPR
- Details of the data controller, data processor and contact person
- The country, service provider and legal mechanism used for international transfers
- The retention period, deletion process and anonymization procedure for corneal maps
- How and within what timeframe you will be notified in the event of a breach
- The procedure for requesting access to, correction of or a copy of your files, and for submitting an objection
Next steps and critical questions before applying
As a first step, request the clinic’s Health Tourism Authorization Certificate, data controller information and secure file-sharing channel in writing. As a second step, clarify whether your corneal map will be used solely for assessment and whether separate permission is required for research or promotional purposes.
Which server will store my corneal tomography, and for how long?
The country where the server is located, the backup location, the retention period and how a deletion request will be implemented should be explained. If the clinic stores not only the report but also the raw images, this should be stated separately.
What safeguard is used for transferring data to Türkiye under the GDPR?
If standard contractual clauses, explicit consent or another transfer mechanism is used, ask for its name, scope and contact point. A general statement that “your data is secure” does not replace a valid legal mechanism.
What information will be shared during online follow-up after I return to my country?
Video consultation recordings, follow-up notes, new corneal images and communication channels should each be explained separately. It should also be established in advance that online follow-up does not replace an in-person examination in an emergency and which local healthcare service you should contact.
If you do not receive clear answers about data security, encounter an ambiguous consent form or are asked to send your file to a personal messaging account, request further clarification before proceeding. A transparent organization treats privacy questions as a natural part of medical planning.