Yes, in general, you may ask the clinic to delete, destroy, or anonymize your personal data. However, this does not mean that every record in your treatment file will be removed immediately and permanently. Some data may need to be retained for specific periods to document the provision of healthcare, preserve medical records, meet accounting obligations, resolve disputes, or comply with applicable regulations.

Why may it not always be possible to delete medical records?

During treatment, a clinic may process your identification details, communications, medical history, test results, images, consent forms, procedure notes, and payment information for different purposes. These records are not all subject to the same legal basis or retention period.

Your deletion request will be assessed based on whether the data is still needed for its original processing purpose, whether processing is based on your explicit consent or another legal basis, and whether the clinic has an obligation to retain it. In particular, records showing how medical decisions were made may be of a nature that cannot be removed solely at the patient’s request.

For this reason, a clinic may delete or anonymize some data while continuing to retain other records. You should generally expect the response to explain which categories of data are being retained and why, as well as which records have been deleted; however, the scope of this explanation may vary depending on your specific request and the applicable legislation.

The framework for deletion and destruction requests under the KVKK

With respect to the data controller in Turkey, your right to request the deletion, destruction, or anonymization of your personal data may be assessed under the applicable personal data protection rules. The clinic, hospital, or health tourism intermediary should be able to explain which data it processes and for what purposes.

Deletion means removing data from relevant systems in a way that makes it unavailable for use; destruction means eliminating access to and use of the data through technical or administrative methods; and anonymization means making the data impossible to associate with an identified or identifiable individual. The method used will depend on the systems in which the data is held and the reason for retaining it.

If your deletion request is refused, it is important that the refusal not be dismissed with a general statement. The reason why the medical record must be retained, the data categories that will be kept, and the intended retention approach should be explained as far as possible. This content does not constitute legal advice; particularly where there is a dispute, an allegation of serious harm, or an international data transfer, you should also seek guidance from official sources or a qualified legal professional.

Data inventory and written request before applying

Rather than framing your request simply as the deletion of your entire treatment file, ask clearly which data is being retained and for what purposes. This allows medical records, marketing communications, passport copies, photographs, payment documents, and correspondence with an intermediary organization to be assessed separately.

  • Identify the data controller: You may need to send your request not only to the intermediary that referred you to the clinic, but also to the clinic or hospital actually processing the data. You can also ask the intermediary which data it retains.
  • List the data categories: Specify identification, contact, health, images or photographs that may contain biometric characteristics, payment, passport, and travel information under separate headings.
  • State the request clearly: Ask for the data to be deleted or, if this is not possible, destroyed or anonymized, and request an explanation of the legal and operational reasons for retaining any records that cannot be deleted.
  • Separate marketing use: Also request in writing the withdrawal of any permission you gave for photographs, videos, testimonials, before-and-after images, or social media posts. State that retaining the treatment file and using data for promotional purposes are separate matters.
  • Choose a secure response channel: Identity verification may be required. If you are asked to send a passport or identity document, ask why it is needed and how long it will be used, without sharing more information than necessary.
  • Keep evidence of your application: Retain the submission date, the content of your request, and the response you receive. If the clinic forwards your request to another department, add the forwarding information to your records.

What should you clarify about records that cannot be deleted?

If the clinic states that it is required to retain certain records, ask it to provide details under the following headings: what data will be retained, for what purpose, who will have access, how long it will be stored, and what action will be taken at the end of that period. In particular, ask whether medical images and notes are being kept for active use, in an archive, or solely to meet a possible legal obligation.

You should also maintain realistic expectations about backup systems. A record deleted from an active system may remain in technical backups for a certain period. The clinic can explain how long this period is and what measures are in place to prevent backups from being reused during normal operations. The clinic may not be required to guarantee that every backup will be immediately and physically destroyed.

If anonymization is performed, removing only your name and email address may not always be sufficient. It may be useful to ask whether combining dates, images, procedure details, or rare medical characteristics could create a risk of re-identification.

How does living abroad affect the situation?

Your relationship with a clinic providing services in Turkey is not automatically governed by a single legal regime simply because you live abroad. Turkish data protection rules remain relevant to the clinic. In addition, the rules of your country, or of a country within the European Union, may become relevant depending on whether the data is processed there, services are offered to you, or the nature of the international transfer.

If you live in the European Union, whether the General Data Protection Regulation, known as the GDPR, applies to the specific situation should be assessed separately. The nature of the clinic’s activities directed at people in Europe, where and how the data is processed, and the roles of the clinic and intermediary organization may all be relevant. The clinic or advisor should not state that the GDPR definitely applies or definitely does not apply without reviewing the relevant documents.

In your request, you may ask in writing who the data controller in Turkey is, which countries the data is transferred to, and whether intermediaries abroad have access to the system. If you do not receive a response, check the current application requirements of the competent data protection authority in your country of residence and the relevant official channels in Turkey.

Risks to consider

Do not confuse a promise of permanent deletion with withdrawing marketing consent. A clinic may stop advertising communications and discontinue the use of promotional images while continuing to retain certain parts of your medical file. It is better to obtain written confirmation of these two actions separately.

In addition, submitting a deletion request immediately before an ongoing complaint or potential compensation claim begins may raise further questions about the preservation of records. If you have concerns about a complication, fee dispute, or consent form relating to your treatment, consider obtaining a secure copy of the necessary documents and seeking independent legal advice before attempting to remove the entire file.

If the clinic gives you only verbal assurances, it is important to request in writing the scope of the deletion and which data will continue to be retained. Issues concerning refunds, compensation, revision procedures, or liability are not automatically resolved as part of the same request; they must be assessed separately based on the contract and the specific circumstances.

Questions you may wish to ask about this topic

  • How can I find out which categories of my personal data are being retained by a clinic in Turkey?
  • How can I withdraw my consent for my medical photographs and treatment results to be used for promotional purposes?
  • How can I check whether my personal health data is being transferred between Turkey and the country where I live?