How Are Your Photos and Medical Data Protected in Turkey?

Short answer: Your before-and-after photos and medical data are generally treated as sensitive personal data in Turkey and must be processed for specific purposes such as planning, providing, or monitoring healthcare services. Using photos on a website, social media, or in advertising materials is a different purpose from providing treatment; this use should require separate, clear, and preferably written consent.

To understand the actual scope of protection, do not rely solely on the clinic’s verbal explanation. Review in writing who the data controller is, which data is processed for what purposes, how long it will be stored, with whom it may be shared, and whether it will be transferred abroad.

The Status of Before-and-After Photos as Health Data

Photos showing your face, body, wound area, teeth, or another anatomical region may make you personally identifiable. If a photo is taken for before-and-after comparison, clinical assessment, filing, or follow-up, it may also contain information about your health status. Therefore, a photo should not automatically be assumed to be merely promotional material.

If a photo is processed in a way that identifies or verifies your identity, it may qualify as biometric data; this assessment depends on the method used and the purpose of processing. Copies of passports, flight information, laboratory results, imaging records, prescription details, surgical notes, and medical history may also trigger the protection requirements applicable to sensitive data when linked to your identity.

In Turkey, the Personal Data Protection Law (KVKK) is important in relation to the processing of personal data. However, merely mentioning KVKK does not automatically mean that your data is secure. You should also examine which legal basis is being used, whether the purpose has been clearly defined, whether more data than necessary is being collected, and whether access is restricted.

Roles of the Data Controller, Intermediary, and Clinic

During the medical tourism process in Turkey, the same information may pass through several organizations. A clinic or hospital may keep medical records; a medical tourism intermediary may access certain information for translation, transportation, appointment, and communication services; and the staff member or external service provider taking the photographs may have a separate role.

These organizations do not all have the same authority. Use written documents to determine whether the organization managing your treatment is the data controller, whether the intermediary acts only on instructions, and which service providers receive your data. The responsibilities of the organizations may vary according to the specific contracts and the data-processing activities actually carried out.

The privacy notice provided to you should clearly explain the company or institution’s legal name, the purposes of data processing, the categories of data collected, recipient groups, the retention approach, and the channel for submitting applications. If the notice uses only general language and does not provide information about the use of photos in advertising, transfers abroad, or third-party access, ask for clarification.

Your Checklist for Photos and Medical Records

Before signing anything or sending photos, check the following points in writing:

• Data collected: List which facial photos, body photos, imaging records, laboratory results, discharge summaries, passport details, and contact information are requested. Ask why data that does not appear necessary for treatment is being requested.
• Purpose of processing: Distinguish whether the data will be used only for medical assessment and follow-up, or also for education, scientific research, websites, social media, or advertising.
• Separate consents: Do not combine processing required to receive healthcare with promotional use of photos in a single mandatory consent box. Clarify in writing beforehand whether refusing advertising or publication consent will affect your access to treatment.
• Identity masking: Ask whether methods such as covering the face, blurring the eyes, or cropping the photo to show only the relevant area will be used. Masking reduces risk, but does not by itself guarantee complete anonymity.
• Access authorization: Find out which doctors, nurses, interpreters, call-center staff, intermediaries, or external service providers can access your photos and file. Ask whether access is limited to what is necessary for their duties.
• Retention period: Ask in writing how long the data will be retained, according to which criteria the period is determined, and how deletion or anonymization will be handled after treatment.
• Transfers abroad: Check whether your data will be sent to cloud systems, email services, intermediaries, or parent companies outside Turkey. Ask which legal mechanism supports the transfer and which countries are involved.
• Copies and corrections: Confirm how you can learn which data about you is being held, request correction of inaccurate records, or object to specific uses.
• Breach notifications: Ask how you and the relevant authorities will be informed in the event of unauthorized access, loss, or incorrect disclosure. Find out whether the organization has a written security and incident-management policy.

Transfer and Storage Risks for Data Sent from Abroad

Before coming to Turkey, you may send your passport, medical reports, and photos by email, messaging applications, or an online form. At this stage, the data may reach not only the clinic but also the email provider, file-sharing system, or the intermediary’s technical infrastructure.

For this reason, avoid sending files to a general messaging group that is not intended for personal data. Ask whether the organization has a secure upload channel, who can download the files, and how long the link will remain active. Before sharing documents such as passports and medical reports, confirm exactly which information the organization actually needs, without including unnecessary sections.

If your data is transferred to a system outside Turkey, you may exercise your right to learn the relevant transfer conditions, the recipient country, and the recipient’s role. Because international data-transfer rules may change over time, check the data controller’s current official privacy notice and, where necessary, the official sources of Turkey’s Personal Data Protection Authority.

Important: Advertising Consent Is Not the Same as Treatment Consent

Allowing a before-and-after photo to be taken should not automatically mean that you have allowed the photo to be published on social media or used in advertising. Consider separately whether the photo will show your face openly or in anonymized form, and whether it will be used only on channels in Turkey or on international platforms.

It may not always be possible to remove a post completely from the internet; you may not have full control over screenshots, reposts, or search-engine caches. Therefore, before granting publication consent, put the channel, duration, geographic scope, visibility of your identity, and withdrawal conditions in writing.

Withdrawing your consent may not mean that all processing carried out lawfully in the past will automatically be erased. The retention of clinic records, the safety of ongoing treatment, or applicable retention obligations may need to be assessed separately; ask for this distinction to be explained clearly.

Your Rights and Preparation Before Applying

You may ask the data controller which data about you is being processed, the purpose of its use, the recipient groups with which it is shared, and how it is retained. The options for correcting inaccurate or incomplete data, requesting deletion or anonymization where legally permitted, objecting to a specific processing activity, and requesting an explanation of automated evaluation may vary depending on the circumstances.

Before submitting a request, keep the contract, privacy notice, consent forms, email correspondence, and the dates of the files you shared. You may first need to use the official application channel specified by the relevant data controller; if you receive no response or the response is inadequate, review the administrative application routes explained in current official sources.

The information on this page is not legal advice or a definitive assessment of your rights. If you have particular concerns about the use of photos in advertising, transfers of data abroad, breach of contract, or a suspected data breach, it is safer to seek advice based on your specific case from a qualified legal professional in your country and in Turkey.

Related Questions

• How can I check whether my personal data is being transferred abroad while receiving healthcare in Turkey?
• How can I withdraw the consent I gave for a clinic to use my before-and-after photo in advertising in Turkey?
• What avenues can I consider if a clinic or intermediary in Turkey shares my health data without my consent?