How Are Your Breast Health Data Protected Under GDPR and KVKK?

Short answer: You can request robust data protection measures under the GDPR and KVKK for your breast examinations, mammograms, ultrasounds, MRI scans, biopsy results, and pathology reports in Turkey; however, no clinic or intermediary can provide an absolute and unconditional guarantee of confidentiality. To assess your security, review the institution’s Ministry of Health–approved Health Tourism Authorization Certificate, the data controller, explicit consent forms, its policy on international data transfers, and the written notification procedure in the event of a breach.

Information about your breast health, pathology reports, and medical images concerns not only medical decisions but also your privacy and personal life. Therefore, before accepting a treatment plan, find out in clear language who will process your data, for what purposes, for how long, and to which countries it may be transferred.

The Sensitive Nature of Breast Health Records and the Privacy Framework

Breast images, biopsy results, pathology reports, genetic test results, previous treatment history, and your contact details fall within the scope of health data. These are treated as sensitive personal data requiring a higher level of protection than general contact information.

In Turkey, the KVKK may apply, while the GDPR may become relevant in situations connected with the European Union. Whether the GDPR applies depends on factors such as your country of residence, the service provider’s activities in Europe, transfers of data to the European Economic Area, and how the service relationship is established. Therefore, do not consider the statement “we are GDPR compliant” sufficient; ask in writing which processing activities are based on which legal grounds.

• Your data should be processed only to the extent necessary for diagnosis, treatment, medical assessment, billing, and legal obligations.
• Your pathology report or images should not be used for promotional, educational, advertising, or social media purposes without a clear and specific purpose.
• Additional explanation and an appropriate legal basis should be required for unnecessary access, downloading, copying, or transfer to another clinic.
• The retention period for images and reports may be linked to the institution’s policy and applicable health-record obligations; request this period in writing in advance.

Security Indicators to Check When Choosing a Clinic or Hospital in Turkey

Verify through official channels whether the institution where the procedure will be performed holds a Health Tourism Authorization Certificate issued by the Ministry of Health. This certificate alone does not mean that all data-security risks have been eliminated; however, it can help you assess whether the institution is subject to certain administrative frameworks for providing international healthcare services.

For breast surgery, biopsy, or pathology assessment, choose a fully equipped hospital and physicians working in the relevant specialties. In particular, ask the institution to explain who manages its digital pathology system, image archive, and laboratory reporting process.

Key Documents You Can Request in Writing

• The official name and contact details of the data controller or relevant institution.
• The KVKK information notice and, where necessary, the explicit consent form.
• If the GDPR applies, a privacy notice explaining the purposes of data processing and data-subject rights.
• Information about where pathology specimens, paraffin blocks, slides, and digital images will be stored.
• Information stating whether your data will be transferred outside Turkey and, if so, identifying the recipient organization and purpose of the transfer.
• The contact channel to use in the event of suspected unauthorized access or a data breach, and an explanation of how notification will be handled.

A Secure Sharing Plan for Pathology Results and Breast Images

Before sending your pathology report or mammography images as an email attachment, ask whether the institution uses a secure portal, encrypted file sharing, or a verified health information system. Ordinary email may not be the preferred method, particularly when reports and images can be accessed by multiple people.

Files should not contain your passport number, full address, unnecessary contact details, or information belonging to other people. Share identity-verification documents only when the medical or administrative necessity of the request has been explained; ask whether unnecessary fields can be redacted.

If the material is to be sent to another laboratory for a second pathology opinion, clarify the type and amount of material to be sent. Paraffin blocks, slides, and digital images may have different storage and transport requirements; obtain written confirmation of which material will be sent for what purpose and whether it will be returned once the assessment is complete.

Practical Questions to Ask Under the KVKK and GDPR

Requesting clear written answers to the following questions before your initial consultation can help you make a more informed privacy decision:

• Who is the data controller for my data, and how are responsibilities divided between the intermediary organization and the clinic?
• Which staff members may access my pathology results, mammography images, and surgical notes?
• Will my data be shared only with the treatment team, or will a translator, insurance company, laboratory, or another service provider also have access?
• Will my data be stored on servers outside Turkey or at healthcare institutions in other countries?
• Which legal and technical safeguards are used for international data transfers?
• Will my photographs, pathology images, or medical history be used for promotional, educational, or scientific purposes?
• For which activities can I withdraw my consent, and how would withdrawal affect my treatment process?
• How can I request correction of my data, a copy providing access to it, or an explanation of the processing activities?

International Data Transfers and Interpreter Support

In health tourism, your data may be shared between the hospital in Turkey and a physician in your country. If such sharing is planned, you should be told which reports will be transferred, who the recipient institution is, why the transfer is considered necessary for diagnosis or follow-up, and how long the data will be retained.

Privacy is also important when interpreter support is provided. Ask why the interpreter’s participation in the clinical consultation is necessary, whether the interpreter is subject to confidentiality obligations, and whether your medical documents will be permanently provided to the interpreter. Where possible, request that only the necessary pages be shared and obtain written confirmation of how additional copies will be destroyed after translation is completed.

Rights under the GDPR or application rights under the KVKK may be subject to different procedures and limitations depending on the circumstances. Review the relevant institution’s current privacy notice for each request involving access, correction, erasure, restriction of processing, or objection; rather than relying on promises of specific deadlines or outcomes, confirm the details through the institution’s official channels.

Privacy Risks to Consider

Absolute statements such as “completely anonymous,” “no third party can access your data,” or “your data will definitely never leave the country” should be assessed carefully if they are not supported by a written contract and privacy policy. Treatment coordination, laboratory services, insurance procedures, technical infrastructure, and legal obligations may make certain data sharing necessary.

Check whether you are giving separate and explicit consent for your photograph, before-and-after surgical images, or pathology findings to be used for promotional purposes. Signing documents necessary for treatment does not necessarily mean that you have automatically authorized advertising or social media use; these purposes should be clearly distinguished in the relevant texts.

Do not sign a consent or privacy document prepared in a language you do not understand. Request an explanation in your native language or in a language provided to you that you fully understand; make sure that the translation covers the entire document you will sign, rather than being merely an oral summary.

Your Privacy Checklist Before Applying

• Verify the institution’s Health Tourism Authorization Certificate and official name.
• Obtain a written description of the division of roles between the data controller, intermediary organization, and laboratory.
• Read the KVKK information notice and, if applicable, the GDPR privacy notice before treatment.
• Ask where pathology material will be stored, who will have access, and how long it will be retained.
• Request written answers about international data transfers, secure file sharing, and third-party access.
• Assess permissions for promotional, educational, and scientific use separately from consent for medical procedures.
• Record the channel to contact in the event of a suspected data breach, incorrect report, or unauthorized disclosure.
• Keep signed copies of documents relating to payment, treatment, data use, and image sharing.

Related Questions

• What permissions should I request when sending my pathology report to another laboratory in Turkey for a second opinion?
• How can I limit the clinic’s use of my before-and-after breast surgery photographs?
• Which institution should I contact to request access to or correction of my data under the KVKK or GDPR?

This information is provided for general informational purposes and does not replace legal advice. In your specific circumstances, before signing the treatment agreement and privacy documents, it is advisable to obtain an up-to-date assessment from the relevant institution’s data protection officer or an independent legal professional.