Privacy and Photo Confidentiality in Women’s Health Tourism

Short answer: The protection of your sensitive medical information and Before/After photos should not be left solely to a clinic’s verbal assurances. The healthcare provider in Turkey, acting as the data controller or an authorized health tourism organization, should clearly explain what data it will collect, for what purposes, for how long, and with whom it will share the data. It should also obtain appropriate consent for examination and photography procedures.

However, assurances of absolute confidentiality or that there is definitely no risk are not realistic from a legal or technical perspective. Before making a decision, review your rights under the Turkish Personal Data Protection Law (KVKK) and, where applicable, the GDPR, as well as the limits on photo use and the provisions of the written agreement.

Privacy and sensitive data during women’s examinations

Health information collected during gynecological examinations, fertility assessments, breast or genital procedures, cosmetic surgery, and similar services may generally qualify as special-category or sensitive personal data. Medical history, imaging results, surgical notes, laboratory reports, and examination photos should be assessed within this scope.

You may request that only people necessary for your care be present in the examination room. For a safe process, the roles of the doctor, nurse, interpreter, companion, and staff involved in photography should be explained in advance; the interpreter should be subject to confidentiality obligations; and the presence of a companion should depend on your consent.

Do KVKK and GDPR mean the same thing?

KVKK is the main regulation governing the processing of personal data in Turkey. The GDPR may apply in certain situations connected with the European Union or European Economic Area, such as when services are offered to people located in Europe or their behavior is monitored. Which regulation applies, and to what extent, depends on the structure of the organization involved, how the service is provided, and whether data is transferred.

For this reason, a clinic stating that it is GDPR-compliant or subject to KVKK is not, by itself, sufficient evidence. Ask for written answers to the following questions: Who is the data controller, what legal basis is being used, where is the data stored, is it transferred abroad, and which channel should be used to submit a request?

Separate and explicit consent for Before/After photos

Even if your entire face is not visible, Before/After photos may be linked to your identity through details such as tattoos, scars, body areas, birthmarks, jewelry, dates, or file numbers. Even when these photos are used only as part of your treatment records, they require a sensitive data security approach. Using them on a website, social media, or in advertising materials is a separate purpose.

Your consent to photography required for examination and treatment should not automatically mean that you consent to the publication of the photo for promotional purposes. Where possible, the clinic should present the following purposes separately:

• Medical records: Diagnosis, planning, preoperative assessment, and follow-up.
• Communication between doctors: Consultation or a second medical opinion.
• Education: Professional presentations or educational materials with identifying information removed.
• Promotion: Website, social media, brochures, advertisements, or campaign content.
• Portfolio and references: Public sharing of Before/After results.

Refusing one of these options should not negatively affect your access to medical care. However, the clinic should separately explain whether photography is necessary for treatment planning in certain clinical procedures. Before signing, ask whether the photo will include your face, voice, tattoo, or any other identifying details.

Privacy checks you can perform before choosing a clinic

In your initial correspondence, ask for specific documentation and process details rather than general assurances. The following checklist may help you make a more informed decision when traveling to Turkey from another country:

• Verify through official channels that the organization has the required authorization and registration to conduct health tourism activities in Turkey.
• Request the data controller’s full legal name, contact channel, and information on how personal data requests can be submitted.
• Request the KVKK privacy notice and, where necessary, the GDPR privacy notice before treatment, in a language you can understand.
• Obtain written clarification on whether photography is for medical records, education, or promotion.
• Check whether there is a separate consent box or signature section for sharing Before/After photos.
• Ask whether faces, eyes, voices, tattoos, birthmarks, or other identifying features will be removed or obscured.
• Find out who can access the data and what roles are held by doctors, nurses, interpreters, call center staff, and external service providers.
• Obtain written information about the data retention period, deletion or anonymization policy, and how you can withdraw your consent.
• Ask whether the data will be transferred to cloud systems, analytics services, or parent companies outside Turkey.
• Determine in advance whom to contact and through which official channel if a data breach or accidental disclosure occurs.

How can you clearly establish your boundaries in the examination room?

Before the examination, clearly state whether you consent to photography, who may be present in the room, and how interpreting support will be provided. You may refuse to allow someone you do not want to remain in the room, request an explanation of the procedure, and ask for a short break when necessary.

For examinations involving intimate areas, a professional approach, the use of a screen or private space, appropriate covering, exposure of only the necessary area, and an explanation before the procedure are important. These details may vary according to the clinic’s protocol, so it is safer to ask about them in writing before your appointment.

International data transfers and online follow-up

If your treatment started in Turkey will continue through online follow-up after you return home, ask which platforms will store reports, photos, video consultations, and messaging records. Access-controlled systems are preferable to personal email accounts, publicly accessible messaging groups, or file-sharing links with unclear security.

If your data needs to be transferred to a clinic in Europe, an insurance provider, or another healthcare professional, the purpose, scope, and legal basis of the transfer should be explained. Since transfer rules may change over time, verify the current requirements with the relevant data controller and through official authorities’ channels.

Important points about consent, withdrawal, and complaints

Do not sign a consent form in a language you do not understand. Ask for an explanation in your native language or in a language provided to you, and remember that the interpreter’s role is limited to translation; they should not make legal or medical decisions on your behalf.

If you want to withdraw permission for the use of photos for promotional purposes, ask in advance how this can be done. The extent to which a withdrawal request can apply to previously printed materials, posts shared by third parties, or search engine caches may depend on the specific circumstances and the contract. For this reason, making your decision before publication offers greater protection.

Important warning: This page does not constitute legal advice. KVKK, the GDPR, healthcare legislation, and the contract you sign should be assessed together. Rather than assuming a definite outcome regarding payment, photo publication, data deletion, or compensation, obtain written confirmation and, when necessary, seek the current guidance of the relevant official authority or an independent legal professional.

Three critical questions to ask before making a decision

• Will my Before/After photos be kept only in my medical file, or may they also be used on the website and social media?
• How is access to information limited for the interpreter, companion, and clinic staff during the examination?
• After I return to my country, where will the photos and reports used for online follow-up be stored, and when will they be deleted or anonymized?