The Right to Privacy and Confidentiality in Health Tourism: A Legal Overview Under Turkish Law
As cross-border healthcare services continue to expand, protecting the privacy and confidentiality of health tourists has become a legal and ethical priority. Patients receiving medical treatment abroad often face challenges related to unfamiliar legal systems and the need to share sensitive health data with multiple institutions, including intermediary agencies and healthcare providers.
Under Turkish law, health data is classified as sensitive personal data within the scope of the Law on the Protection of Personal Data No. 6698 ("KVKK"). This classification imposes strict requirements on the collection, processing, and transfer of such data. Unless explicit consent is obtained or legal exceptions apply, the processing of sensitive personal data, including health information, is prohibited.
To further clarify the legal obligations, the Regulation on the Processing of Personal Health Data and Ensuring Privacy outlines detailed principles for data collection, storage, system security, access control, and personnel responsibilities within healthcare institutions. The aim is to ensure full compliance with both privacy standards and data minimization principles.
In addition to these general data protection rules, the new Regulation on International Health Tourism and Tourist Health, which entered into force on April 26, 2025, brought important changes. While this regulation requires healthcare institutions to process personal data in accordance with the KVKK, it lacks specific provisions addressing the role and obligations of intermediary agencies—entities that often serve as the first point of contact for health tourists.
This regulatory gap raises concerns. In practice, intermediary agencies frequently collect and transfer patients' personal and health data to clinics or physicians to obtain service quotations, treatment plans, or medical evaluations—even before the patient formally receives care. As such, even if a patient ultimately chooses not to proceed with treatment, their sensitive personal data may already have been shared across multiple entities, increasing the risk of privacy breaches.
Therefore, ensuring that all parties involved—particularly intermediary agencies, hospitals, and physicians—implement clear and robust data protection protocols is critical. Patients must also be informed in advance about how their data will be used and stored. Since foreign patients may not be familiar with the local legal framework, obtaining legal counsel from firms specialized in health law and data protection law is highly recommended.
In conclusion, while Turkish legislation provides a strong foundation for the protection of health data, greater regulatory clarity and practical safeguards are needed—particularly in the context of intermediary institutions. For Turkey to maintain its reputation as a growing hub for international health tourism, aligning practice with data protection standards will remain a key challenge and responsibility.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
