Foodlex-Produktratgeber
KVKK for dietitians: how to handle clients' health data
Dietitians record their clients' health conditions, medications, allergies and measurements as part of the job. Under Turkey's Personal Data Protection Law No. 6698 (KVKK) this is special-category personal data with stricter rules. This guide summarises, in plain language, the parts of the law that matter for a dietitian's practice, including the 2024 amendments.
Zuletzt aktualisiert:
1. Health data is special-category personal data
Article 6 of KVKK defines data about a person's health as special-category personal data. A client's conditions, medications, allergies, lab results and body measurements all fall within it. Contact details such as name, phone and email are personal data too.
Processing special-category data is prohibited in principle; it is allowed when one of the conditions listed in the law applies and the adequate measures set by the Personal Data Protection Board are in place.
Collect only the data your work needs. Recording information you will not use increases the data you have to protect.
2. On what grounds can health data be processed?
Under Article 6(3), as amended by Law No. 7499 of 2 March 2024, special-category data may be processed if the person has given explicit consent, if it is expressly provided for by law, or if it is necessary for protecting public health, preventive medicine, medical diagnosis, treatment and care by persons under a duty of confidentiality or by authorised institutions; the article lists further conditions too.
Which condition applies to your practice is a legal assessment. In practice many dietitians also obtain and record explicit consent.
Explicit consent is consent that is specific, informed and freely given. Do not make the service conditional on consent, and state that consent can be withdrawn.
3. The duty to inform
Under Article 10, when collecting data you must tell the client: who the data controller is, why the data will be processed, to whom and why it may be transferred, how and on what legal basis it is collected, and the client's rights under Article 11.
The privacy notice is a separate duty from explicit consent: even where you do not need consent, you must still inform. Keeping the two texts separate is good practice.
Keep a record of when and how you gave the notice; you may need to show it if a request is made.
4. Cloud software and transfers abroad
If the software holding your client data, or its service providers, are outside Turkey, that is a transfer abroad. Under Article 9 as amended in 2024, data may be transferred to a country with an adequacy decision; without one, an appropriate safeguard such as a standard contract is required. A standard contract must be notified to the Authority within five business days of signing.
Transfers abroad based on explicit consent are now provided for only as incidental, that is non-recurring, transfers.
Ask your software provider where data is held, which service providers receive it, and which safeguard is used.
5. Data security and breach notification
The data controller must take the technical and administrative measures needed to prevent unlawful processing and access and to protect the data (Article 12). If a software company processes data on your behalf, you are jointly responsible with it for those measures.
If data is obtained by others unlawfully, the person concerned and the Board must be notified as soon as possible.
A strong password, two-step verification and a screen lock on your devices are the most effective first measures, even for a small practice.
6. Clients' rights and retention
Clients have rights such as learning whether their data is processed, requesting information, asking for correction or deletion and knowing to whom the data was transferred (Article 11). When the reasons for processing no longer exist, data is deleted, destroyed or anonymised (Article 7).
Decide in advance how long you will keep data after your work with a client ends and how you will delete it.
Check the Personal Data Protection Authority's current decisions for your Data Controllers' Registry (VERBİS) obligation and any exemptions.
What Foodlex provides
In Foodlex the client's explicit consent is recorded with date and IP address. Health conditions, medications, allergies, email and phone are stored encrypted, and servers are in Amsterdam (EU). Each client's data can be exported, and you can use two-step verification on your account. Foodlex's service providers and transfer information are set out in its KVKK privacy notice.
Software helps you meet your obligations; as data controller, the obligations remain yours.
Häufige Fragen
Does a dietitian have to obtain explicit consent from clients?
Since the 2024 amendment, health data can also be processed on some other grounds listed in KVKK Article 6. Assess with a legal adviser which ground applies to you. The duty to inform applies in every case.
Is a privacy notice the same as explicit consent?
No. The notice is the duty to tell people why and how their data is processed, and it is always required. Explicit consent is the person's freely given approval for a specific processing. They should be presented as separate texts.
Can I keep client data in a cloud service abroad?
Under KVKK Article 9, without an adequacy decision an appropriate safeguard such as a standard contract is required, and a standard contract must be notified to the Authority within five business days. Ask which safeguard your provider uses.