Why it is especially sensitive in health tourism
In health tourism operations, patient data brings together identity details, medical history, travel details and payment details. Because this data includes health information, which counts as "special category personal data" under KVKK (Turkey's personal data protection law), it needs more care than ordinary business data.
Informing patients and explicit consent
Clearly telling the patient why their data is used and who it is shared with (the transfer company, the hotel, the clinic team), and getting their explicit consent for this, is one of the most basic steps of the process.
Data minimization and access control
The principle that each team sees only the data it needs to do its own job (for example, the driver sees only the transfer details, not the patient's medical history) is critical for both KVKK compliance and operational security.
Data retention and deletion
Which data is kept, for how long, and how it will be exported or deleted when the contract ends should be a process that is defined in advance and can be tracked.
This is also about choosing software
The infrastructure of the operations software you use (data hosting, access separation, activity logs) is the technical foundation of your KVKK compliance work. So choosing software is not only an efficiency decision. It is also a compliance decision.