Sharing Health Data via WhatsApp: Privacy Notice

Data controller

Assoc. Prof. Dr. Ali Oğul, Medical Oncology Specialist, Mersin University Faculty of Medicine Oncology Hospital, Çiftlikköy Mah. MEÜ Çiftlikköy Campus, 33110 Yenişehir/Mersin, Turkey.

Which of your data is processed?

• Identity: full name, age or year of birth
• Contact: telephone number, WhatsApp profile name
• Health data (special category): diagnosis information, pathology and imaging reports, discharge summary, test results, medicines used
• If a relative applies: the relative’s name and relationship to the patient

For what purposes is it processed?

• Receiving your appointment and second-opinion request
• Planning the clinic day and time and informing you of them
• Preparing for the clinic evaluation (having your file ready on the clinic day)
• Where needed, preparing a tumour board evaluation within the hospital system
• Contacting you about your request

Your data is not used for promotion, advertising or any other purpose.

Legal bases

• Your health data: processed under KVKK Art. 6/3 for the planning and delivery of medical diagnosis, treatment and care services, by a physician who is under a duty of confidentiality.
• Your identity and contact data: under KVKK Art. 5/2, because data processing is necessary to receive your request and to plan your appointment.
• Transfer abroad: see the section “WhatsApp and transfer abroad” below.

WhatsApp and transfer abroad

WhatsApp messages are end-to-end encrypted; however, the servers and systems of the WhatsApp service provider are located abroad. For this reason, the information and documents you send via WhatsApp may be regarded as transferred abroad under KVKK Art. 9.

This transfer is based on your explicit consent, provided that you are informed about the possible risks (KVKK Art. 9/6-a, occasional transfer). Possible risks: the data being subject to foreign law, authorities of that country being able to access information held in the service provider’s systems, and risks related to the security of your device or account.

Your choice: You do not have to send your documents via WhatsApp. You can write only your appointment request on WhatsApp and bring your documents in printed form on the clinic day. You can withdraw your explicit consent at any time.

Before sending documents, we recommend writing this sentence: “I have read the privacy notice; I give my explicit consent to my health documents being sent via WhatsApp and therefore being transferred to servers abroad.”

With whom is your data shared?

Your data may be shared only for diagnosis and treatment purposes and, where necessary, with hospital physicians who are under a duty of confidentiality (e.g. the tumour board), within the hospital system. It is not shared with other third parties unless there is a legal obligation.

How long is it kept?

Documents sent via WhatsApp are kept for as long as necessary for planning your request and for the clinic evaluation, and are deleted after that period. Your medical records opened at the hospital are kept in the hospital system for the periods set out in the relevant legislation.

Your rights under KVKK Art. 11

• To learn whether your personal data is processed and, if it is, to request information
• To learn the purpose of processing and whether the data is used in line with that purpose
• To know the third parties to whom the data is transferred, in Turkey or abroad
• To request correction if the data is incomplete or incorrectly processed
• To request deletion or destruction within the conditions of KVKK Art. 7
• To request that correction, deletion or destruction be notified to the third parties to whom the data was transferred
• To object to an outcome against you resulting from analysis exclusively by automated systems
• To claim compensation if you suffer damage due to unlawful processing

How to apply

You can send your requests regarding your rights in writing, together with information verifying your identity, to: Assoc. Prof. Dr. Ali Oğul, Mersin University Faculty of Medicine Oncology Hospital, Çiftlikköy Mah. MEÜ Çiftlikköy Campus, 33110 Yenişehir/Mersin, Turkey. Your request will be answered free of charge within 30 days at the latest (KVKK Art. 13).

Recommendations for safe sharing

• Send your documents only to +90 530 250 54 85; do not share them in group chats.
• Cover information that is not needed for the evaluation, such as the national identity number.
• Send only the documents requested; bring imaging CDs (DICOM) on the clinic day.
• In an emergency, do not wait for a WhatsApp message; call 112.