Veterinary clinics treat animals, but the records belong to people: the pet owner's name, phone, address, payment history and contact preferences all fall under Turkey's Personal Data Protection Law No. 6698 (KVKK). This article is a general compliance checklist for a clinic, not legal advice. For your clinic's specific situation, contracts and registration thresholds, consult a lawyer. Clinic management software such as VetBis supports the routine, but it does not make you compliant by itself.
Which data in a clinic is personal data?
- The owner's name, surname, phone, e-mail, address
- Invoice and payment records, customer account movements
- Appointment and communication history, message preferences
- ID number (do not ask for it unless needed)
- CCTV and waiting-room footage
- The animal's clinical record: on its own it is information about the animal, but a record linked to its owner should be protected together with the owner's data
Do not store card numbers or CVV codes in the clinic system. Use an authorised payment institution for collections.
Key terms in clinic language
| Term | What it means in a clinic |
|---|---|
| Data controller | The party that decides why and how data is processed: usually the clinic |
| Data processor | A party that processes data on your behalf: software, hosting or messaging providers |
| Privacy notice | Telling people who processes their data, for what purpose, who it is shared with and on what legal basis |
| Explicit consent | Consent given for a specific matter, based on information and expressed freely |
| VERBIS | The Data Controllers' Registry Information System, for controllers with a registration duty |
| Commercial electronic message | Marketing SMS, e-mail and messages; a separate consent topic |
Explicit consent is not the basis for every processing activity. The law also recognises grounds such as performing a contract or complying with a legal obligation. Agree with your adviser which ground applies to which data; a "collect consent for everything" approach is often unnecessary and wrong.
Eight steps for a clinic
1. Map what you collect and why
Name and phone are needed. A national ID number is not needed in most exams. Collect only what you need (data minimisation). Next to every field on your registration form write "what do we use this for?" and delete the fields with no answer.
2. Provide the privacy notice
Owners should learn who processes their data, for what purpose and for how long. Present the notice at registration and record that you did. The printed notice at reception and the consent record in the software should be consistent.
3. Collect explicit consent separately
Marketing SMS, e-mail or messages require explicit consent and commercial-message permission. The consent should be recorded with its date and be withdrawable. Do not make consent a precondition for treatment. Agree with your adviser which messages are service notices (an appointment confirmation, say) and which are commercial messages. For channel-based permissions, see the WhatsApp article.
4. Put security measures in place
- A separate account and strong password per user; no shared logins
- Role-based access: reception should not see everything
- An audit trail: who changed which record
- Regular backups, and a test that they can be restored
- Closing a departing employee's account the same day
- Screen locks and logging out on shared computers
5. Define retention and deletion
Keeping records forever is also a risk. Tie each data type to a written routine: how long it is kept and how it is deleted, destroyed or anonymised afterwards. For medical and financial records, confirm the retention periods set by the relevant legislation with your adviser.
6. Document your service providers
List every party that touches your data: software, cloud hosting, SMS or e-mail providers. For each one, check how data is processed, where it is held and what the contract says.
7. Prepare for requests and breaches
Owners can ask about their data and request correction or deletion. Know who receives such a request, who answers and how it will be answered within the period the law sets. Decide in advance who handles a data breach and how and when the Board must be notified; verify current periods on kvkk.gov.tr.
8. Check your VERBIS obligation
The duty to register with the Data Controllers' Registry depends on thresholds for headcount and annual balance sheet, and on the field of activity. The Personal Data Protection Board can change these thresholds, so verify the current position on VERBIS and the authority's website. Even if you are not required to register, your inventory and privacy-notice duties continue.
What lands in the record
- Consent written to the owner card with its date
- Email consent saved as its own line
- No marketing consent: left off campaign lists
Live flowMarketing refused 4 / 4
Steps
- 1Empty recordThe owner card has no consent yet.
- 2Appointment reminder consentConsent given for the SMS channel.
- 3Email consentEmail consent added for notices.
- 4Marketing refusedNo promotional consent; the record is kept.
Sending channels are in preparation; the consent record is kept today.
How software supports compliance
Software does not deliver compliance on its own, but it makes some things easier: role-based access, an audit trail, per-owner contact permissions and consent records. In VetBis the owner card holds the KVKK consent and contact permissions. Details are on the security and KVKK pages. Sending messages through external providers is still being prepared; recording a permission does not mean a message has been sent. For multi-site setups, separating permissions is covered in the multi-branch article.
Common mistakes
- Working at reception with a shared username and password.
- Asking everyone for an ID number "just in case".
- Taking consent only verbally, or not keeping the record.
- Merging service notices and marketing messages into one permission.
- Leaving a departed employee's account open.
- Taking backups but never testing a restore.
Checklist
- Collected data fields listed and justified
- Privacy notice ready and presented
- Explicit consent and contact permission recorded with dates
- User and role permissions reviewed
- Backup routine defined and a restore tested
- Retention and deletion periods written down
- Service providers listed
- Request and breach process defined
- VERBIS obligation checked
Frequently asked questions
Is an animal's record personal data? Information about the animal alone is not personal data, but once it is linked to the owner it should be protected together.
Do I need explicit consent for every message? No; service notices and marketing messages are assessed separately. Clarify with your adviser which falls where.
Does a small clinic have to register with VERBIS? The obligation depends on thresholds and field of activity and can change. Check the current position on the authority's website.
Does using software make me KVKK compliant? No. Software helps with access, records and permission tracking; notices, retention periods and processes remain the clinic's responsibility.
Conclusion
KVKK compliance is a daily working routine, not a one-off document. The two most critical areas are consent records and access permissions; start there, then add retention periods and the provider list. This article is general information and does not replace legal advice.