Healthcare websites: legal limits, KVKK and content rules

Why are healthcare organization websites subject to different rules?

A healthcare website is subject to different rules because healthcare cannot be promoted like a consumer product, and every statement on the website is assessed against the line between promotion and advertising. The Regulation on Promotion and Information Activities in Healthcare Services, published in the Official Gazette on November 12, 2025, prohibits carrying out or commissioning covert or explicit advertising in healthcare provision; it permits only promotion and information complying with specified principles.

The regulation defines advertising as any activity that exceeds the limits of promotion and information to highlight a product, service, person or organization. Posts on social media and websites must follow these principles, and those who create and share noncompliant content are held equally responsible. This means that the agency or designer writing website copy must also know the content rules.

Which regulations apply?

The main regulations affecting a clinic website are the promotion regulation, the relevant licensing regulation for the type of organization and legislation on personal data protection. The key texts are:

• Regulation on Promotion and Information Activities in Healthcare Services (Official Gazette, November 12, 2025, issue 33075): Regulates promotion by healthcare professionals, private healthcare organizations and international health tourism intermediaries. It repealed the previous regulation of 2023; references to the old regulation are deemed to refer to this text.
• Regulation on Private Healthcare Organizations Providing Outpatient Diagnosis and Treatment (Official Gazette, April 19, 2025): Article 26 subjects information and promotion by organizations such as polyclinics, medical centers and private practices to the promotion regulation; Article 27 limits the use of names and specialties online.
• Private Hospitals Regulation: Article 37 subjects hospitals’ information and promotion activities to the same regulation.
• Personal Data Protection Law No. 6698 and the Regulation on Personal Health Data: Determine the conditions for processing health data collected through forms.

The current text of the outpatient diagnosis and treatment regulation can be read at mevzuat.gov.tr . Under Article 27, a healthcare organization cannot use an online name other than the name and title on its license and registered names, and cannot list a specialty not included in its operating permit; this limit is considered when choosing a domain name and website title.

Which information may appear on the website?

The promotion regulation explicitly lists the information permitted for healthcare facilities, and the structure of a healthcare website follows this list: address and contact information, working days and hours, specialties in which patients are accepted, professional and academic titles of employed healthcare professionals, and information that protects and improves health in the area of service. Within this framework, a private practice website may also share the physician’s main and subspecialty qualifications, academic title, and where and when patients are seen.

Physician profiles may include personal information such as training completed, registered certificates, scientific publications, academic awards and association memberships, provided these remain within the specialty stated on the diploma and registered by the Ministry. The regulation also requires the last update date of website information and contact information for reaching the website editor to be clearly stated. These two details are absent from many template websites; they need to be added to the page template from the outset.

What may not appear on the website?

The promotion regulation explicitly prohibits many marketing elements commonly seen on healthcare organization websites. The main elements to exclude when planning website content and design are:

• Advertising-style posts based on expressions of gratitude and satisfaction from patients or relatives; a “patient reviews” page may fall within this scope
• Fee, discount, campaign and promotional information; announcements involving prize draws, gifts or incentives
• Statements about methods not scientifically and clinically proven or not defined by the Ministry
• Specialist titles based on certificates outside the specialties specified by law
• Statements promoting one’s own services at the expense of other organizations or misleading the public
• Promotion creating the impression that a device, product or brand is superior, company or product promotion, and links to these
• Presenting research results or statistics in a way that produces a different impression from the actual findings

This list directly conflicts with common website practices. Customer reviews, price tables and campaign banners considered trust signals in other industries may be subject to sanctions on a healthcare website. For violations, the regulation provides for administrative sanctions and, when necessary, applications to block access.

Visual content: before-and-after photographs and patient images

Patient images may be used only under strict conditions: the patient’s explicit consent must be obtained using the consent form attached to the regulation, the patient must be able to see the image before it is shared, and must be able to withdraw permission at any time. Patients cannot receive payment, discounts or gifts in exchange for permission; it must also be guaranteed that refusing permission will not change their treatment or fees.

Article 7 of the regulation also sets rules for the images themselves. The following conditions are considered when designing website galleries and case pages:

• Images cannot undergo subsequent technological retouching, and misleading makeup cannot be used.
• Before-and-after photographs are taken in the same environment and under the same technical conditions, with procedure and photography dates stated.
• Whether the image depicts an actual patient is stated, and the source is given if the image is taken from elsewhere.
• Images of patients during surgery or an intervention are not shared.
• Posts are closed to interactions such as comments, likes and resharing.

Images intended for a domestic audience must also include an easily readable warning stating that results may vary from person to person and recommending consultation with a physician before the procedure. The gallery template can be set up to display this warning automatically with every image.

Limits on search engines, advertising and messages

Healthcare facilities and healthcare professionals may appear in search engines and on social media, but these listings must not be paid, sponsored or intended to secure prominence. The regulation states that keywords used in search engines and information appearing on results pages also cannot violate the same principles.

As an exception, healthcare facilities may run sponsored promotion during the first month after their opening date, provided it complies with the regulation; separate conditions are defined for health tourism activities aimed overseas. This framework substantially limits domestic paid search advertising; legal advice is necessary before any advertising plan is made. Promotion through phone calls, text messages or email without individuals’ knowledge and consent is also prohibited.

These strict limits on paid visibility make organic search and map results more important. For a business profile managed with the correct category, current hours and consistent contact information, the Google Business Profile guideprovides guidance, while the SEO-friendly web design approach guides the website’s technical infrastructure.

KVKK: health data is a special category of personal data

Health data is listed as a special category of personal data in Law No. 6698 and is protected much more strictly than other personal data. According to the Personal Data Protection Authority’s explanation , this data may be processed only in the limited circumstances listed in the Law, and data controllers must take the adequate measures determined by the Board.

Article 6 of the Law was amended in 2024 by Law No. 7499, adding new conditions for processing special category data; the Authority published a separate guide on this amendment. The practical consequence for a website is this: wherever forms, chat tools and analytics scripts may collect health data, the legal grounds relied upon, recipients of transfers and retention periods must be determined from the outset. The promotion regulation also separately requires promotion activities to comply with KVKK and the Regulation on Personal Health Data.

Data minimization in appointment forms

An appointment form should request only the minimum information truly needed to create the appointment; one of KVKK’s basic principles is that data must be relevant, limited and proportionate to its processing purpose. Fields such as complaints, diagnoses and medication are not essential to booking an appointment, and each turns the form into a tool collecting special category data.

The technical side of the form follows the same principle. Instead of sending form notifications as plain text by email, submissions are kept in the administration panel with access restricted to authorized users; a retention and deletion period is set for records. A link to the privacy notice is provided next to the form, and if explicit consent is required, it is presented as a separate approval from the privacy notice.

Google’s expectations for health content: YMYL and trust

Google calls topics such as health that may significantly affect people’s health and safety “Your Money or Your Life” (YMYL) topics and places greater emphasis on highly trustworthy content in these areas. Google’s helpful content guidestates that trust is the most important element among experience, expertise, authoritativeness and trustworthiness.

The same guide recommends making it clear who created content, how and why; bylines and background information about authors on pages where readers expect them are part of this. On a healthcare website, this expectation overlaps with legislative requirements: every informative article includes the name and specialty of the physician writing or reviewing it, the last update date and editor contact information. Work for search engines and legal obligations meet here in the same page layout.

Health content writing rules: a checklist

Health content is written in an informative and cautious style, without diagnosing or promising outcomes. Before publication, the following questions can be checked for every text:

• Does the text promise a definite treatment outcome or claim superiority with phrases such as “the best” or “the only place”?
• Is the method described scientifically established and defined by the Ministry?
• Does it contain a call directly steering the reader to a particular physician or organization?
• Has price, discount or campaign information slipped into the text?
• Has the research or statistic cited as a source been conveyed faithfully?
• Are the name and specialty of the writing or reviewing physician and the update date visible on the page?
• Is there a note reminding readers to consult a physician about their personal situation?

This check is an initial screening by the content agency or designer; final approval always belongs to the healthcare professional publishing the content and the organization’s legal advisor. When a long-term information plan is needed, content marketing work is structured together with these rules.

Technical infrastructure: security, maintenance and accessibility

A healthcare website’s technical infrastructure is built to protect form data and allow content to be updated quickly when legislation changes. SSL, an up-to-date core and plugins, regular backups and restricted administrator access are basic requirements; where and for how long the form plugin stores data is checked separately.

In this field, where regulations are updated at short intervals, it is important to prepare the administration panel so the organization’s team can easily correct texts. Regular update and backup needs can be met through the WordPress maintenance and updates service. Readable font sizes, sufficient color contrast and keyboard-accessible forms are also included in page templates from the start so that patients of every age can use the website comfortably.

The service side of building healthcare websites is explained on separate pages: website design for doctors and clinics, website design for dietitians and website design for psychologists. Other industries are brought together on the industry-specific website design page.

Because paid search advertising is limited, how healthcare organizations build organic visibility is covered on the SEO for doctors page.