Clinic website compliance in Turkey: where booking and KVKK actually start

Clinics in Turkey usually start a website with design and leave booking and data compliance for last. The working order is the reverse. Booking first, because that is where patients are lost to a phone call or an Instagram DM. KVKK consent second, because the booking form now collects patient data. A doctor and treatment page that fits the health advertising rule that changed on 12 November 2025 comes third. Visual design follows all three.

What a phone call or Instagram DM actually costs a clinic

A clinic's appointments arrive from three places: the phone, Instagram DMs, and a notebook at the front desk. When all three are busy or it's after hours, the patient messages another clinic instead of waiting. That is not a vague loss, it's a specific one: an empty slot that was already staffed and equipped. The missed-appointment cost calculator turns your own patient volume and session price into a monthly number; the flow in the next section exists to close exactly that gap.

Booking comes first: why a no-account flow is step one

Booking goes before design because that's where the patient actually disappears. For a hair studio in Denizli, we built a flow where the customer picks the service, the specialist, the day and the time, leaves a name, phone and email, and the appointment is confirmed on the spot. No account, no password, no staff approval step.

Choosing a "nice" design before this flow exists still routes the visitor back to the phone. The order matters here: a site without booking sends the patient to a DM regardless of how well it's designed.

KVKK second: where patient data sits, what the consent notice says

Once the booking form works, the clinic is collecting personal data: name, phone, email, sometimes a complaint or treatment history. Under Article 6 of Law No. 6698 (KVKK), health data is a special-category personal data. Processing it requires the patient's explicit consent as a rule; the exception covers persons bound by confidentiality and authorized institutions processing it for public health protection, preventive medicine, diagnosis, treatment and care, or health service planning, management and financing.

In practice this means a consent notice next to the booking form and an explicit opt-in checkbox on the form itself. We detailed what that notice needs to say, and how fast a patient's data-access request must be answered, in our KVKK guide; the same list applies to a clinic's booking form.

Where the ad line sits: what changed on 12 November 2025

Turkey's health-advertising rules were republished in the Official Gazette on 12 November 2025, number 33075, replacing the previous regulation from 29 July 2023, number 32263. Two years is long enough that most agency pages on this topic are still written against the old rule.

Article 5(1) bans hidden or explicit advertising in health service delivery; promotion is limited to the stated principles. What a clinic site can and can't carry is split across Articles 4 and 5:

This list is read directly from the regulation, not legal advice. A homepage with a campaign price or a "20% off" banner runs straight into Article 5(1-m); a refresh should start there.

Building the doctor and treatment page, and where local search connects

Within what Article 4 allows, every doctor needs their own page: title, specialization, working days, a booking button. Treatment pages repeat the same shape: what it is, who it suits, a booking button, with no price or comparative claims like "the best." Matching the name, address and phone (NAP) on Google Business Profile to the site exactly is the cheapest lever for getting doctor pages found in local search; get that mismatch wrong and nothing else here compensates for it.

These three steps, booking, KVKK, and a regulation-compliant page structure, get built together under a corporate website scope; FK Optik and Nöro Gelişimsel Yoga followed the same order in health and education.

Why the order matters: what breaks when a step gets skipped

Designing first and leaving booking for later still sends the visitor to the phone; a new-looking site with the same old missed appointments. Publishing a booking form with no KVKK consent notice means collecting patient data with no consent at all, which is a compliance failure, not a design one. Writing ad copy before reading the regulation is the most common mistake: a "20% off" banner breaks Article 5(1-m) no matter how good the rest of the site looks. The order doesn't end at launch either; keeping the booking form and the consent notice current is part of ongoing site maintenance.

Does this order apply identically to a single-practitioner clinic? No. If monthly patient volume is still in the tens and phone booking works fine, setting up the KVKK consent notice first and leaving booking automation for a second phase is a fair call. Compliance is never optional at any size; the timing of booking automation can shift with volume.

Frequently asked questions

Where should a clinic website start?

Not with design. Booking flow first, then a KVKK consent notice, then a doctor/treatment page that fits Articles 4 and 5. Visual identity comes after those three.

Is a "nice-looking" site enough without a booking system?

No. A site with no booking flow still routes the visitor back to the phone or an Instagram DM, regardless of design quality.

Can a clinic website list prices or discounts?

No. Article 5(1-m) of the regulation in force since 12 November 2025 bans price, discount, campaign and promotion information.

How does a clinic comply with KVKK for patient data?

A consent notice next to the booking form plus an explicit opt-in. Article 6 of Law No. 6698 classifies health data as special-category personal data.

How does a doctor profile page affect local search?

Matching the name, address and phone on Google Business Profile exactly to the site is the first step that gets doctor and treatment pages found locally.