KVKK for psychologist and counseling practice websites in Turkey
A psychologist or counseling practice site in Turkey collects more than a name and a phone number: an intake question, a session note, sometimes a WhatsApp message. KVKK asks for a disclosure notice, explicit consent, and a defined retention period.
A psychologist or counseling practice site in Turkey falls under KVKK the moment its booking form collects more than a name and a phone number, which is almost always. The law asks for three separate things: a disclosure notice shown at the point of collection, explicit consent for anything that counts as health data, and a defined limit on how long that data sits. None of the three substitutes for the others.
TL;DR
A psychologist or counseling site needs three things under KVKK: 1) a disclosure notice covering Article 10's five required elements, 2) explicit consent for session content and anything resembling a diagnosis, 3) periodic destruction at most every 6 months with a policy, or within 3 months without one. Copying a colleague's notice covers none of these; it has to name your own vendors and your own legal basis.
Where client data actually sits: the form, the intake question, the session note
Data in a counseling practice doesn't arrive from one place. The booking form is the visible one, but the flow doesn't stop there: an intake questionnaire, the first WhatsApp message a client sends, the note taken during a session, and whatever reaches the accounting software for invoicing. Each one sits under a different rule.
Five surfaces where client data sits
Booking form
Name, phone, email, appointment time. Ordinary personal data, coverable under contract performance.
Intake questionnaire
A field like "what would you like to talk about" turns this into special-category data.
Session notes, client file
Special-category data. Consent is the rule; the exception is narrow and covers confidentiality-bound health care delivery only.
WhatsApp and DM threads
Health information shared outside the booking system is not exempt just because it lives in a different app.
Accounting and invoicing software
A name and a fee now sit in a third program. That transfer has to be named in the disclosure notice.
There's a technical requirement underneath these five surfaces: the booking form has to log who processed what and when consent was given. The corporate site built for FK Optik shipped with Lighthouse scores of 100/100 on both mobile and desktop; the same engineering discipline is what keeps a counseling practice's consent record from silently dropping.
The disclosure notice needs Article 10's five elements: a filled template
Article 10 of Law No. 6698 requires five elements to be disclosed at or before the point of collection. Most sample notices found online cover identity and purpose, and stop there; the transfer and legal-basis elements are usually missing. The template below fills all five for a counseling practice.
Disclosure notice: Article 10's 5 elements
Identity of the data controller
"The data controller is [Practice name], [full address]. Contact: [email], [phone]."
Purpose of processing
"Processed to schedule your appointment, deliver the counseling service, and meet our legal record-keeping duties."
Who it may be shared with, and why
"Shared with [SMS provider] for appointment reminders and [accounting software] for invoicing, only for the stated purpose."
Collection method and legal basis
"Collected through the website's booking form, on the basis of contract performance and your explicit consent."
The rights listed in Article 11
"You may exercise your right to learn, correct, delete, or object by writing to [email]."
The bracketed fields change per practice; the rest follows Article 10's order as written.
An AI-built booking app almost never produces this list on its own, because the tool's priority is a working form and nobody asked it for a disclosure notice. We covered the technical side of that gap in our KVKK guide for AI-built apps; this piece covers the same law for a counseling practice's own booking form and session data.
When consent is required, and when contract performance already covers it
The booking form's basic fields, name, phone, email, appointment time, are ordinary personal data and can be processed under contract performance without separate consent. But session content, a stated complaint, or anything resembling a diagnosis is special-category data under Article 6. The rule there is explicit consent; the exception is narrow, limited to confidentiality-bound persons and authorized institutions processing it for preventive medicine, diagnosis, treatment, or care.
A psychologist shouldn't assume that exception automatically applies: a licensed clinical psychologist delivering treatment and a life coach offering counseling don't necessarily sit in the same category. The safer, practical path is a separate consent checkbox for anything touching session content, which protects the client even where the exception is genuinely debatable.
How long data should be kept, and when destruction is due
The law sets no fixed retention period; it sets a principle, data is kept only as long as its purpose requires. What makes that concrete is Article 11 of the Regulation on the Deletion, Destruction or Anonymization of Personal Data: the data controller sets its own periodic destruction interval in its policy, but that interval can never exceed six months.
6 months
With a retention and destruction policy
The practice sets its own periodic destruction interval; Article 11 of the Regulation caps it at six months.
3 months
Without one
Deletion, destruction or anonymization must happen within three months of the obligation arising.
In practice this means a client's file shouldn't sit indefinitely after they've left. If a client asks for their data to be deleted, Article 13 requires a free response within 30 days at the latest, and that deadline applies to access requests the same way.
Sharing with a third party: reminders, accounting, marketing tools
A counseling practice's data rarely stays in one hand: a reminder SMS goes to an SMS provider, an invoice goes to accounting software, sometimes a newsletter goes through an email tool. Each one has to be named in the disclosure notice's third element; a vague "may be shared with our partners" doesn't satisfy Article 10. If the tool in use sits abroad, which is true of most SMS and email providers, that opens a cross-border transfer question under Article 9 and needs its own legal basis.
Where this checklist stops being enough: when to call a lawyer
Everything above is an operational baseline, not legal advice. A single practitioner seeing a handful of clients a month and keeping paper files may not need a web form at all yet; the priority there is a disclosure notice for the paper process, not a website. But once a practice grows, adds more than one practitioner, sees a minor client, or approaches the VERBİS registration threshold, a general checklist stops being enough and a KVKK lawyer is the next call.
Booking, the disclosure notice, and a regulation-compliant page structure get built together in one pass; the clinic website guide walks through that order step by step, and a corporate website scope builds the same three for a counseling practice. For what that actually costs, the clinic website pricing guide breaks down the same budget line items.
Frequently asked questions
Does a psychologist's website need a disclosure notice?
Yes. Article 10 requires disclosure at or before the point of collection; the moment a booking form collects data, the notice needs to be on the site.
Does recording a session note require consent?
Session content and anything resembling a complaint or diagnosis is special-category data under Article 6, and consent is the rule. The exception is narrow and doesn't automatically apply to every kind of counseling practice.
How long should client data be kept?
The law sets no fixed period, only a purpose-based limit. With a retention and destruction policy, periodic destruction happens at most every 6 months; without one, within 3 months of the obligation arising.
How many days are there to respond to a client's data request?
Article 13 requires a response within 30 days at the latest, free of charge as a rule.
Can another psychologist's disclosure notice be copied?
No. The notice has to name your actual purpose, your actual vendors (booking software, SMS provider, accounting tool), and your actual legal basis. A copied notice that doesn't match what the practice actually does creates its own risk the moment it's checked against reality.