KVKK and clinical software: what to ask a vendor

Psychotherapy records are special category personal data under Article 6 of Turkey’s KVKK. That means a different processing regime from an ordinary customer list: explicit consent or a specific statutory basis, a narrower sharing surface, and the additional technical measures the Board expects.

The practical consequence is that choosing software is a compliance decision, not a convenience one. These are the questions worth settling before you sign.

1. Who is the controller, and who is the processor?

This split gets skipped often, and it causes problems later. For your client’s clinical data you are the data controller — the duty to give notice, manage consent, and answer data subject requests sits with you. The software vendor is a processor, handling that data on your behalf.

Does the vendor draw that line explicitly in its own documents? If it doesn’t, where responsibility sits in the event of a breach stays undefined.

2. Is there a data processing agreement?

Under KVKK Art. 12 the controller is jointly responsible together with the processor. Without a written DPA there is no way to manage that relationship. What to look for:

• Subject matter, duration, and purpose of the processing
• A list of sub-processors (hosting, email, AI provider) and notice of changes
• Breach notification timing — KVKK works from a 72-hour window for notifying the Board, so the vendor’s notice to you needs to be shorter than that
• Return or destruction of data at the end of the agreement

3. Where is the data stored?

Transfers abroad fall under a separate regime in KVKK Art. 9, tied since the 2024 amendments to mechanisms such as standard contractual clauses, binding corporate rules, or an undertaking. Get the vendor’s hosting location — and which transfer mechanism it relies on, if any — in writing.

If AI features are in play, this question doubles: if session text goes to a model provider, that is also a transfer.

4. Is AI processing disclosed separately?

Transcribing a session recording is a distinct, additional processing activity from the client’s point of view. A clause buried in a general privacy notice doesn’t cover it — the client needs to be told separately that a recording will be made, what it will be used for, and that they can decline.

In a well-designed product this is a technical constraint rather than a written promise: with no consent record, the operation never starts. In psisula, drafting a note from session audio never reaches the provider without a consent record — the request is rejected at the application layer.

5. Do erasure and export actually work?

KVKK Art. 11 gives the data subject the right to request erasure and information, and as controller you have to be able to satisfy it. The vendor needs to offer this as a working feature, not as a support ticket.

Worth asking: how many steps does an erasure request take? When does it clear backups? What format does export produce, and is it readable?

6. Is access logged?

For clinical data there has to be an answer to “who saw what, and when.” In a multi-therapist clinic that isn’t only a compliance matter, it’s a matter of trust inside the team. If access and modification aren’t recorded, there’s nowhere to look after something goes wrong.

---

The answers to these questions tell you more than any compliance claim in a vendor’s marketing copy. Phrases like “100% KVKK compliant” are not an assurance — compliance isn’t a product feature, it’s a joint result of the contract between you and the vendor and of how you run your own practice.

Our own texts are published on the Security page and in the legal section. Some of them are still under legal review, and that is stated plainly on the pages concerned.