Why health data is treated differently
Both the GDPR (Article 9) and Turkey's KVKK (Article 6) place health data in a special category, subject to stricter conditions than ordinary personal data. Medical tourism companies hold exactly this: diagnoses, photographs, medical reports, treatment histories.
The practical consequence is that "we're careful" is not a position. You need a lawful basis you can point to, controls you can demonstrate, and records that show who accessed what.
What follows is a practical checklist, not legal advice. Take proper advice for your jurisdiction and circumstances.
The controls your CRM must have
| Control | What it means in practice |
|---|---|
| Role-based access | A consultant sees their own patients, not the whole database |
| Field masking | Phone and email hidden from restricted roles — data masking |
| Audit logging | Who opened which record, when, and what changed |
| Encryption | In transit and at rest |
| Retention rules | Data not kept indefinitely; deletion requests satisfiable |
| Export control | Bulk export restricted and logged |
The last row is the one most often missing and most often exploited: an unrestricted export button is how databases walk out of companies. See security.
Questions to ask a vendor
- Where is the data hosted, and in which jurisdiction is it processed?
- Is there a data processing agreement, and does it name sub-processors?
- How are backups protected, and how long are they kept?
- What is the breach notification process and its timeline?
- Can I delete a specific patient's data on request, including from backups over time?
- What certifications exist, and when were they last audited?
A vendor who cannot answer these plainly is not a vendor whose security you can vouch for to a regulator.
The habits that cause breaches
In this sector, incidents rarely come from sophisticated attacks. They come from ordinary working habits:
- Patient photos in personal WhatsApp. Medical images on a personal phone, backed up to a personal cloud account.
- Spreadsheet exports. "Just to work on at home" — then on a personal laptop indefinitely.
- Shared logins. One account used by three people destroys the audit trail entirely.
- No offboarding. Access left open for weeks after someone leaves.
All four are organisational, and all four are fixed by routing communication through CRM-connected channels and closing access on the day someone departs. See sales team management.
What to put in place this quarter
A realistic starting sequence for a company that has none of this:
- Write the privacy notice and consent text; make consent capture part of the enquiry flow rather than an afterthought.
- Turn on role-based access and user groups; remove blanket admin rights.
- Move patient messaging onto connected channels so nothing new accumulates on personal devices.
- Define a retention period and apply it to closed records.
- Write a one-page offboarding checklist and use it every time.
None of these require a project. All of them reduce your exposure more than any single technical purchase.