A clinic AI assistant on WhatsApp and patient data: notice, consent and transfers abroad

When a clinic connects an AI assistant to WhatsApp, the first questions are usually technical. Data protection comes later, often after the first patient has written. Yet a patient's first line, "my tooth hurts", already falls into the most protected category of personal data.

This article is about the data side under the booking flow, using Türkiye's data protection law (KVKK, Law No. 6698) as the main example. We cover how to put the privacy notice in the first message, when explicit consent is needed, what the assistant should not ask, and what to do when your provider is abroad. The booking flow itself is covered in clinic appointment automation.

Roles first: who is the data controller

When a patient writes to the clinic, the clinic decides why and how the data is processed. That makes the clinic the data controller. A company that provides the assistant and works on the clinic's instructions is usually the data processor.

The Turkish authority's guide on generative AI and personal data, published in November 2025, says this split depends on who actually controls the data, not on the words in the contract. If the provider uses patient messages for its own purposes, such as training its own model, the picture changes. So the contract should state clearly that data is processed only on your instructions. Meta's WhatsApp Business Platform terms also forbid using WhatsApp data to train other AI models.

The privacy notice in the first message, separate from consent

Article 10 of Law No. 6698 requires five things to be told when data is collected: who the controller is, the purpose, to whom and why data may be transferred, the method and legal basis of collection, and the person's rights under Article 11. On WhatsApp the data starts arriving with the patient's first message, so the notice belongs in the first reply. If you treat patients from the EU, Article 13 of the GDPR sets a similar list.

In principle decision 2026/347, published in Türkiye's Official Gazette on 24 March 2026, the Turkish Data Protection Board named the mistake it sees most: mixing the privacy notice and the consent text together. What follows for a clinic:

• The notice does not depend on the patient's approval. Do not ask for "I have read and accept" or "I approve". If needed, ask for an acknowledgement such as "I have read and understood".
• If processing relies on explicit consent, the two texts come under separate headings with separate statements.
• If processing relies on another legal basis, only the notice is given and no consent text is shown.
• The language should be plain. Instead of copying Article 11 in full, "your rights under Article 11 of the Law" is enough.

A good first reply on WhatsApp could look like this:

Hello, I am the AI assistant of Example Clinic. I help with appointments and general questions, and I connect you to our team when needed. You can read how we process your personal data here: [link to privacy notice]. How can I help?

Look at the first sentence. The Turkish AI guide says it matters that people talking to a chatbot clearly know they are talking to an AI system, and that the system should include a notice saying so.

A legal basis for health data

Article 6 of the Turkish law treats health data as special category data. Since the 2024 amendment the conditions for processing it sit in one list. Two of them matter most for a clinic:

• Point (a): the patient's explicit consent.
• Point (e): processing that is necessary for purposes such as preventive medicine, medical diagnosis, treatment and care, carried out by persons under a duty of confidentiality or by authorised institutions.

The authority's February 2025 guide on special category data clarifies two points. "Authorised institutions" covers private persons and companies that provide health care, not only public bodies. And when another legal basis exists, explicit consent should not be added on top, because that can breach the principle of good faith.

For a clinic this means deciding in advance which basis covers the data needed for booking and treatment, and writing that basis in the notice. Marketing messages, surveys or social media posts are not needed for treatment and need their own assessment.

What the assistant asks and what it does not

Less data means less risk. Use this table when you write the assistant's rules:

The WhatsApp Business Messaging Policy also asks businesses not to use WhatsApp for telemedicine or to send or request health information where local rules forbid sending it to systems that do not meet heightened requirements. If a patient writes details anyway, the assistant should not interpret them. It should hand the conversation to the doctor or the team.

Adequate measures: what the team does

The Turkish law requires the adequate measures set by the Board for special category data. They are listed in Board decision 2018/10 of 31 January 2018, and the AI guide says the same measures apply to AI systems. Applied to an assistant panel:

• Define person by person who can read conversations, and review access at set intervals.
• Remove access at once when someone leaves or changes role.
• Use at least two-step verification for remote access to the panel.
• Get it in writing from the provider that data is stored encrypted and that actions on it are logged.
• Sign confidentiality agreements with everyone who sees the chats and train them on data protection regularly.
• Keep a separate written policy and procedure for special category data.

If the provider is abroad: Article 9

Many AI assistants run on servers or companies abroad. The Turkish AI guide states that when a controller in Türkiye uses AI through a provider abroad, the transfer must follow Article 9 of the law and the regulation on transfers abroad. Under Article 9 the order is:

1. If the Board has issued an adequacy decision for the destination, the transfer relies on it.
2. If not, one of the appropriate safeguards is needed. For a small clinic the most practical one is the Board's standard contract. The Board has published four types, and for a transfer from a clinic to an assistant provider the fitting one is usually Standard Contract 2, controller to processor.
3. Once signed, the standard contract must be notified to the authority within five working days. Article 18 of the law attaches a separate administrative fine to failing to notify.
4. If none of these is possible, data may be transferred only incidentally, meaning in non-recurring cases, for example with explicit consent given after the risks were explained. An assistant that runs every day is not incidental, so do not rely on this.

Seven questions to ask your provider

1. In which country are patient messages stored and processed?
2. Who are your sub-processors and where are they?
3. Are messages used to train your model or anyone else's?
4. Will you sign a data processing agreement and, where needed, the Board's standard contract?
5. How soon is data deleted when the contract ends?
6. How soon do you tell us about a data breach?
7. How does the assistant hand a conversation to a person when it does not know the answer or the question is medical?

Ask us these questions too. The Bulsu Labs AI Receptionist answers only from the information the clinic gives it and hands unknown and medical questions to the team. Bulsu Labs is a Montenegrin company, so for a clinic in Türkiye, Article 9 applies when working with us as well. Our data processing agreement is on the site. For the dental flow see dental clinic appointment booking, and for WhatsApp's AI rules see WhatsApp AI assistant in 2026.