KVKK and messaging consent for vet clinics: what to watch out for with SMS and WhatsApp reminders

Although the patient is an animal, most of the information held in the records belongs to the owner: name, phone number, address, email and sometimes an ID number. This information is personal data under Law No. 6698 on the Protection of Personal Data (KVKK, the Turkish Personal Data Protection Law), and the clinic is the data controller for it.

Privacy notice: what should you tell the owner?

When personal data is collected, the owner must be informed of the purposes for which their data will be processed, to whom it may be transferred, the method of collection and the legal basis, as well as their rights under the law. Keeping a short privacy notice alongside the registration form and recording that the owner has read it is common practice.

Don't collect more data than you need

Not every field has to be filled in. For example, an ID number should only be requested if it's needed for invoicing or a legal requirement. Data you don't collect is data you don't have to protect.

Reminder messages and consent

Vaccine and appointment reminders relate to the service provided for the owner's pet; promotions and discount announcements, on the other hand, may qualify as commercial electronic messages and require separately obtained consent. Which category a message falls into must be assessed case by case. The safest approach is to ask owners at registration which channels they'd like to receive messages through, and record that preference channel by channel.

• Keep SMS, WhatsApp and email consent separate.
• Don't send messages through a channel without consent.
• Update the record immediately when an owner withdraws consent.
• Don't mix promotional messages with reminder messages.

Limit access

Only staff who need personal data for their work should have access to it. Role-based permissions, locking idle screens and logging who carried out each action are part of the technical measures required by KVKK.

The owner's rights

Owners have rights such as finding out whether their data is being processed, requesting information, and asking for their data to be corrected or deleted. Deciding in advance how you'll respond to these requests saves time when one arrives.

In ZooAsist, SMS, WhatsApp and email consent are separate fields on the client record, and no reminder is sent through a channel without consent; a reminder that isn't sent appears in the list along with the reason. Role-based permissions and session lock are also built into the system.