Sending your X-rays and health details to a clinic outside the EU

To give you a real opinion, a clinic needs to see your mouth: a panoramic X-ray, perhaps a 3D scan, photos of your teeth and a summary of your health and medicines. That is health data, which European law protects more strictly than almost anything else. Sending it to a clinic in Türkiye is entirely legal and very common, but it is worth doing thoughtfully. This article explains the legal background in plain terms and gives practical steps.

You decide to share your own data

Data protection law mainly regulates what organisations do with personal data. When you, as a private individual, send your own X-ray to a clinic, you are choosing to share it. That is your right. What changes is who is responsible afterwards: once the clinic receives your data, it becomes the organisation responsible for keeping it safe and using it only for the purpose you sent it for.

When a clinic in Türkiye processes data about people in the EU, the GDPR’s rules on international transfers and Türkiye’s own law both come into play. Article 49 of the GDPR lists situations in which personal data may go to a country without an EU adequacy decision, including when the person concerned has explicitly agreed after being informed of the risks, or when the transfer is necessary for a contract at their request. Those rules mostly bind organisations; for you, the practical point is that the clinic should tell you how it handles your data.

Türkiye’s data protection law

Türkiye has its own Personal Data Protection Law, No. 6698, usually called KVKK after its Turkish initials, overseen by the Personal Data Protection Authority. Like the GDPR, it treats health data as a special category with stricter conditions for processing. Healthcare providers and others under a duty of confidentiality may process health data for the purposes of treatment.

The law was amended in 2024. The changes, which came into force on 1 June 2024, created a new system for transferring personal data abroad, based on adequacy decisions, appropriate safeguards and, for occasional transfers, specific conditions; a regulation on procedures followed in July 2024. Turkish government plans also mention bringing KVKK closer to the GDPR. For a patient, the effect is reassuring rather than complicated: a licensed clinic in Türkiye is subject to a data protection law built on the same principles as the one you know.

Send only what is needed

For a first opinion on All-on-6, a clinic usually needs:

• a recent panoramic X-ray, or a CBCT scan if you have one;
• a few photos of your teeth or current denture;
• a short list of health conditions and medicines, especially blood thinners, bone medicines, diabetes treatment and anything affecting healing;
• your name and how to contact you.

It does not need your passport, your full hospital history or your insurance number at this stage. If you are unsure whether something is relevant, ask before sending it.

Choosing a method

• The clinic’s enquiry form. Precious Dental’s form deliberately does not ask for health information. After you make contact, the clinic will tell you how to send images.
• WhatsApp. Messages and files are end-to-end encrypted in transit. Files then remain on the phones involved, so it is reasonable to ask which number belongs to the clinic, who sees the images and how long they are kept.
• Secure file transfer. CBCT scans are large. A file-transfer service that lets you set a password and an expiry date is better than email. Send the password by a different route.
• Email. Fine for small images if you are comfortable with it; ordinary email is not encrypted end to end.

Questions to ask the clinic

1. Who will see my images, and are they dentists or coordinators?
2. Where are my data stored, and for how long?
3. Will my data be shared with anyone else, such as a laboratory or a travel agent?
4. How do I ask for my data to be deleted if I do not go ahead?

A clinic that takes data protection seriously will answer these without difficulty. Precious Dental’s handling of enquiries is described in this site’s privacy policy: enquiries go only to the clinic, are not passed to other clinics or agents, and are deleted on request.

Getting the data in the first place

If your X-rays are at your dentist’s, you have a right to copies, and in the EU the first copy should be free. See your dental records under GDPR.

Photos that help a dentist

If you are asked for photos, a few simple steps make them far more useful:

• Use daylight or a bright room, and turn off the flash if it causes glare.
• Take a front view smiling, a front view with teeth together and lips pulled back, and views of the upper and lower teeth from above and below (a mirror helps).
• If you wear a denture, take photos with and without it.
• Send the photos as files rather than screenshots, so they keep their quality.

A health summary in one page

Rather than sending a stack of hospital letters, write a one-page summary: your age, conditions you are treated for, medicines with doses, allergies, any bone medicines past or present, smoking, and previous dental surgery or implants. Add your doctor’s details. This gives the dentist what they need and keeps unnecessary information out of your file. Bring a printed copy on the first trip.

When you decide not to go ahead

If you decide against treatment, or choose another clinic, you can ask the clinic to delete your enquiry, images and health information. Do it in writing and keep the reply. Under Turkish law and the GDPR you can also ask what data they still hold. Precious Dental deletes enquiries on request, as described in this site’s privacy policy.

Coordinators and dentists

Many clinics that treat international patients have coordinators who answer messages and arrange travel. That is useful, but your images and health details should be assessed by a dentist. Ask who will look at them and who will write the opinion you receive. The answer tells you something about how the clinic works.

At Precious Dental, the clinical opinion on an X-ray comes from a dentist, and All-on-6 is planned and placed by Dt. Hüseyin Yavuz Özbek. See why we recommend Precious Dental.

Keep your own copy

Whatever you send, keep a copy of it and a note of the date and method. If you later ask what data the clinic holds, or need to send the same images to another clinic for a second opinion, you will have everything in one place. Our article on your dental records under GDPR suggests a simple way to organise the files.

Second opinions

You are free to send the same X-ray to more than one clinic, or to a dentist at home, for a second opinion. Comparing written opinions is a good way to understand your options. Tell each clinic which images you sent and when they were taken, so that their answers are based on the same information.

In short

• Sending your own X-rays to a clinic abroad is your right and is common practice.
• The clinic then has to protect them, under Türkiye’s KVKK, which treats health data as a special category.
• Send only what is needed, use a secure method for large files, and ask how data are stored and deleted.

Read why we recommend Precious Dental, or start with our contact form.

Questions readers ask

Is it legal to send my own X-rays to a clinic in Türkiye?

Yes. You can share your own data with whomever you choose. Data protection law mainly governs what organisations do with data; once the clinic receives it, it must protect it under Turkish law.

What does Turkish law say about health data?

Türkiye’s Personal Data Protection Law (No. 6698, KVKK) treats health data as special-category data with stricter rules. Amendments in force from 1 June 2024 changed how data may be transferred abroad.

Is WhatsApp safe for sending X-rays?

WhatsApp messages are end-to-end encrypted in transit. The files then sit on the phones involved, so ask who at the clinic receives them and how they are stored.

How should I send a large CBCT scan?

Use a secure file-transfer link with an expiry date or a password, rather than attaching it to an email. Send the password separately.

Can I ask the clinic to delete my data?

Yes. If you do not go ahead, you can ask the clinic to delete your enquiry and images. Under KVKK and the GDPR you can also ask what data it holds.

Sources

1. EUR-Lex — GDPR, Articles 9 and 49
2. Personal Data Protection Authority of Türkiye (KVKK)
3. Erdem & Erdem — Kişisel Verilerin Korunması Kanunu’nda neler değişti? (2024 amendments)
4. WhatsApp — About end-to-end encryption

Checked in October 2026. Where we give our own view as a clinic, we say so.