Can Doctors and Clinics Legally Share Before-and-After Patient Photos on Instagram, Websites and Social Media?

Before-and-after photographs have become one of the most powerful marketing tools in aesthetic medicine.

Plastic surgeons, dentists, hair-transplant clinics, dermatologists and aesthetic medical practitioners frequently publish photographs showing the results of procedures such as:

• rhinoplasty;
• hair transplantation;
• dental veneers and implants;
• breast surgery;
• liposuction;
• facelift procedures;
• Botox and fillers;
• skin treatments; and
• reconstructive or cosmetic surgery.

From a marketing perspective, the logic is understandable: prospective patients want to see results.

From a Turkish-law perspective, however, a before-and-after photograph is potentially one of the most legally sensitive pieces of content a healthcare professional can publish.

The photograph may simultaneously involve:

personal data, sensitive health data, patient confidentiality, personality rights, medical advertising restrictions, cross-border data transfers and, in serious cases, criminal liability.

The most important practical rule is therefore:

Obtaining the patient’s signature does not automatically make the publication lawful.

Following the new Regulation on Promotion and Information Activities in Healthcare Services, published in the Official Gazette on 12 November 2025, Turkish law does not impose an absolute prohibition on every before-and-after image. However, doctors and healthcare institutions must satisfy a detailed set of requirements before patient images can lawfully be used for promotional or informational purposes.

This article explains the current rules and the principal risks facing doctors and clinics operating in Turkey.

1. Are Before-and-After Patient Photos Completely Prohibited in Turkey?

No.

This is an important change in the current regulatory framework.

Under the Regulation published on 12 November 2025, healthcare professionals and healthcare institutions may use visual content relating to healthcare services, including certain before-and-after photographs, provided that the requirements contained particularly in Article 7 are satisfied.

Accordingly, the statement:

“Doctors are absolutely prohibited from sharing before-and-after photographs in Turkey.”

is no longer an accurate description of the current rules.

However, the opposite statement is equally dangerous:

“If the patient signs a consent form, the doctor can post whatever they want.”

That is also incorrect.

The current system is better understood as:

Before-and-after photographs may be permitted, but only within a tightly regulated legal framework.

2. A Patient Photograph Is Personal Data

The first legal layer is the Turkish Personal Data Protection Law No. 6698 (“KVKK”).

If a photograph makes a patient identified or identifiable, the photograph constitutes personal data.

The patient does not necessarily need to be identified by name.

A person may remain identifiable from:

• facial structure;
• tattoos;
• scars;
• hair;
• distinctive physical characteristics;
• background information;
• accompanying captions;
• treatment dates; or
• other contextual information.

This issue was directly addressed by the Turkish Personal Data Protection Board in Decision No. 2022/630 dated 29 June 2022.

The case concerned photographs taken during a patient’s rhinoplasty and subsequently published on the treating doctor’s social-media account.

The healthcare provider argued that the patient’s eyes had been covered and that the photograph therefore did not identify the patient.

The Board disagreed.

It observed that other parts of the patient’s face, including identifiable facial features, remained visible and concluded that the individual could still be identified. The photographs therefore remained personal data.

This decision provides an important warning:

Putting a black bar over the patient’s eyes does not necessarily anonymize a photograph.

3. Before-and-After Photos May Also Reveal Health Data

The risk is greater because a medical before-and-after photograph does more than reveal someone’s appearance.

It may also disclose that the person:

• underwent rhinoplasty;
• received a hair transplant;
• suffered from hair loss;
• had dental treatment;
• underwent obesity surgery;
• received dermatological treatment;
• underwent breast reconstruction; or
• received another particular medical intervention.

Information concerning a person’s health is classified as special-category personal data under Article 6 of KVKK.

The current version of Article 6 expressly includes health data among sensitive categories and imposes stricter processing requirements.

For marketing and social-media publication, a healthcare provider therefore cannot automatically rely on the legal grounds permitting doctors to process health information for diagnosis and treatment.

There is an important difference between:

using a photograph for medical treatment

and

publishing the photograph to thousands of Instagram followers.

The first may be necessary for healthcare delivery.

The second is a separate processing activity requiring its own legal justification.

4. Medical Consent and Photo-Publication Consent Are Different

One of the most common compliance mistakes is including one sentence in the surgical consent form stating:

“I authorize the use of my photographs.”

This should not be treated as a safe solution.

Consent to:

• undergo surgery;
• have medical photographs taken for the clinical file; and
• have photographs publicly published for promotional purposes

are legally different issues.

Under the 2025 Regulation, patient visual content may be used only after obtaining the required consent through the Visual Content Recording and Processing Consent Form contained in Annex 1 of the Regulation.

The consent can be obtained in writing or electronically.

As a practical compliance matter, a clinic should therefore separate:

Treatment Consent

from

KVKK Information

from

Consent to Record and Publish Patient Images.

Combining everything into one five-page admission document creates unnecessary legal risk.

5. The Patient Must Be Allowed to See the Photograph Before Publication

One of the most important provisions introduced by the current Regulation is the patient’s right to see the visual content before it is published.

Article 7 provides that the patient has the right to review the image intended for publication in advance.

This is practically significant.

Suppose a patient agrees generally that the clinic may use photographs.

The clinic later chooses an embarrassing close-up image that the patient never expected to be made public.

The clinic should not assume that the original general authorization resolves the issue.

A robust compliance system should document exactly:

• which images were approved;
• where they may be published;
• whether video is included;
• whether the patient’s voice is included;
• whether the patient’s name may appear; and
• whether the images will be used on social media, the website or another platform.

6. The Patient Can Withdraw Permission at Any Time

Consent to the publication of patient images is not irrevocable.

The 2025 Regulation expressly provides that permission to share visual material may be withdrawn at any time at the request of the patient, parent or guardian, without being subject to any particular formality or condition.

Once the request is received, the healthcare provider or healthcare professional must process and conclude it immediately.

This creates a significant operational requirement.

A clinic should have a system capable of identifying where a patient’s image has been published.

For example:

• Instagram;
• Facebook;
• TikTok;
• YouTube;
• Google Business;
• the clinic’s website;
• foreign-language websites;
• agency advertisements; and
• archived marketing materials.

Otherwise, removing the photograph from one Instagram post while leaving it on five other platforms may not properly implement the patient’s withdrawal request.

7. Treatment Cannot Depend on Giving Marketing Consent

A doctor cannot tell the patient:

“You will receive the discounted surgery price only if you allow us to publish your photos.”

The Regulation expressly states that patients who refuse permission for visual publication must be assured that their diagnosis, treatment and fees will not be affected.

It also prohibits healthcare providers from providing:

• payment;
• discounts; or
• gifts

in exchange for permission to use visual content.

Therefore, arrangements such as:

“Normal rhinoplasty price: TRY 150,000. Instagram-photo price: TRY 120,000.”

create substantial regulatory risk.

This rule also strengthens the argument that consent must genuinely reflect the patient’s free will.

8. Before-and-After Images Must Be Taken Under Comparable Conditions

The new Regulation addresses another major problem in cosmetic advertising: manipulated comparisons.

Before-and-after photographs must be taken under the same environmental and technical conditions, and the relevant dates relating to the medical procedure and photography must be indicated.

For example, a clinic should avoid a comparison where:

Before

• poor lighting;
• no makeup;
• unfavorable angle;
• neutral facial expression;

and

After

• studio lighting;
• professional makeup;
• flattering angle;
• beauty filter.

Such presentation may artificially exaggerate the treatment result.

The requirement is particularly important for:

• rhinoplasty;
• facial aesthetics;
• dermatology;
• hair transplantation;
• cosmetic dentistry; and
• body-contouring procedures.

9. Photoshop and Digital Retouching Are Particularly Dangerous

The current Regulation expressly prohibits subsequent technological alterations or corrections to visual content used for healthcare promotion and information.

A clinic should therefore be extremely cautious with:

• Photoshop;
• Facetune;
• AI enhancement;
• skin smoothing;
• reshaping;
• automatic beautification;
• hair-density enhancement;
• teeth whitening filters;
• body contour editing; and
• generative-AI image modification.

Even a marketing agency’s routine process of “cleaning up” a photograph may cause the medical provider to publish content that no longer reflects the genuine treatment outcome.

For medical before-and-after photographs, the safest rule is:

Do not beautify the medical result digitally.

10. The Patient’s Body Cannot Be Used Without Limits

Patient consent does not allow a clinic to publish every photograph taken during treatment.

The Regulation specifically prohibits publishing images of a patient during:

• medical interventions;
• invasive procedures; or
• surgery.

It also restricts publication of intimate body areas contrary to general morality and requires that irrelevant parts of the patient’s body or unrelated information not be included in the image.

Accordingly, content such as:

“Watch us perform this patient’s operation live.”

may create much more serious legal risks than an ordinary before-and-after photograph.

11. Doctors Cannot Use Patient Satisfaction as Advertising

Another important restriction concerns testimonials.

Healthcare providers cannot use patient or patient-relative expressions of:

• gratitude;
• satisfaction;
• recommendation; or
• praise

as advertising in domestic healthcare promotion.

A problematic post might therefore look like:

“Before and after rhinoplasty. Our patient says Dr. X changed her life and recommends everyone to come to our clinic.”

The photograph itself may satisfy technical image requirements, while the accompanying testimonial may independently violate advertising restrictions.

The legal review must therefore examine the entire post, not merely the photograph.

12. Comments, Likes and Reposts Must Be Disabled

One of the most practically challenging provisions of the 2025 Regulation concerns social-media interaction.

Visual posts covered by the Regulation must be closed to user interactions such as:

• comments;
• likes; and
• reposting/sharing.

This requirement can create a serious practical problem because some social-media platforms may not provide complete control over every type of interaction.

Doctors should therefore not assume that:

“Instagram allows the post, therefore Turkish law allows it.”

Platform functionality and legal compliance are different matters.

If the healthcare professional cannot technically configure the platform in the manner required by Turkish healthcare regulations, publication may create avoidable compliance risk.

13. Domestic Before-and-After Posts Cannot Be Sponsored

For healthcare promotion aimed at persons in Turkey, before-and-after photographs cannot simply be turned into paid advertising campaigns.

The Regulation provides that visual content cannot be published through paid or sponsored promotion.

Accordingly, a domestic aesthetic clinic should be very cautious about:

• Instagram Boost;
• Meta Ads;
• Google Display Ads;
• TikTok Ads;
• influencer-paid promotion; and
• other paid visibility mechanisms

using patient before-and-after images.

The fact that an ordinary organic post may potentially satisfy the Regulation does not mean that the same image can lawfully be used as a paid advertisement.

14. A Mandatory Disclaimer Must Appear on Domestic Visual Content

For domestic promotion and information activities involving visual material, the Regulation requires a visible warning explaining, in substance, that results from surgical or invasive procedures may vary from person to person and that the patient should obtain detailed medical advice before the procedure.

Clinics should therefore create standardized visual-publication templates.

Allowing an external marketing agency to freely design every post without legal review creates unnecessary exposure.

15. Consent Given to the Hospital Does Not Necessarily Authorize the Doctor’s Personal Instagram Account

This is one of the most important practical lessons from Turkish KVKK enforcement.

In Personal Data Protection Board Decision No. 2022/630, the patient had signed documentation regarding use of her images by the healthcare institution.

However, the photographs were subsequently published on the personal social-media account of the doctor employed by the hospital.

The Board concluded that the patient’s consent related to the healthcare institution and did not establish consent for the doctor independently to process and publish the images through the doctor’s own social-media account.

The hospital was also criticized for failing to take adequate organizational and technical measures to prevent unlawful processing by the doctor.

The practical lesson is extremely important:

Consent must identify who will use the photograph and for what purpose.

A consent form signed in favor of:

ABC Hospital A.Ş.

should not automatically be treated as authorization for:

Dr. X’s personal Instagram account.

The roles of the clinic, hospital and individual doctor must be clearly structured.

16. Consent Is Necessary, but It Is Not Sufficient

Another Personal Data Protection Board decision illustrates the broader principle.

In Decision No. 2023/787, the Board considered a hospital’s processing of patient health data for advertising and promotional purposes.

Although the patients had provided consent, the Board emphasized that consent cannot itself legalize processing carried out for a purpose prohibited by healthcare-sector rules.

The regulatory framework has since changed, particularly with the 2025 Regulation permitting certain patient imagery under defined conditions.

Nevertheless, the underlying principle remains important:

KVKK consent is not a regulatory exemption.

A doctor must satisfy both:

1. data-protection law, and
2. healthcare advertising and professional rules.

If one of those layers prohibits the particular publication, simply obtaining consent does not necessarily cure the violation.

17. What About Completely Anonymous Photographs?

If information is genuinely anonymized so that the person cannot reasonably be identified, KVKK may no longer apply in the same way.

But genuine anonymization is much more difficult than many clinics assume.

Consider a hair-transplant photograph showing only the back of a patient’s head.

Identification might still become possible because:

• the patient reposted the clinic’s photograph;
• the treatment date appears;
• tattoos are visible;
• other photographs from the same procedure show the face;
• metadata identifies the patient; or
• the clinic tags the patient’s account.

Similarly:

covering the eyes
blurring part of the face
cropping the photograph

does not automatically constitute legal anonymization.

The 2022/630 Board decision provides a clear example: covering part of the patient’s face did not prevent the image from remaining identifiable personal data.

18. Does Posting to Instagram Create a Foreign Data Transfer Problem?

Potentially, yes.

This issue is frequently overlooked.

Publishing or uploading patient data through foreign technology providers may involve processing or transfer of personal data outside Turkey depending on the technical infrastructure and contractual architecture used.

Article 9 KVKK was substantially amended in 2024.

The current system provides mechanisms including:

• adequacy decisions;
• appropriate safeguards;
• binding corporate rules;
• standard contracts;
• written undertakings approved by the Board; and
• limited exceptional transfer grounds.

One particularly important point is that consent-based foreign transfer under Article 9 is structured as an occasional-transfer exception where the ordinary adequacy or safeguard mechanisms cannot be used, rather than a universal solution for systematic overseas data transfers.

Healthcare providers using:

• foreign cloud storage;
• overseas CRM software;
• Meta;
• Google;
• foreign marketing platforms; or
• international social-media management systems

should therefore separately map whether patient visual data is transferred abroad.

A domestic photo-publication consent form should not be treated as an automatic substitute for Article 9 compliance.

19. International Health Tourism Has Different Marketing Rules

Turkey’s international health-tourism sector is subject to a partially different regime.

Under Article 8 of the 2025 Regulation, healthcare institutions authorized for international health tourism can conduct certain promotional activities through social-media accounts and websites specifically directed abroad.

Among other conditions:

• the promotional channel must be directed toward foreign audiences;
• domestic audiences cannot be intentionally targeted;
• automatic audience targeting must be disabled;
• sponsored content may be used under the conditions established by the Regulation;
• foreign-language promotion is permitted within the prescribed structure;
• the healthcare institution must display its health-tourism authorization;
• the HealthTürkiye logo must be used where required; and
• patient privacy and consent requirements continue to apply.

This creates a major practical distinction.

A clinic may have:

Turkish domestic Instagram account

and

international health-tourism Instagram account.

The legal limits applicable to those accounts may differ.

A clinic should therefore not use one global advertising strategy for all audiences.

20. Patient Stories May Be Used More Broadly in International Health Tourism

The international health-tourism rules permit authorized healthcare institutions, under specified conditions, to publish patient stories, reviews and expressions of thanks through foreign-facing websites and social-media channels where patient privacy is protected and consent is documented.

This is materially different from the stricter domestic prohibition on using patient satisfaction statements as advertising.

Therefore, a clinic targeting patients in:

• the United Kingdom;
• Germany;
• France;
• the Netherlands;
• the Gulf;
• Scandinavia; or
• the United States

should legally separate its international marketing infrastructure from domestic Turkish promotion.

21. Doctors May Face KVKK Administrative Sanctions

Unauthorized use of patient images may trigger proceedings before the Personal Data Protection Authority.

Potential violations may include:

• failure to provide adequate information;
• processing without a valid legal basis;
• unlawful disclosure;
• inadequate security measures;
• failure to delete data after the processing basis disappears;
• improper overseas transfers; or
• failure to implement a Board decision.

The healthcare promotion Regulation expressly refers privacy violations to the sanctions contained in Articles 17 and 18 KVKK and the Personal Health Data Regulation.

For 2026, administrative fines under KVKK can reach multi-million-lira levels depending on the type and severity of the violation. For example, the indexed maximum for certain data-security violations exceeds TRY 17 million.

The amount actually imposed will depend on the relevant violation and circumstances.

22. The Ministry of Health May Also Impose Separate Sanctions

KVKK is not the only regulatory risk.

The Ministry of Health independently supervises promotional and informational activities.

The 2025 Regulation provides for monitoring of:

• websites;
• social-media accounts;
• press publications; and
• other promotional channels.

Provincial authorities may investigate content either ex officio or following a complaint, and the provincial evaluation commission may assess the alleged violation.

Depending on the healthcare provider involved, consequences may include:

• administrative sanctions;
• professional or disciplinary referrals;
• notification to professional organizations;
• notification to the Ministry of Trade;
• criminal complaints in appropriate cases; and
• applications for restriction of access to unlawful online content.

One Instagram post can therefore potentially trigger multiple regulatory proceedings simultaneously.

23. Criminal Liability Is Also Possible

An unlawful patient-photo disclosure may, in serious circumstances, go beyond administrative regulation.

Article 136 of the Turkish Criminal Code criminalizes unlawfully giving, disseminating or obtaining personal data and provides for imprisonment of two to four years.

Article 135 separately regulates unlawful recording of personal data and provides enhanced consequences where certain sensitive information, including health information, is involved.

The Personal Data Protection Board expressly referred to possible criminal proceedings under the Turkish Criminal Code in its 2022/630 patient-photo decision.

This does not mean that every defective consent form automatically results in criminal liability.

Criminal responsibility must be individually assessed.

Nevertheless, a doctor should understand that unauthorized publication of identifiable patient images is not merely a “social-media compliance mistake.”

24. The Patient May Claim Compensation

Unauthorized publication may also constitute an infringement of personality rights.

Article 24 of the Turkish Civil Code protects individuals against unlawful interference with personality rights.

Article 25 preserves claims including preventive and remedial actions and compensation.

Article 58 of the Turkish Code of Obligations allows a person whose personality rights have been infringed to seek non-pecuniary damages. Turkish higher-court case law recognizes privacy and the individual’s private sphere as protected personality interests.

A patient may therefore potentially seek:

• removal of the photograph;
• cessation of continued publication;
• prevention of future publication;
• determination that the interference was unlawful;
• pecuniary damages where actual financial loss exists; and
• non-pecuniary damages for violation of privacy and personality rights.

The seriousness of the violation may increase where the image concerns:

• intimate areas;
• cosmetic surgery;
• reproductive health;
• psychiatric treatment;
• sexually transmitted diseases;
• oncology;
• obesity surgery; or
• another highly sensitive medical condition.

25. Deleting the Post Does Not Necessarily Eliminate Liability

Suppose a doctor publishes a patient’s photographs without valid authorization.

The patient complains.

The doctor deletes the post immediately.

That is normally the correct first response.

But deletion does not necessarily erase the earlier violation.

The content may already have been:

• viewed thousands of times;
• screenshotted;
• downloaded;
• indexed by search engines;
• reposted;
• copied to another website; or
• stored by third-party platforms.

Deletion can reduce continuing harm, but it does not automatically eliminate administrative, civil or potential criminal consequences arising from the original disclosure.

26. A Marketing Agency Does Not Remove the Doctor’s Responsibility

Many clinics outsource their Instagram accounts to digital marketing agencies.

A common defence is:

“The agency posted it, not us.”

That defence is unlikely to provide complete protection.

The current Regulation expressly provides that the fact that the content was shared by another party does not remove the responsibility of the healthcare institution or healthcare professional concerned.

The Regulation also states that persons who carry out or share non-compliant promotional activity may bear responsibility.

Accordingly, every healthcare marketing agreement should contain clear rules governing:

• who can access patient photographs;
• which photographs may be published;
• required approvals;
• prohibited editing;
• deletion requests;
• data security;
• overseas processing;
• retention periods; and
• immediate incident reporting.

A marketing agency should never have an unrestricted folder containing thousands of identifiable patient photographs.

27. Practical Example: Rhinoplasty Before-and-After Post

Assume that a plastic surgeon wants to publish a rhinoplasty result.

A legally safer workflow would involve:

Step 1 — Medical photography

Photographs are taken for legitimate clinical documentation.

Step 2 — Separate publication decision

The clinic decides that particular photographs may potentially be suitable for informational use.

Step 3 — Specific consent

The patient receives the appropriate information and completes the legally required visual-content consent process.

Step 4 — Patient review

The patient sees the exact images intended for publication.

Step 5 — Content review

The clinic verifies that:

• the images are genuine;
• no digital retouching has occurred;
• before-and-after images use comparable conditions;
• relevant dates are displayed;
• no inappropriate body areas are shown;
• no misleading claim accompanies the images;
• no patient testimonial is improperly used;
• the required disclaimer appears; and
• the publication is not sponsored for domestic audiences.

Step 6 — Platform configuration

Where the Regulation requires it, comments, likes and repost interactions are disabled.

Step 7 — Publication register

The clinic records where and when the photograph was published.

Step 8 — Withdrawal mechanism

If the patient subsequently withdraws permission, the clinic can quickly locate and remove all relevant publications.

That is very different from simply asking:

“Can we post your before-and-after on Instagram?”

28. Ten Questions a Doctor Should Ask Before Posting a Patient Photo

Before publishing any patient photograph, the doctor or clinic should ask:

1. Can the patient be identified?

If yes, personal-data legislation applies.

2. Does the photograph reveal a medical treatment or health condition?

If yes, sensitive health-data rules may apply.

3. Do we have the correct visual-content consent under the current Regulation?

A generic surgical consent form may not be enough.

4. Has the patient seen the exact photograph?

The current Regulation gives the patient that right.

5. Did the patient receive any discount, payment or gift in return?

If yes, the arrangement should be reconsidered.

6. Has the image been digitally edited?

If yes, do not publish it as a treatment-result comparison.

7. Were the before-and-after photographs taken under comparable conditions?

If not, publication may be misleading.

8. Is the content sponsored?

Domestic sponsored visual promotion is heavily restricted.

9. Can social-media interactions be disabled as required?

If the platform cannot comply, publishing there may be risky.

10. Where will the data be technically transferred?

If foreign platforms or cloud infrastructure are involved, Article 9 KVKK should also be assessed.

29. A Safer Compliance Structure for Clinics

A private clinic regularly using patient imagery should establish a Patient Image Compliance Protocol.

It should include at least:

1. a separate KVKK privacy notice;
2. a compliant visual-recording and publication consent form;
3. patient approval of specific images;
4. separate rules for medical-record photographs and marketing photographs;
5. a register of published content;
6. standardized before-and-after photography procedures;
7. prohibition on digital retouching;
8. rules for marketing agencies;
9. immediate withdrawal and deletion procedures;
10. domestic versus international marketing separation;
11. cross-border transfer analysis;
12. social-media configuration requirements;
13. mandatory disclaimer templates; and
14. periodic legal review of published content.

For high-volume aesthetic clinics, this should be treated as part of healthcare compliance—not merely social-media management.

Conclusion: “The Patient Agreed” Is No Longer a Sufficient Compliance Strategy

Before-and-after medical photography can be extremely valuable for informing prospective patients.

But it is also one of the most legally sensitive forms of healthcare marketing in Turkey.

Under the current regime introduced by the 12 November 2025 Regulation on Promotion and Information Activities in Healthcare Services, before-and-after visual content is not universally prohibited. However, its lawful use is subject to detailed conditions concerning consent, authenticity, photography technique, patient review, withdrawal rights, user interaction, sponsorship, disclaimers and privacy.

KVKK creates an additional layer of obligations because identifiable patient photographs may constitute personal data and, where they reveal treatment or health status, may involve sensitive health information.

The Personal Data Protection Board’s patient-photo decisions demonstrate that regulators will closely examine:

• exactly who obtained the consent;
• who actually published the photograph;
• whether the patient remained identifiable;
• whether the purpose was lawful; and
• whether the healthcare institution took adequate compliance measures.

A doctor therefore should not ask only:

“Did the patient sign a form?”

The correct questions are:

What exactly did the patient consent to?

Who is authorized to publish the image?

Where will it be published?

Is the publication itself permitted under healthcare advertising rules?

Has the image been modified?

Can the patient withdraw permission immediately?

Is personal data being transferred abroad?

And can the clinic prove compliance if the Ministry of Health, the Personal Data Protection Authority or a court asks for the records?

For Turkish doctors and clinics, the safest principle is simple:

Before posting the before-and-after, perform the legal before-and-after check first.