Health data and accessibility: KVKK Article 6 and WCAG 2.2 on a single platform.

The online appointment form, test result page or patient portal login screen are moments where the visitor comes into contact with health data. On these pages, any analytics or marketing script collected via cookies that runs without explicit consent creates a risk of aggravated penalties under KVKK Article 6. A standard general privacy notice is not considered sufficient.

• Explicit consent: must be separate, freely given, specific and informed
• The consent log must be recorded with a timestamp before appointment confirmation
• The burden of proof lies with the data controller; if the log is deleted, the penalty can double

A patient who is visually impaired or has motor difficulties must be able to book an appointment independently. A calendar widget that can't be navigated by keyboard, a mouse-focused doctor selection list and silent form errors create WCAG 2.1.1 and 4.1.2 violations. If the module belongs to an external provider, the responsibility still stays with the hospital.

• A calendar module without keyboard access is a critical violation (WCAG 2.1.1)
• If error messages are shown by color only, the screen reader can't detect them
• The violation report can be used as a vendor brief, requesting changes

Lab results and imaging reports are mostly provided as untagged PDFs. Color-only value coding (high/normal/low red-green) falls under a WCAG 1.4.1 violation. Without header labels in tables, the screen reader reads the values in a meaningless order.

• A violation report is needed to request results in tagged PDF or HTML format
• Alongside a color-only indicator, an icon or text description is required
• The cerez.io report serves as a technical brief for the HIS update

Organizations covered by Circular 2025/10 are required to publish an up-to-date accessibility statement on their websites. The statement must include the compliance level, known shortcomings and a feedback channel for users with disabilities. A missing or outdated statement is a direct cause for penalty.

• The cerez.io statement generator fills in the Circular format automatically
• A footer link and feedback channel are included
• When the scan result is updated, the statement version is updated too

• Health data is considered special-category personal data
• Explicit consent: separate, freely given, informed
• The burden of proof lies with the data controller
• In a violation, twice the standard penalty can be applied
• Deleting the consent log constitutes an independent violation

• All private hospitals are in the one-year compliance group
• Deadline: 21 June 2026
• Standard: WCAG 2.2 Level A
• Statement required: footer link and feedback channel
• 5.000-25.000 TL administrative fine (annual cap 500.000 TL)