Units
1. Introduction to Artificial Intelligence in Physiotherapy: Boundaries, Validation, Responsibility and Ethics 2. Exercise Program Draft: Fast and Safe Editing with Artificial Intelligence 3. Movement and Posture Analysis: Video and Artificial Intelligence 4. Patient Tracking, Compliance and Motivation 5. Evaluation and Progress Report Writing 6. Patient Education Content Production: Brochure, Home Program and Lecture 7. Evidence-Based Practice: Literature and Evidence Review 8. Clinical Documentation and SOAP Notes 9. Special Populations: Neurological, Pediatric, Geriatric, Orthopedic and Athlete 10. Tele-rehabilitation and Remote Monitoring 11. Privacy, KVKK, Ethics and Data Security 12. End-to-End Workflow: Integration, Quality and the Future in the Clinic
Unit 11 / 12

Privacy, KVKK, Ethics and Data Security

Gains:

  • Ability to apply KVKK, open consent and data minimization principles in the processing of patient data in AI tools
  • Ability to justify anonymization, local/institutional tool selection, and data retention decisions
  • Ability to recognize ethical dilemmas (bias, transparency, providing patient information) and create a responsible use policy

The physiotherapist accesses the most private information of his patient: his health condition, his body, photos, videos, daily life. This trust is fundamental to the profession and protected by law. Once artificial intelligence (AI) tools start processing this data, the responsibility for privacy does not disappear; On the contrary, it becomes even more complex. Because now the data can leave your computer and go to another company's server. In this unit, you will learn the legal framework that protects patient data in the AI ​​age (KVKK), practical ways of protection (anonymization, tool selection) and ethical principles (bias, transparency, information to the patient).

KVKK and health data

KVKK (Personal Data Protection Law) regulates the processing of personal data. Health data is classified as special personal data in this law; that is, it has the highest level of protection. Diagnosis, treatment, measurements, images of a patient; As a rule, the patient's explicit consent (free consent given by knowing what they will be used for) is required for their processing. Giving this data to an AI tool is also “processing.” Therefore, three questions always apply: Do I have a legal basis for the processing (explicit consent)? Am I processing only necessary data (data minimization)? Is the data safe?

Caution: Pasting a patient's name, diagnosis or image into a cloud AI tool without explicit consent and anonymization may be an unlawful data transfer in terms of KVKK. This poses a risk of harm to the patient, legal sanctions, and violation of professional ethics.

Data minimization and anonymization

The strongest way to protect yourself is to minimize the data to be protected. Data minimization is processing only the minimum data required for the purpose. The AI ​​does not need the patient's name, ID, or contact information to draft an exercise program; it only needs anonymous clinical context such as “45-year-old female, chronic low back pain, 3 months.” Anonymization means removing all elements that determine identity (name, ID, address, date, institution, face) from the data. Correctly anonymized data is no longer personal data and can be processed much more securely.

Data type

example

Should it be given to AI?

Method

Direct identifier

Name, TR ID, phone

no

Take it out completely

indirect identifier

Rare diagnosis + city + date

careful

Generalize/infer

clinical context

Age range, diagnosis, stage

Yes (anonymous)

Give if necessary

Image/video

face visible record

No (as a rule)

Hide face, consent, secure tool

Vehicle selection and data storage

Not all AI tools are equal. Some store your data to train the model; Some people don't hide it. Some transfer your data to servers abroad. The physiotherapist must know the data policy of the tool he uses: Is the data used in training? Where and how long is it stored? Is it in compliance with KVKK? If possible, corporate/contracted, data-free or locally working tools should be preferred. A corporate data processing agreement (DPA) and a clear retention policy are signs of safe tool selection.

Tip: A "free" tool can often mean payment with data. When it comes to patient data, reading the vehicle's data policy is not a luxury but a necessity. When in doubt, anonymize data and do not share any identifiers.

At an enterprise scale, privacy goes beyond individual attention and becomes a matter of policy. If ten different physiotherapists behave in ten different ways in a clinic, even the most careful one cannot cover the risk posed by the most careless one. That's why a written data use policy is essential: what tools are allowed, what data can never be shared, what to do if a breach occurs. Additionally, a data breach plan (who will be notified when a leak is noticed, how it will be limited, notification to the competent institution and the patient if necessary) should be prepared in advance. KVKK imposes a notification obligation for certain violations; It is too late to learn this at the time of the incident. The good news is that when the basic discipline in this unit (anonymization, minimization, secure tool, transparency) is applied, the likelihood and impact of a breach is significantly reduced.

Ethics: bias, transparency, information to the patient

Privacy is the domain of the law; Ethics is broader. Three ethical issues stand out. Bias: AI may be more inaccurate for groups underrepresented in training data (certain age, gender, ethnicity, disability); the output needs to be validated more carefully in these groups. Transparency: You must clearly tell the patient that you are using AI; Hiding damages trust. Information and autonomy to the patient: The patient has the right to make decisions regarding his/her own data; automatic and secret decisions cannot be made on his behalf.

Step by step: safe and ethical data use

  1. Get consent. Explain that patient data will be processed and AI will be used, and obtain explicit consent.
  2. Minimize. Do not share any unnecessary data for the purpose.
  3. Anonymize. Strip out all identifiers; maintain clinical context.
  4. Choose a safe vehicle. Use a KVKK compliant vehicle with a known data policy.
  5. Beware of prejudice. Validate output more rigorously in underrepresented groups.
  6. Be transparent. Inform the patient, answer his questions, respect his decision.
  7. Document it. Record which data is processed how and record consent.

Three mini cases (in numbers)

Case 1 — Anonymization saves. The physical therapist would paste the patient file into the AI ​​to draft a report; There was name, ID and address in the file. Instead, in 30 seconds, it stripped out all identifiers and gave only the context of “58-year-old male, total knee replacement, 6 weeks post-op.” The result was the same quality, personal data was never shared.

Case 2 — Vehicle policy difference. One clinic found that a free tool was using data in the model and switched to an institutional, data-free version. Additionally, a "no identifiers are shared" rule was written for the team. No personal data leaks were found in the internal audit conducted 3 months later.

Case 3 — Transparency and trust. A patient was initially uneasy when he learned that his physiotherapist was creating brochures with AI. The physiotherapist explained that the AI ​​was used only for text drafting, his personal data was not shared and all decisions were his own. The patient's confidence increased. Lesson: transparency strengthens trust, not diminishes it.

Weak prompt / Strong prompt

Weak: "Here is the patient's file (including name, ID, diagnosis), write a report."

Transfers personal and private data without explicit consent and anonymization; It carries the risk of KVKK violation.

Strong: "Write report draft based on the following anonymous clinical context. No personal identifiers, just age range, diagnosis, stage, and measurements. Context: [anonymised data]." Use this after clearing the identifiers first with a separate anonymization step.

Four copyable templates

Task: Anonymize this text.Text: [text containing personal data]Rule: Replace name, ID, phone, address, date, institution, unique identifiers with [TAG]. Preserve clinical context (age range, diagnosis, stage, measurement). Output: anonymized text only.

Task: Produce AI tool data policy checklist. Context: [tool evaluated] What I want: Questions I need to ask — is the data used in education, where/how much is it stored, is there KVKK/DPA, is there any transfer abroad, what is the right to delete? The decision is mine; just give me the checklist.

Task: Write a DRAFT of explicit consent / informational text.Scope: [physiotherapy + AI-assisted content/follow-up]Must contain: which data, what purpose, AI role, storage, patient's rights, statement of approval/disapproval. Plain language. Do not use without approval.

Task: Review this AI output for bias.Output: [recommendation/content], patient group: [possibly under-represented group]I want: Flag points that may be inaccurate/incomplete/generalizing for this group +recommendation for stricter validation. Don't decide, show risk.

Common mistakes

  • Pasting personal data. Name, ID, image cannot be shared without explicit consent and anonymization.
  • Not knowing vehicle policy. Blindly using tools that store/train your data is risky.
  • Skipping data minimization. Sharing unnecessary data increases the surface area that needs to be protected.
  • Ignoring prejudice. Outcome in underrepresented groups should be validated more carefully.
  • Not being transparent. Concealing the use of AI to the patient undermines trust and ethics.
  • Not documenting consent. Processing and consent must be recorded in a traceable form.

In summary

Health data is special data under KVKK and requires the highest protection. In the age of AI, responsibility for privacy increases. Obtain explicit consent, minimize data, anonymize identifiers, choose secure tools where you know the data policy, be alert to bias, be transparent to the patient, and document the process. Anonymization is the most practical and powerful protection in most cases: data you do not share will not be leaked.

Application task

Prepare a sample patient text containing personal data. Anonymize with the first template and check the result (are there any identifiers left?). Evaluate the data policy of an AI tool you use with the second template. Finally, with the third template, produce a simple draft of the explicit consent/information text for your own clinic.

checklist

  • [ ] I have received explicit consent to process patient data.
  • [ ] I processed only the minimum required data (data minimization).
  • [ ] I anonymized all identifiers.
  • [ ] I checked the data policy (storage, training, KVKK) of the vehicle I use.
  • [ ] I more rigorously validated anti-bias in underrepresented groups.
  • [ ] I transparently communicated the use of AI to the patient and documented the process.
Previous Next