Gains:
- Ability to understand and implement the fact that the child's data is special data and that it must be anonymized within the scope of KVKK and confidentiality and requires family consent.
- Ability to evaluate artificial intelligence tools in terms of data security, storage and use in model training and choose the safe one
- Ability to maintain ethical boundaries such as diagnostic authority, stigma, discrimination and the best interest of the child in the workflow
A child's developmental file carries that child's most intimate information: developmental history, family situation, screening results, observations, and sometimes medical information. When this information falls into the wrong hands or is misused, it can harm the child for years to come: a label, a stigma, a discrimination. Therefore, protecting children's data is one of the most serious responsibilities of the child development specialist; In the age of artificial intelligence, this responsibility is multiplied, because pasting data into a tool takes seconds and cannot be undone. In this unit, we will cover the legal status of child data, evaluation of artificial intelligence tools in terms of privacy, and ethical boundaries.
First, the legal basis: In Türkiye, KVKK (Personal Data Protection Law) regulates the processing of personal data. The child's health and development data are in the category of special personal data; This category is subject to the highest level of protection. In Europe, its equivalent is GDPR. In the case of a child, the sensitivity is even greater, because the child cannot give valid consent on his or her own data; Consent (informed explicit consent) is obtained from the legal representative, that is, the family. The principle of "best interest of the child" prevails in every decision.
Anonymization: the most basic and powerful step
The most basic, most practical step that protects privacy when working with artificial intelligence is anonymization: removing all identity-revealing information (name, surname, TR ID number, date of birth, school/institution name, address, protocol/file number, family names) from the data and using only the non-identified information necessary for your task. Writing "3 years and 2 months old girl" instead of "Elif Kaya, 3 years and 2 months, Papatya Kindergarten" does the job of data but preserves the identity.
A word of caution: identity can reemerge when multiple small details come together (this is called re-identification). For example, details such as "The only twin in village X, his father is the headman" can identify the person even if there is no name. Therefore, it is necessary not only to delete the name but also to generalize the details that make it unique.
Raw (cannot be shared)
Anonymous (shareable)
Elif Kaya, TC 123..., born 12.03.2022.
3 years 2 months old girl
Papatya Kindergarten, 3-A class
preschool institution
His mother is Ayşe and his father is Mukhtar.
parents
File number 2024/187
(removed)
Attention: Uploading the child's identity information, full report or photo to a publicly available artificial intelligence tool is a violation of KVKK and privacy and cannot be withdrawn. The data goes to an external server and some tools can use it for model training. Always anonymize before uploading.
Tool selection and data lifecycle
Not every AI tool has the same level of privacy. When evaluating a tool, ask: Does it use efficiency in training the model? Where does it store data and for how long? Does it offer a data processing agreement (for corporate use)? Where are their servers? Corporate, contracted, and training tools that do not use your data are safer than publicly available free tools. However, even in the most secure tool, do not share unnecessary credentials — anonymization is the first defense in all circumstances.
Consider the data lifecycle: collect data (validate), process (as needed), store (secure, timed), share (authorized only, anonymous), and delete (when done). Anything you stick in AI tools runs the risk of falling outside of this loop.
Tip: Put a hard rule at the top of your favorite prompts: “I will not share any information that identifies the child or family in this conversation.” Making this a control reflex prevents the most common violation (absentmindedly pasting ID).
Ethical boundaries: diagnosis, stigma, discrimination
Privacy is a technical issue, but ethics is broader. Three boundaries are critical. Diagnostic authority: child development specialist conducts screening and developmental assessment; Definitive diagnosis is the job of the relevant physician/clinical team. Artificial intelligence does not know this limit; you will protect. Stigma: marking a child with an early and permanent label (in the file, in the family, in your own mind) is unfair to the child and can negatively impact their development. Discrimination and bias: AI may reflect biases in training data; It may produce biased results regarding a particular culture, gender or socioeconomic group. The expert should notice these and correct them. Above all this stands the principle of the best interests of the child: is every decision for the good of the child?
Four copyable prompts
1) Anonymization prompt:
I will give you a text. Remove any information that may reveal the identity of the child or family (name, surname, TR ID, date of birth, school/institution, address, file number, unique details); replace with general expression([girl], [pre-school institution]). Generalize not just the name, but also unique details that may identify the person. List what you removed.Text: [raw]
2) Vehicle privacy evaluation prompt:
Give me a checklist of privacy questions I should ask to decide whether I can use an AI tool with child data (is the data used in education, retention, contract, server location, deletion). Don't make up the answers; just list the questions.
3) Ethics/limit of authority control prompt:
Ethically review the following text: (1) does it make/imply a diagnosis? (2) is there a stigmatizing label? (3) are there cultural/gender/socioeconomic biases? Highlight each problem and suggest a corrected, cautious alternative.Text: [draft]
4) Family consent information text prompt:
Draft a brief NOTIFICATION/CONSENT text to the family that simply explains how I will use and protect the child's data. It includes: which data, for what purpose, how it is protected, with whom it is shared, right of withdrawal. Providing legal advice; Note that it is a draft and must be approved by the institution.
three mini cases
Case 1 — Identity upload violation. On a busy day, a specialist pastes a child's development report, complete with full name and ID, into a public tool and says "summarize." The data left the institution and family consent was not obtained. The correct way was to anonymize the data with the 1st prompt and use only anonymous information in a secure tool. This violation is both a legal and ethical issue and cannot be reversed.
Case 2 — Re-identification. An expert deletes the name but leaves the detail "the only triplet in the village, his father is an imam." This detail identifies the child even without a name. The expert deepens the anonymization to generalize unique details: “a child of multiple pregnancy living in a rural area.” Identity is now protected.
Case 3 — Bias correction. AI produces a biased assumption implicit in the content about a low-income family, such as “involvement is often inadequate in these families.” The expert catches this with the 3rd prompt; finds the statement unsubstantiated, stigmatizing and discriminatory and removes it. It rewrites the content in a language that sees every family as equal and respected.
Weak prompt / Strong prompt
Weak prompt:
I'm pasting Elif's full report here, evaluate and recommend a diagnosis.
Problem: identity information is shared (KVKK violation), diagnosis is requested (authorization excess), no consent, safe vehicle is not questioned.
Powerful prompt:
Edit the following ANONYMOUS development summary (identification information removed) for the evaluation DRAFT. Making a diagnosis; using stigmatizing labels; Avoid biased assumption. Mark [let an expert evaluate] where you are not sure. Summary: [anonymous]
Common mistakes
- Uploading credentials: The most common and most severe violation; always anonymize.
- Superficial anonymization: Just deleting the name is not enough; generalize unique details as well.
- Not questioning tool privacy: Avoid tools that use your data for education.
- Crossing the diagnostic boundary: Assessment is not diagnosis; The authority lies with the physician/team.
- Not recognizing bias: Fix stigmatizing/discriminatory assumptions of AI.
In summary
Child data is special personal data; It requires the highest protection within the scope of KVKK and confidentiality and consent is obtained from the family. The strongest defense when working with AI is anonymization — generalize not just the name, but also unique details that may identify the individual. Evaluate tools for privacy; Choose the safe one that does not use your data in training. Maintain ethical boundaries (diagnostic authority, stigma, discrimination/bias) and consider the best interests of the child in every decision.
Application task
Take a non-anonymised (authentic, from your own records) progress note; Without reflecting it on the screen, anonymize it manually using the logic of the 1st prompt and list every information you have extracted. Evaluate an AI tool you use in terms of privacy with the 2nd prompt. Check a draft for ethics/bias with prompt 3. Note at least three corrections you made (one anonymization, one ethics, one bias).
checklist
- [ ] I anonymized the data; I also generalized unique details.
- [ ] I evaluated the tool I used in terms of privacy; I chose the safe one.
- [ ] I obtained family consent when necessary.
- [ ] I maintained the diagnostic authority limit; I applied the evaluation-diagnosis distinction.
- [ ] I removed stigmatizing tags and discriminatory/biased expressions.
- [ ] I considered the best interests of the child in every decision.
- [ ] I have not uploaded the credential to any vehicle.