Cold outreach for clinics: KVKK + medical advertising rules in 2026

Clinics in Türkiye live under two overlapping rule sets. KVKK (Kişisel Verilerin Korunması Kanunu) sets the floor for any kind of personal-data processing including B2B email lists. Sağlık Bakanlığı’s reklam yönetmeliği (the medical advertising regulation) limits what a clinic can say in any commercial communication. Together they mean clinics cannot send what restaurants can — but they can still do compliant outbound, and the legal envelope is narrower than most clinic owners assume.

What is and is not allowed

Three things to internalise before anything else.

• B2B outbound is allowed. Reaching out to other clinics, suppliers, distributors, lab partners, or insurance contracts under legitimate interest is fine, the same way it is for any other commercial entity.
• B2C cold email is essentially banned. Reaching out to potential patients via cold email requires either prior consent or an existing relationship. The IYS registry will block almost everything else. Do not try it.
• Medical claims are restricted. Even in B2B email, you cannot make therapeutic-outcome claims (“our laser fixes back pain”). You can describe the service category, the patient-volume, the equipment make.

The cleanest legal envelope for B2B clinic outreach

Most clinics find growth on the B2B side rather than the B2C side. Lab partnerships, equipment financing deals, insurance-contract negotiations, supply chain for consumables — all are reachable via cold email under legitimate interest.

The envelope works like this:

• Legal basis. KVKK Art. 5(2)(f) — legitimate interest. Document the LIA as you would under GDPR: necessity, balance, mitigation.
• Channel. Email and LinkedIn are the workable channels. WhatsApp is technically allowed in B2B but is risky because of how WhatsApp’s own TOS treat unsolicited business messaging.
• IYS preflight. Every commercial email to a Turkish address has to be checked against the IYS registry before sending. The check is API-level and takes 100ms. The platform does it on the queue.
• Content limits. No therapeutic claims, no patient testimonials, no before/after photos in the body. Describe the clinic and the offer in operational terms.
• Unsubscribe + suppression. One-click unsubscribe in every message. Suppression honoured forever, hashed at rest, propagated across all future campaigns.

What this looks like in a real campaign

Take a dermatology clinic in Beşiktaş that wants to find new lab partners for histology samples. The campaign looks like this.

Source: clinical labs in İstanbul that publish a price list and accept B2B referrals. 60 prospects discovered via Google Maps + medical-directory enrichment. IYS check on every address — 9 prospects opted out, removed from the queue. Draft generated by AI, reviewed by the clinic operations manager in a 30-second-per-message queue. Approved drafts sent on a 50-per-day cadence to avoid bulk-flag heuristics.

Reply rate on this kind of campaign: 15–20%. Most replies come within five business days. Two to four lab partnerships per campaign is normal.

The mistakes that get clinics in trouble

Three patterns we see repeatedly.

1. Mixing B2C and B2B in the same campaign. Sending the same offer to potential patients and potential lab partners using the same template is a fast way to get reported. Keep the two motions on separate domains, separate suppression lists, separate compliance logs.

2. Skipping the IYS preflight. Sağlık Bakanlığı pays attention to clinic mailing patterns. Repeated sends to opted-out addresses are the easiest way to attract an investigation.

3. Therapeutic claims in the email body. The reklam yönetmeliği applies to any commercial communication, including B2B. The temptation to write “our team has resolved 90% of cases referred to us” is real. Resist it; describe the operation instead.

The tools that fit this regime

Leafer runs IYS preflight on every send, blocks medical-claim language at draft time, and keeps the audit log a Sağlık Bakanlığı inspector would expect. Clinics that adopt the workflow stop worrying about which messages they can and cannot send because the queue answers the question for them. Your job becomes the partnerships themselves, not the legal envelope around them.