Data protection laws such as Türkiye's KVKK (Law No. 6698) and the EU GDPR treat health data as a special category and attach strict conditions to processing it. A referral between colleagues is also a data transfer.
Three core principles
Necessity: share only what the referral requires. Legal basis: the transfer must rest on the patient's consent or a statutory exception. Security: data should not be scattered in personal photo galleries and general messaging groups.
The risk of personal messaging
A lab result photo sent in a general-purpose messaging app ends up in phone backups, the gallery and sometimes other chats. Who accessed which data cannot be traced afterwards.
How HeliaLoop handles it
HeliaLoop keeps referrals and messaging in a workspace dedicated to physicians, with a separate screen for patient consent. The physician always decides what is shared and on what legal basis. This article is not legal advice; review it with your organisation's data controller.