Spa guest consultation form: what to ask before a treatment and how to keep it
A spa consultation form records health data that requires strict protection under Turkish law. This guide explains what to ask, how to separate notice from consent, and how to manage access and retention.
Contents
Key takeaways
- A consultation form exists to record a decision, not to collect data: what was asked, what the guest answered, what the therapist did about it and who approved it.
- Under Article 6 of Law No. 6698 (as amended by Law No. 7499 of 2 March 2024), health data is special-category personal data: processing it is prohibited unless one of the listed conditions applies, and the adequate measures set by the Personal Data Protection Board must also be taken.
- The duty to inform applies whether or not the spa relies on explicit consent, and the Authority's communiqué on the duty to inform (Official Gazette 10 March 2018, No. 30356, as amended 28 April 2019, No. 30758) requires the notice to be given separately from consent and worded for a specific, explicit and legitimate purpose.
- No supplied text sets a retention period for spa forms: the spa sets one from its purpose and its ability to defend a claim, writes it into its procedure and destroys on schedule.
A spa consultation form is a short health questionnaire a guest completes before a treatment. It records what the therapist must avoid and what was decided. Because the answers are health data, they fall into a more sensitive category under Turkish personal data law: the spa needs a lawful basis for processing, a separate notice to the guest, restricted access and a retention period tied to its purpose. Confirm your specific legal obligations with a qualified legal adviser.
A clipboard goes round the spa reception with the previous guest's answers still on it: pregnancy, blood pressure, a list of medicines. The next guest reads it while waiting. That one sheet is the whole problem in miniature: the form protects people, and the same form is health data. After reading this you will know what to ask, what to do with a "yes", how the notice and consent duties fit together, and where the form ends its life.
Why does a spa need a consultation form at all?
It does two jobs: it stops a treatment that could harm the guest, and it records that the spa asked, was told and decided.
The therapist cannot see a pregnancy, a blood thinner, a recent operation or a heart condition across the reception desk. The form is the only place those appear before the guest is in the room. It turns a verbal chat into a record: what was asked, what the guest said, what was adjusted or declined, and who made that call.
It protects the therapist as well. A standard massage given after an unexplained "yes" is hard to defend later; a note that says "guest reported recent surgery, deep tissue avoided, guest agreed" is not. It is not a medical examination and not a diagnosis: the spa records and refers, it does not assess clinical risk.
The form also sets expectations before the treatment starts: pressure, areas to avoid, draping and modesty, and the guest's right to stop at any point. Keep it short. A one-page form that gets read beats a four-page form that gets signed unread at the door. The form sits inside the daily operation of a hotel spa, hammam and sauna, and it should follow that rhythm, not slow it down.
What should a spa consultation form ask?
Ask only what changes what the therapist does, in a language the guest actually reads, with answers a non-medical person can give.
Every question must pass one test: if the answer would change nothing in the room, delete it. A longer form collects more health data for no extra safety. Ask about conditions, not diagnoses: "Do you have a heart condition or high blood pressure?" works; "please state your ICD code" does not. For medication, ask for the name only, never the dose, and only for medicines that affect a treatment, such as blood thinners.
Allergies need their own line, covering oils, nuts, latex and fragrances, because the products used in the room are part of the treatment. This is the same logic as the allergy routine we describe for hotel restaurants: the ingredient list matters as much as the question. Print the form in the languages the spa actually serves, and add a line saying a therapist can read it aloud. A form the guest cannot read is a signature, not a record. Keep the "yes" boxes specific and few: a page of vague yes/no boxes teaches the guest to tick "no" to finish faster.
ChecklistThe question set, written as the guest reads it
- Are you pregnant or could you be, and how many weeks?
- Do you have a heart condition, high or low blood pressure, or are you under treatment for either?
- Do you take blood thinners or any regular medicine? Name only.
- Have you had surgery, an injury, a fracture or a hospital stay in the last six months? When?
- Do you have diabetes, epilepsy, asthma or another condition your therapist should know about?
- Skin: any open wound, recent sunburn, eczema, psoriasis or contagious condition?
- Do you have allergies to oils, nuts, latex or fragrances?
- Areas you would rather we avoid, and your pressure preference: light, medium, firm.
- Have you had alcohol or any other substance in the last few hours?
- Anything else we should know before your treatment? (open line)
What does a therapist do with a "yes"?
A "yes" is neither a stop sign nor a green light: it moves the decision onto one of three paths, and the path taken is written on the form.
Path one is adjust and proceed: the treatment goes ahead with a change the therapist can describe, such as lighter pressure over a recent injury, a shorter session or a different position. Path two is proceed only with clearance: the spa asks for a doctor's approval, or for the guest to acknowledge in writing that the risk was explained and they choose to continue. Which of the two the spa requires is a decision for its own lawyer and insurer, not for the therapist at the door. Path three is decline and refer: say it plainly, "this needs a doctor's approval before we can treat you", and offer an alternative that carries no risk.
Key pointThe three-path rule
Adjust and proceed: write the adjustment made, and tell the guest what will change. Proceed only with clearance: write what clearance was asked for, and tell the guest the treatment waits for it. Decline and refer: write the refusal, the reason and the alternative offered, and say it in plain words. If the answer would change nothing, do not ask the question.
Never diagnose and never reassure clinically. The therapist's vocabulary is "we adjust" or "we wait", not "that should be fine". Stop mid-treatment if the guest feels dizzy, numb or short of breath, or asks to stop, and record the stop, the time and what was done next. Write the decision, the time, the therapist's name and the guest's acknowledgment on the same sheet. A form with answers but no decision is a data collection exercise, not a safety record.
Is the form health data under KVKK?
Yes. Health data is special-category personal data under Article 6 of Law No. 6698, and processing it is prohibited unless one of the conditions listed in that article applies.
Article 6 of Law No. 6698 (as amended by Law No. 7499 of 2 March 2024) lists health data alongside race, ethnic origin, political opinion, belief, dress, membership of associations, sex life, criminal convictions and biometric and genetic data, and states that processing this category is prohibited. The article then allows it only in defined cases, according to the consolidated text of Law No. 6698 on the Presidency's legislation database (opens in a new tab): the person's explicit consent; where expressly provided for in law; where necessary to protect the life or bodily integrity of someone who cannot consent or whose consent has no legal validity; where the person has made the data public and processing follows their intention in doing so; where necessary to establish, exercise or protect a right; where necessary for public health, preventive medicine, diagnosis, treatment and care carried out by people under a duty of confidentiality or by authorised institutions; where necessary for legal obligations in employment, occupational health and safety, social security and social services; and for certain non-profit bodies, limited to their members and their field of activity.
Which of those conditions fits a hotel spa is a question for the hotel's lawyer. Explicit consent is the common route, but it is not the only one, and the others do not disappear because a consent box exists. Article 6(4) adds a second requirement: the adequate measures set by the Personal Data Protection Board must also be taken. A lawful condition without those measures is not enough.
The medium changes nothing. A paper sheet on a desk, a tablet at reception and a record in the hotel system are the same data under the same rules. Collect less and you risk less: a form that asks only what the treatment needs is easier to justify than a full medical history kept for years. The wider duties, from notices to staff access, are the ones we describe for KVKK in hotels: notices, consent, staff access and retention.
What must the guest be told, and why is that separate from consent?
The duty to inform applies in every case where personal data is processed, and the communiqué requires the notice to be given separately from explicit consent, before processing starts.
The Authority's communiqué on the duty to inform (opens in a new tab) (Official Gazette 10 March 2018, No. 30356, as amended in the Official Gazette of 28 April 2019, No. 30758) applies whether the spa relies on explicit consent or on another condition in the law. Consent does not replace the notice. The purpose stated must be specific, explicit and legitimate, and the wording must not be general or vague, or hint at other purposes that might arise later. "For your comfort and our service quality" fails that test; "to decide which treatment is safe for you today" passes it.
When the purpose changes, a new notice for that purpose is required before the new processing. If the answers later feed marketing, staff training or a group-wide guest profile, that is a new purpose with its own notice. The notice does not depend on the guest asking for it, and the burden of proving it was given sits with the data controller, so keep a dated copy of the exact text the guest saw. Ask your lawyer to confirm the full contents your notice must carry and the wording you use.
| Notice (aydınlatma) | Explicit consent (açık rıza) | |
|---|---|---|
| What it is | Telling the guest what happens to their data | A separate permission for processing |
| When it happens | In every case, before processing starts | Only where the spa relies on it as its condition |
| Wording | Specific, explicit, legitimate purpose; not vague | Related to that purpose |
| What it does not do | It is not consent | It does not remove the notice duty |
| How you prove it | Dated copy of the exact text; burden on the controller | Its own signature and date |
| Purpose changes | A new notice is required before the new processing | Revisit whether the consent still covers it |
One signature line reading "I have read the notice and consent" collapses two different acts into one and weakens both.
Who may read the form, and how long do you keep it?
The therapist treating the guest and the person responsible for the spa, and nobody else by default. No supplied text sets a retention period, so the spa sets one from its purpose and writes it down.
Name the roles in the procedure, not "all front desk". A form that any staff member can open is a form that will be read for reasons unrelated to the treatment. Paper belongs in a locked drawer or cabinet in the spa, not on the reception counter and not in the treatment room, with no photocopies and no second copy in the guest file. Digital access follows the role, not the shift: a tablet that clears the screen after submission, and a system that records who opened the record and when.
Retention: decide from the purpose. The answers are needed while the guest is on property and for as long as the spa may need to answer a later question about the treatment. Write the period into the procedure, destroy on schedule and keep a destruction record that shows what was destroyed and when. Guests can ask what is held about them and ask for correction or deletion where the conditions allow; give them a route and a named person. Sharing a guest's form across a group's properties, or sending it abroad, is a question for counsel, not a default that follows from a shared reservation system. The same discipline applies to what a hotel registration card asks and what you keep.
Watch outThe clipboard at reception
The common failure is a clipboard or shared tablet left at reception with the previous guest's answers visible. Three fixes: a covered or cleared screen, a named handler, and a locked place between treatments.
The one-page form, field by field
One page, front and back at most: identity, the questions, the decision, the notice reference and the signatures, in that order.
Put the therapist's section on the same sheet as the questions. A decision recorded on a separate page gets separated from the answers it belongs to. Keep the notice reference short on the form itself: title, version, date and where the full text is available. The full notice is a separate document the guest can take away. The consent line, where the spa relies on consent, gets its own signature and date, physically apart from the notice reference. Offer the guest a copy: it costs one page and it answers most later questions about what was asked.
Checklist
- Header: hotel and spa name, date, time, therapist
- Guest: name, room number or contact, age band only if the treatment needs it
- Language of the form, plus a line saying a therapist can read it aloud
- The question set with yes/no and a short details line
- Areas to avoid and pressure preference
- Guest declaration: answers complete to my knowledge, and I will tell the therapist if anything changes
- Notice reference: title, version, date, where the full text is available
- Explicit consent line with its own signature and date, where used
- Therapist section: path taken, adjustment made, name, signature, time
- Footer: retention period, destruction date, responsible person
Review the form once a year with the therapist team and the person responsible for data protection: delete questions nobody uses, add what the team keeps asking verbally.
What to do next
Take the form you use today, delete every question whose answer would change nothing in the room, move the consent signature away from the notice reference, and write a destruction date on the footer. Then walk the whole flow, from the clipboard at reception to the drawer it ends in, with your therapist team and the person responsible for data protection, and have your lawyer confirm the processing condition and the notice wording before the next season.
Frequently asked questions
Can a spa refuse a treatment if the guest answers yes to a health question?
Yes. A spa can decline a treatment it cannot deliver safely, and should say why in plain words. Offer an alternative that carries no risk, refer the guest to a doctor where clearance is needed, and record the refusal, the reason and what was offered. Refusing is a safety decision, not a data decision.
Does the guest have to sign the spa consultation form?
A signature is not what makes processing lawful: the lawful condition under Article 6 of Law No. 6698 and the notice do that. The signature records that the answers were given and read. If a guest will not sign, the spa decides whether it can treat safely without the record and writes that decision down.
Can the consultation form be filled in on a tablet instead of paper?
Yes, and the duties do not change with the medium. The tablet must not leave one guest's answers visible to the next, access must follow the role, and the record needs the same retention period and destruction date as paper. A screen that stays open at reception is the clipboard problem with a battery.
Is a spa consultation form the same as a medical consent form?
No. The consultation form records what the therapist needs to know before a treatment and what was decided. A medical consent form belongs to a clinical setting with a clinician. Where a doctor's clearance is needed, the spa asks the guest to bring it rather than writing its own clinical document.
Sources
- Aydınlatma Yükümlülüğünün Yerine Getirilmesinde Uyulacak Usul ve Esaslar Hakkında Tebliğ (current text) (opens in a new tab)Kişisel Verileri Koruma Kurumukvkk.gov.tr
- Kişisel Verilerin Korunması Kanunu (Kanun No. 6698), consolidated text, Article 6 (as amended by Law No. 7499) (opens in a new tab)T.C. Cumhurbaşkanlığı Mevzuat Bilgi Sistemi (mevzuat.gov.tr)mevzuat.gov.tr