A medical tourism agency needs about three dozen things from a clinic, hospital or hotel before it can send a patient: proof of licence and liability insurance, accreditation, named doctors with register numbers, a dated price list in one currency, line-by-line package contents and exclusions, response times, a named coordinator, patient-photo consent, commission terms and a data-protection pack. To our knowledge no regulator or standard prescribes a fixed “provider pack”; the 36 items here are onMESSE’s own checklist, built from what national rules already require providers to disclose and from what agencies ask in due diligence, and 14 of them are core items. Tick what you can already send and the page assembles a one-page provider data sheet and a cover e-mail; the facility name and everything you type stay in your browser.
Tool
An agency that sends patients abroad puts its own name on every provider it recommends, so before it sends the first case it asks the same questions of every clinic, hospital and hotel: who exactly are you, who vouches for you, who treats, what does it cost, what is included, who answers, and what happens to the patient’s data. A provider that answers all of that in one pack is easier to onboard than one that answers it over a dozen e-mails. This checklist turns those questions into 36 items and turns your ticks into a one-page data sheet you can send.
The checklist sits at the top of this page next to a live A4 sheet. Eleven group cards list the items. Mark an item ready to send, or in progress, and the sheet beside the list gains a line; type your facility name and contact details and the letterhead fills in, while the stamp shows your readiness score. “Print or save as PDF” prints only the sheet, and the cover e-mail under the checklist is written from the same ticks. Choose “hotel or recovery residence” and the clinical items disappear. The facility name and everything you type stay in your browser; the page link carries only the ticks.
There is no register of provider packs and, to our knowledge, no regulator or standard that prescribes one. ISO 22525:2020 (Tourism and related services — Medical tourism — Service requirements) sets requirements and recommendations for facilitators and healthcare providers, and it excludes thalassotherapy centres, medical spas and wellness spas. The 36 items on this page are therefore onMESSE’s own checklist, assembled from what national rules already require providers to disclose and from what agencies ask in due diligence. Several are legal duties, shown in the table below.
The consent and data items carry weight for a reason: infringements of the GDPR’s consent and special-category rules (Art. 5, 6, 7 and 9) and of its transfer rules (Art. 44 to 49) can draw administrative fines of up to EUR 20 million or, for an undertaking, 4% of total worldwide annual turnover of the preceding financial year, whichever is higher (Art. 83(5)).
Each item says why agencies ask for it, what a good version looks like, the mistake that costs time and the document that proves it. Items marked “Core” carry the highest weight in the readiness score. Items marked “Clinics and hospitals” are hidden when you choose the hotel or recovery residence option.
Who you are legally and who permits you to treat patients: the first thing an agency verifies.
Independent proof that your processes meet a recognised standard, in a form the agency can check.
The agency names doctors to patients, so it needs names, register numbers and experience.
What you treat and what it costs, in a form an agency can quote from.
What the patient gets for the price, and what is not in it.
How a case moves from first enquiry to follow-up, and how fast you answer.
The people and the languages an agency and its patient will deal with.
What the place looks like and how patients and companions get there and stay.
The images an agency may use, and the consent and advertising rules behind them.
Who vouches for you, and what happens when something goes wrong.
The money and data arrangements an agency signs up to.
Turn the sheet into your Health onMESSE profile. Exhibitors at Health onMESSE present this information to agencies in one profile. Exhibit at Health onMESSE and choose the package that fits, or see what exhibitors get.
Two worked examples: ticking only the 14 core items scores 51 for a clinic and 54 for a hotel (whose 11 core items weigh 33 of 61 points), and marking all 36 items in progress scores 40.
The sheet has a letterhead with your facility name, a stamp with your score, a contact block and the eleven groups, each with a check mark for every item that is ready and “to follow” for every item in progress. Items you have not ticked do not appear, so the sheet never claims more than you have. It is self-declared: an agency will still ask for the documents behind each line, which is why every item names its evidence.
Use the print dialog of your browser and choose “Save as PDF” to get a file you can attach. The cover e-mail lists the same items in plain text with a subject line, ready to paste into your mail program. Both are generated in your browser; nothing is uploaded.
Türkiye’s Regulation on Promotion and Information Activities in Health Services (Official Gazette 12 November 2025, No. 33075, which replaced the 2023 regulation) makes patient images conditional on the patient’s explicit consent on the standard form in its Annex 1 (Art. 7(1)(b)). The patient may see the content before it is published and may withdraw consent at any time (Art. 7(1)(c)), and nothing may be paid, discounted or given in return for consent (Art. 7(1)(d)). Before-and-after images must be taken under the same conditions and technical settings with the procedure and viewing dates stated (Art. 7(1)(f)), and images from during a procedure cannot be shared (Art. 7(1)(h)). For promotion aimed at patients abroad, patient stories, reviews and thank-you messages may be published if privacy is respected and written consent is documented (Art. 8(1)(ç)).
Under the GDPR, health data is a special category (Art. 9) and the consent that lifts the prohibition must be explicit (Art. 9(2)(a)) and withdrawable at any time (Art. 7(3)); see special-category data and informed consent. Advertising rules for health services are set largely at national level, and some markets restrict before-and-after comparisons: in Germany, § 11(1) sentence 3 no. 1 of the Heilmittelwerbegesetz (HWG) bars advertising for operative plastic-surgery procedures without medical necessity (§ 1(1) no. 2 lit. c) by comparing the body or appearance before and after the procedure. Check the rules of each market in which an agency will use your material.
Under Art. 8(1) of the same regulation, a Turkish facility promoting international health tourism publishes its health tourism authorisation certificate on its website or social media (b), uses the HealthTürkiye logo on all media (e) and shows the facility name and URL exactly as in its licence (f). Promotion aimed at creating demand among people living in Türkiye is not allowed (c). The authorisation guide explains how the certificate is obtained.
Health data is special-category data under GDPR Art. 9 and under Art. 6 of Türkiye’s Law No. 6698 (KVKK), whose processing conditions were rewritten by Law No. 7499 (in force 1 June 2024). KVKK Art. 9, also rewritten, allows transfers abroad on an adequacy decision or, without one, on an appropriate safeguard listed in the article (in both cases a processing condition under Art. 5 or 6 must also be met); the GDPR’s transfer rules are Art. 44 to 49 (see adequacy decision and standard contractual clauses). In practice the data-protection item asks for three things in writing: who is responsible for the patient’s data at each step (controller and processor), on what basis it moves between provider and agency, and where it is stored. A data processing agreement usually covers the first two.
Agencies: Health onMESSE is free for agencies. Join as an agency to find and compare providers, and use the clinic due-diligence scorecard to check what you receive.
Agencies can send this checklist as the standard request to every new provider. The pack is the provider’s side of the same file that the clinic due-diligence scorecard scores on the agency’s side, and the clinic contract checklist covers what to sign afterwards. Asking every provider for the same 36 items also makes providers comparable; the commission guide explains how the commission and net rates in the terms group work, and the accreditation comparison shows how to read the accreditation item. Hotels can check themselves first with the hotel readiness check.
More planning tools for this fair are in the Health onMESSE tools directory, and the fair itself is at Health onMESSE.
العربية · Deutsch · Español · Français · Nederlands · Türkçe