“Would I want a copy of myself that knows my future before I do?”
I recently read that Concurrence, a US health technology company, is building AI agents for hospitals. The company is reportedly working on “building a digital twin of the patient”. This twin would examine a person’s health history spanning years, update itself as new information arrives and forecast how their health will unfold.
The aim is also to capture the data lost between doctor visits and check-ups; to see possible illnesses before they happen and to intervene. The technology is still in development, but the news alone raises many questions for us lawyers.
First, the positive side: if it works properly, such a model could help catch an illness before it appears and tailor treatment to the individual. Records whose integrity is preserved, showing which information was obtained when, also make it easier to establish the truth.
The Turkish Personal Data Protection Law (KVKK) treats health data as special category data and, as a rule, prohibits its processing (Article 6). There are exceptions: explicit consent, or necessity for diagnosis, treatment and care by persons and institutions under a duty of confidentiality. The adequate safeguards set by the Personal Data Protection Board are also mandatory.
Yet the sentence “build my digital twin with all my health data” does not, on its own, amount to valid explicit consent. Which data will be shared, for what purpose, with whom and for how long? Anonymising it and sharing it with third parties is another matter altogether.
The truly worrying scenario is this: what if an illness your digital twin predicts lands on the desk of an insurer, an employer or a bank? We could be excluded because of a probability calculation, before we are even ill. Article 11 of the KVKK grants the right to object to an adverse outcome arising exclusively from automated analysis. But to object, we first need to know that such a decision was made! And unlawful recording of personal data carries a prison sentence that is increased by half where health data is involved (Turkish Penal Code, Article 135).
The human side matters even more. At your appointment, will the doctor listen to you first, or to the digital twin speaking before you on the screen? Would you want to learn that you are very likely to develop an incurable illness in a few years? Do not say yes too quickly. Isn’t the right not to know just as valuable as the right to know?
I am not against technology; a digital twin that strengthens the doctor’s hand and stays under our control would be exciting. But if the twin knows more about me than I do, I must be able to limit it, challenge its forecasts and ask for it to be deleted. Will that always be possible?
Would you want a digital twin of your own? More importantly, who will inherit that twin once we are gone?
Sources
- Concurrence, “Superintelligent Care” research page
- Concurrence and Databricks partnership announcement, “Health World Models That Predict Patient Outcomes” (22 September 2026)
- Personal Data Protection Law No. 6698, Articles 6 and 11 (official Turkish text)
- Turkish Penal Code No. 5237, Article 135 (official Turkish text)
- Regulation on Personal Health Data (Official Gazette, 21 June 2019, No. 30808) (official Turkish text)
