Health data is the most sensitive kind you can hold.
Patients and clients share things they tell almost no one else. The GDPR sets a higher bar for that information, and a data breach or a careless booking tool can do real harm. A practice that can show clear notices, careful consent and vetted vendors earns trust and avoids avoidable problems.
A higher bar applies
Health data needs an ordinary legal basis plus a specific condition under Article 9, and stricter safeguards. The pack keeps these straight in your forms and notices.
Tools touch the data too
Booking systems, email reminders and payment tools often see names, dates and the reason for a visit. The sub-processor checklist shows what to verify with each.
Keep records, but not forever
Professional rules require you to keep clinical records for a set time. The retention guidance separates those from appointment data you should delete sooner.
Five parts. One careful approach to health data.
Each part stands on its own and also points to the next: the intake form feeds the notice, the notice names your tools, and the DPIA checklist records the risks.
Patient & client intake forms and consent
Collect what you need, and be clear about why.
- Intake form wording that asks for health information only as far as needed
- When consent is needed and when another basis applies
- Explicit consent wording for optional uses such as reminders or testimonials
Appointment & record retention
How long to keep what, and what to do afterwards.
- A suggested approach for appointment data and clinical records
- Notes on national and professional-body differences
- When to delete or anonymise
Sub-processor checklist
Know who sees your patients' data.
- What to verify with each tool: DPA, data location, transfer mechanisms
- Questions to ask before you connect a tool to patient data
Simple DPIA checklist for health data
Decide whether you need an assessment, and document it.
- Whether your processing is likely to be high risk
- The main risks to patients and the safeguards that answer them
- A short record you can keep on file
Privacy notice clauses for clinics Ready to copy
Drop-in wording with fill-in placeholders, one block per topic.
- Health and treatment records
- Appointments, bookings and reminders
- Sub-processors and where data is stored
- Retention and deletion
- Confidentiality and who can see your records
- Your rights and how to ask
Real wording, not a table of contents.
Two short excerpts from the pack. Highlighted fields are the parts you fill in for your own practice.
Health and treatment records
We keep notes about your health and the care we give you, such as your history, assessments and treatment plans, so that we can treat you safely. We use this information only to provide your care and meet our professional and legal duties. It is kept confidential and is available only to the people involved in your care.
We keep your records for [retention period]. Questions can be sent to [privacy@yourpractice.eu].
The full pack adds the legal-basis wording and the national confidentiality references.
Do you need a DPIA for health data?
- Do you process health data for many patients, or across several sites?
- Do you use new technology, such as an online booking or video tool, with patient data?
- Could a breach cause serious harm, for example by revealing a diagnosis?
- Do you share health data with other organisations?
- Have you checked your supervisory authority's list of processing that needs a DPIA?
The full checklist continues with risks, safeguards and a record to keep.
These are shortened starting points. Your own notices and records must reflect what your practice actually does, and health data and professional secrecy rules vary by country. The pack shows you where to check.
Who it's for, and who it isn't.
A good fit if you
- Run a clinic, therapy or counselling practice, or a wellness studio
- Collect health information from patients or clients
- Use standard tools: a booking system, email, online payment
- Have no in-house privacy counsel
Not enough on its own if you
- Run a hospital or large multi-site service processing health data at scale
- Handle genetic data, research data or clinical trials
- Build or run a telehealth platform for others
- Need a signed, lawyer-reviewed contract; the pack is not legal advice
Five parts. One payment.
Everything on this page, delivered together. Adapt it to your practice, update your forms and notices and answer the next patient question from the same documents.
- Patient & client intake forms and consent
- Appointment & record retention guidance
- Sub-processor checklist
- Simple DPIA checklist for health data
- Privacy notice clauses for clinics
Before you ask —
Who is the Clinic & Wellness Compliance Pack for?
Clinics, therapists, counsellors, physiotherapists and wellness practices in the EU that collect health information from patients or clients and want a clear, documented way to handle it.
What do I receive?
Five parts: intake form and consent wording, appointment and record retention guidance, a sub-processor checklist for booking, email and payment tools, a simple DPIA checklist for health data and privacy notice clauses for clinics. You get your download page straight after checkout, with no account to create.
Why is health data treated differently?
Health data is a special category of personal data under Article 9 of the GDPR. Processing it needs both an ordinary legal basis and a specific condition, and calls for stricter safeguards such as tight access control and confidentiality.
Do I need explicit consent to treat a patient?
Not necessarily. Providing health care or treatment, by or under the responsibility of a professional bound by confidentiality, can rely on a different Article 9 condition, and national law shapes the details. Explicit consent is more usual for optional extras such as reminders, testimonials or photos. The pack explains the difference and gives wording for both.
Do I need a DPIA?
A data protection impact assessment is required where processing is likely to result in a high risk, which includes large-scale processing of health data. A single practitioner is not usually considered large scale, but this depends on the circumstances and your national supervisory authority's guidance. The simple DPIA checklist helps you decide and document the result.
How long do I have to keep patient records?
It depends on your country and profession, because health and professional rules set the minimum periods. The retention guidance explains how to separate clinical records from appointment data and leaves the national period as a field for you to confirm.
Is this legal advice?
No. The pack is a practical starting point. Health data rules and professional secrecy duties vary by country and profession, so have a qualified lawyer or your professional body review anything you rely on.
What if it isn't what I expected?
Email hello@gdprgard.eu within 14 days for a full refund. No form to fill in.
Earn the trust that health data requires.
Get the consent wording, retention guidance, vendor checklist, DPIA checklist and privacy notice clauses in one pack.
Get the Pack — €39