Name, phone number, email, date of birth... and, in many practices, session notes, diagnoses, care plans or medical reports too. All of that is personal data, and a good part of it is health data, which the General Data Protection Regulation (GDPR) treats as especially sensitive.
The good news is that complying doesn't require being a lawyer or hiring a big consultancy. It requires knowing what data you have, why you have it, where you keep it and who can see it. Let's take it step by step.
This article is for guidance only and is not a substitute for legal advice. If you have questions about your specific situation, ask a data protection professional or your professional association.
Does the GDPR apply to me if I work on my own?
Yes. The GDPR and the Spanish law that implements it (the LOPDGDD) apply to any person or company that handles personal data as part of their professional activity, whether you're self-employed, run a company or see ten clients a month.
And if you work with health data — psychology, therapies, nutrition, physiotherapy and other healthcare or wellbeing disciplines — the bar is higher, because it's a special category of data. In a veterinary clinic, the animal's data isn't personal data, but the owner's data is.
What you need to have in order
1. Inform your clients before collecting their data
Everyone has the right to know who handles their data, what for, for how long, who it's shared with and how to exercise their rights. The usual way is a privacy notice that the client receives when they sign up or at their first appointment, written clearly, with no small print.
2. Have a legal basis for each use
You don't need to ask for consent for everything. To see someone and manage their appointments and invoices, the basis is usually providing the service itself and legal obligations (such as tax rules). But if you want to use that data for something else — for example, sending a newsletter or publishing a testimonial — you need specific consent, freely given and as easy to withdraw as it was to give.
3. Keep a record of what you do with the data
The record of processing activities is a document describing what data you handle, for what purpose, how long you keep it and what security measures you apply. Small businesses are often exempt, but that exemption doesn't apply when health data is processed on a regular basis, so most practices need one.
4. Protect the data with appropriate measures
The GDPR doesn't give a fixed list of measures: it asks for security proportionate to the risk. With health data, that means at least:
- Controlled access: only those who need it can see the information, with their own passwords that aren't shared.
- Encryption of stored information and of anything you send.
- Backups, so nothing is lost if a device fails.
- No client data on an unprotected personal phone, on a USB stick or on a computer the whole family uses.
5. Sign an agreement with anyone who handles data for you
If you use practice management software, an accountant or a cloud service that stores your clients' data, that provider is a data processor. The law requires an agreement (or terms) setting out how they handle it, what security measures they apply and what they do with it when you stop working together. Ask any provider for it before you start.
6. Respond to your clients' rights
Any client can ask you to access their data, correct it, restrict its use, object to some processing or, in certain cases, erase it. You have one month to respond. Meeting that deadline is much easier if all their information is in one place rather than spread across notebooks, emails and chats.
7. Know what to do if something goes wrong
If you lose a laptop with client data, someone gets into your account without permission or you send a report to the wrong person, that's a personal data breach. If it poses a risk to the people affected, it must be reported to the Spanish Data Protection Agency (AEPD) within 72 hours, and in serious cases, to the people affected as well.
How long to keep information
Data can't be kept forever "just in case": only for as long as needed for the purpose it was collected for and to meet legal obligations. Two common examples:
- Invoices and tax data: tax rules require you to keep them for several years.
- Clinical records: if you're a healthcare professional, Spain's patient autonomy law requires you to keep them for at least five years after each episode of care ends.
After that, the right thing to do is delete or anonymise the information.
The most common mistakes in small practices
- Using personal WhatsApp to send reports or results. It mixes your data with your clients' and you have no control over where that information ends up.
- Keeping session notes on paper without safe storage, in a folder anyone can open.
- Emailing several clients at once without BCC, leaving their addresses visible to everyone.
- Sharing the practice software password with other people in the practice.
- Copying and pasting a privacy notice from the internet that doesn't match what you actually do.
- Not knowing where your providers store the data or whether you have an agreement with them.
How SIKIO helps
A tool won't make you GDPR-compliant on its own — decisions about what data you collect and why are still yours — but it can take a good share of the day-to-day risks off your plate. With SIKIO CORE:
- Each client's information lives in their profile, with their history and documents in one place instead of scattered across paper, email and chats. That makes it much easier to respond when someone asks to access or correct their data.
- Data is stored encrypted, with daily backups.
- Your clients have their private space to receive and send you documents securely, without going through WhatsApp or email.
If you'd like to know more about organising your patients' information, we cover it in organised clinical records.
If you'd like to try it with no commitment, you can try SIKIO for free until the end of 2026 — and because we're a small team, if you have questions you talk directly to us, not to a bot.