GDPR • Sensitive data
GDPR for therapy practices: how to protect clients' sensitive data
Mental-health data is sensitive data, with special protection under GDPR (special category, Art. 9). A therapy practice must be able to show how it collects, stores and accesses this data. Below you'll see how to protect clients' sensitive data under GDPR, without the jargon.
The essential measures (short answer)
- Request and record explicit consent for processing sensitive data.
- Encrypt data at rest and in transit.
- Limit access to data: each team member should only have the access they need.
- Keep an access log: who read which data and when.
- Define a retention period and respond to data-subject requests.
The client's rights
- Right of access: the client can request a copy of their personal data.
- Right to rectification: they can ask for an incorrect record to be fixed.
- Right to portability: they can receive the data in a reusable format.
- Right to erasure, within the limits of legal record-retention duties.
Table: GDPR requirement and how to meet it
GDPR requirements for a therapy practice
| Requirement | How to meet it |
|---|---|
| Legal basis | Explicit consent or a legitimate care interest |
| Security | Encryption, access log, backup |
| Access | Role-based rights, authentication |
| Incidents | Notification within 72 hours |
Common mistakes
- Keeping client data in an unencrypted file, accessible to the whole team.
- Having no access log, so you cannot prove who read the data.
- Using hosting services outside the EU, without adequate safeguards.
How 4therapy helps
- Encryption at rest of session notes and sensitive client data, by design.
- Roles that can be assigned to team members, and an audit log of access.
- Recorded consents, retention policies and data export for data-subject requests.