Special category data in a small clinic or studio

A tattoo studio asking about medication. A massage therapist recording an old back injury. An aesthetics practitioner taking a full medical history. A podiatrist noting a diabetes diagnosis. A salon recording a scalp condition and an allergy.

All of those are health information, which UK GDPR treats as special category data with a higher bar than ordinary personal data. Very few small practices have ever been told this in plain terms, and most are already handling it perfectly sensibly by instinct while having nothing written down.

This is a practical summary and not legal advice.

What counts

Special category data covers health, race or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, genetic and biometric data used for identification, sex life and sexual orientation.

For a service business it is almost always health. It includes anything that reveals health rather than only what is stated outright. A note that somebody is undergoing chemotherapy is health data whether it appears as a diagnosis or as a reason for a change of treatment.

Criminal offence data is handled under separate rules again, which matters to anybody doing DBS style checks on staff.

The bar is higher, and it is a specific bar

Ordinary personal data needs a lawful basis. Special category data needs a lawful basis and a separate condition under Article 9, and the two are not the same thing.

Explicit consent is one route and it is not always the best one, because consent has to be freely given and easy to withdraw, which sits awkwardly when you genuinely cannot perform the treatment safely without the information.

Practitioners providing health or social care may be able to rely on a health related condition instead. Which one applies depends on what you actually do, and it is worth getting a straight answer once rather than assuming.

What that means in practice

• Ask only for what affects the treatment. A full medical history for a service that needs to know about two things is over collection, and over collection is the most common failing.
• Explain why you are asking on the form itself. One line next to the question does more for trust and compliance than a privacy notice nobody opens.
• Keep it in a structured field rather than a free text box. Data you can find is data you can protect, restrict and delete.
• Restrict access by role. Reception does not need to read a medical history to take a payment or book a follow up.
• Encrypt it at rest and make sure it is not sitting in an email inbox, a spreadsheet or a photograph of a paper form on somebody's phone.
• Set a retention period and stick to it. Clinical records are often kept longer for good reason and that reason should be written down rather than assumed.
• Consider whether you need a data protection impact assessment. Large scale processing of health data usually triggers one, and it is a useful exercise even when it does not.

Paper forms are not a loophole

A filing cabinet of consultation forms is processing special category data in exactly the same way as a database, with worse security, no access control, no audit trail and no realistic way to answer a request for erasure.

If a client asks what you hold about them, a drawer of forms in date order is a genuinely awful afternoon. Digital records with a search box are a two minute job.

The things worth doing this month

Write down what special category data you collect, why you collect it, which condition you are relying on, who can see it and how long you keep it. That is most of an Article 30 record and it is the document that turns a vague worry into a settled question.

Then look at your intake form and delete every question you do not act on. It is the fastest compliance improvement available and it makes the form better for the client at the same time.