Children's data and GDPR: basic rules for therapy clinics

A therapy centre knows things about the children it works with that few other organisations know: diagnoses, evaluation results, behaviours, notes from every session, and sometimes family details. This is data that deserves careful protection, and the General Data Protection Regulation (GDPR) requires exactly that.

What follows is not legal advice. It is a list of basic rules, so you know what questions to ask and where to look more closely. The decisions should be made together with a specialist.

Health data is a special category

GDPR treats health data as a special category. For a therapy centre, that means almost everything clinical: the diagnosis, the evaluations, the intervention plan, session notes, progress reports. The fact that children are involved calls for even more care, because they cannot look after their own interests.

In practice, this data needs a stronger legal basis and more careful protection than, for example, your list of supplier contacts.

Legal basis and informing parents

Any processing of data needs a clear legal basis, and for health data GDPR also requires a special condition. In some situations, this is the parents' explicit consent. In others, it can rest on a different basis. Which one fits each of the centre's activities is a question for a specialist lawyer or a data protection officer.

Whatever the basis, parents need to be told clearly, from the start:

• What data you collect and why you need each piece of it.
• Who has access to it, inside the centre and outside it.
• How long you keep it.
• What rights they have and who to contact about them.

Photos and clips of the child deserve a separate conversation. A clip used within the team to track progress is not the same as a photo posted on the centre's page. For any use outside therapy, ask for the parents' agreement separately and keep a record of it.

Access only for those who need it

A simple principle: each person on the team sees only what they need for their work. The therapist needs the programmes of the children they work with. Reception needs the calendar and contact details, not evaluations. The accountant needs invoices, not session notes.

A few habits matter just as much as the written rules:

• No personal messaging groups for clinical information about children.
• No lists of children and diagnoses sent as email attachments.
• Individual accounts, not one shared password for the centre, so you know who did what.
• Access closed immediately when someone leaves the team.

How long you keep the data

GDPR requires that data is not kept for longer than necessary. For a therapy centre, that means deciding in advance, by category, what happens to a child's data once therapy ends. Some documents, such as accounting records, have retention periods set by other laws. For the rest, decide the retention period together with a specialist and write it into the information you give parents.

Parents' rights

Among the rights parents have over their child's data:

• The right of access: to find out what data you hold about the child and to receive a copy.
• The right to rectification: to ask for incorrect data to be corrected.
• The right to erasure: to ask for data to be deleted, with the exceptions provided by law, for example documents the centre is required to keep.

The regulation requires a response without undue delay, generally within one month at most. Decide in advance who at the centre receives these requests and how they are handled, so you are not improvising when the first one arrives.

When something goes wrong

A lost phone with files left open, an email sent to the wrong person, an account used by someone else: incidents happen even at careful centres. What matters is what you do afterwards:

• Write down immediately what happened, which data is involved and what you did to stop the problem.
• Assess the risk to children and families, together with the specialist you work with.
• Notify the authority: the National Supervisory Authority for Personal Data Processing (ANSPDCP) must be informed within 72 hours at most of when you found out, unless it is unlikely that the incident creates a risk for the people involved.
• Inform families when the risk to them is high.

Who can help you

Some organisations are required to appoint a data protection officer (DPO), depending on their activity and the data they process. Whether your centre falls into that category, which legal basis you use, and how long you keep data are decisions for a DPO or a lawyer specialising in data protection. A conversation at the start is simpler than fixing a mistake later.

In TempoApp

In TempoApp, each person on the team has a role: Admin, Coordinator, Therapist or Reception. Reception works with appointments and families without access to evaluations or clinical reports, and only Admins see the money. Parents sign in with an access code from the clinic and see only their own child. Each clinic's data is kept separate from every other clinic's, an activity log shows who changed what, and an Admin can permanently delete a child's file, along with their sessions and files. What remains are the invoices, which accounting law requires to be kept, and the activity log, which no one at the clinic can edit or delete, so that it stays a complete record of what was done.