You open an intake form copied from another centre. It asks for an address, identity number, occupation, medication, medical history and permission to send offers. Before adding your logo, pause at each box: can you explain why your own practice needs this answer?
A useful form supports the session and respects the person completing it. This article offers a practical review for a practice subject to the EU General Data Protection Regulation, or GDPR. It is not a ready-made legal form: the right wording and arrangements depend on your actual services, professional status and applicable rules.
Give every question a job
Separate appointment details from information needed to discuss the session. A way to contact the person about a booking has a different purpose from a note about an agreed adaptation. “The previous form included it” is not a useful explanation for collecting either.
Create a working sheet with three columns: question, purpose and who needs the answer. If you cannot complete the last two columns, reconsider the field. The GDPR’s data minimisation principle requires information to be limited to what is necessary for its purpose.
For example, do you need a postal address at the first enquiry, or only particular billing details later? Does everyone who handles appointments need to see session notes? These are questions to resolve in your own workflow, not instructions to remove information that another applicable obligation requires.
Treat health information as a separate decision
A wellbeing service can still receive health information. A free-text box may contain a diagnosis even if its label only says “anything we should know”. Calling the document a wellbeing questionnaire does not make that information ordinary contact data.
The European Data Protection Board explains that health-data processing needs an Article 6 legal basis and an applicable Article 9 condition. Do not assume every massage practice can use a healthcare exception.
Decide what you genuinely need to know, why you must record it and how you will handle it before requesting a detailed history. Where the basis is unclear, obtain advice for your actual situation. Agreement to receive a massage is not, by itself, a complete arrangement for processing sensitive information.
Explain the form where the person uses it
A client should not have to search your website to understand who receives the answers. Put a short explanation beside the form and make the complete privacy information easy to open. The EDPB guidance on transparency supports providing information when data is collected, using clear layers where helpful.
Your explanation should match your actual organisation, purposes and arrangements. Identify who is responsible and how someone can contact them. Explain retention or the criteria used, relevant recipients and rights in the complete notice. Do not paste another centre’s identity, promise absolute confidentiality or describe software you do not use.
Keep any optional promotional choice separate from the session. A person asking for an appointment has not thereby asked to join every future campaign. Do not hide unrelated marketing inside a required acceptance box.
Write notes that help the next decision
Compare “difficult client” with “asked for a quieter session; preference respected”. The second is a factual description of an interaction. It avoids a judgement that someone else could interpret without context. Record relevant observations and agreed changes within your professional role; do not turn notes into unsupported diagnoses.
Use a consistent place for those notes. If some live in a notebook, others in a personal phone and another copy in email, answering “where is this person’s record?” becomes unnecessarily difficult. A simple system that people actually follow is easier to review than several overlapping habits.
Check access, then follow the record to its end
The EDPB security guidance covers safeguards appropriate to the data and risks. Apply that thinking to your room: who can read an open screen, take a paper folder or use a shared account?
Walk through the process with an empty example. Check where it is saved, who can open it and what happens when a colleague leaves. Decide how you will review retention, handle a correction or access request and remove data when appropriate. Do not invent one storage period for every document; billing, professional records and enquiries may need different decisions.
Finally, test the form as a client. Are the questions understandable, the purpose clear and the contact route visible? For questions about joining Massage Alliance, use the association’s enquiry form without attaching identifiable client histories. Professional discussion does not require exposing the person whose trust you are trying to protect.
