Health data is a special category under Article 9 — the single highest-risk data an SME can hold, with the highest level of protection in the GDPR. Yet most practices exchange results, prescriptions and clinical images over WhatsApp and store X-rays on personal phones — convenient, and a textbook special-category breach waiting to happen.
The reality
None of this is malicious — it's just how the day flows. But with health data each one is a special-category gap a patient, a competitor or a disgruntled ex-employee can report, and the severity is high.
Test results, prescriptions and clinical images sent to patients by WhatsApp. They land on personal phones, in cloud chat backups, with no encryption, access control or deletion.
Dentists and clinicians take X-rays and before/after photos on personal phones that sync to private photo libraries — special-category data outside any control.
The whole team uses one shared login to the practice-management or clinical software, so there's no individual accountability and no real audit trail of who saw which record.
Reception screens, open records and paperwork on the desk are visible to the next patient in the queue — casual disclosure of someone else's health data.
Recall reminders and promotional messages go out mixed together with no valid consent or opt-out, treating clinical contact and marketing as the same thing.
Patient data is passed to practice-management software, dental/medical labs and radiology providers with no data-processing agreement and no idea where it's stored.
It only takes one. A lost phone, a forwarded image, a synced photo library — with health data any of these is a high-severity breach that is likely notifiable to the affected patients themselves, not just the authority. The fix is far cheaper than the incident.
The fix
We don't hand you a policy and leave. We change how health data actually flows through your practice, with tools your team will actually use.
An encrypted patient-messaging channel or portal for results, prescriptions and images — replacing WhatsApp and personal email — that staff and patients find easier, not harder.
We identify and document the correct Article 9 lawful condition for each use of health data (provision of care, explicit consent), on top of the Article 6 basis.
Individual logins for every staff member, multi-factor authentication and proper access levels with audit logs — no more one shared login for the whole team.
Patient records, X-rays and clinical photos encrypted at rest and in transit, kept off personal phones and private photo libraries.
Clinical recalls separated from marketing, with a clean, documented consent and a working opt-out for promotions, offers and newsletters.
Data-processing agreements with your software, labs and radiology providers, a short staff briefing and a simple breach procedure (including "I lost my phone").
How we work
We follow real patient data end-to-end: where the result, the X-ray and the prescription go, and on which device or tool.
We flag the non-compliant flows and the concrete risks — prioritised, in plain language, not a 90-page report.
We set up secure messaging, encryption, access control, consent and the DPAs — and migrate you off WhatsApp and personal phones.
A short team briefing, a breach plan and the records of processing — so it stays compliant day to day.
FAQ
The questions practices ask us most.
Tell us how you send results and images to patients today. We'll show you the gaps and the fix — response within 4 working hours, no commitment.
EN
IT
ES