Privacy notice, consents, privacy policy - GDPR in a physiotherapy clinic.
Police demand footage, a patient wants proof of a fall, an insurer wants the parking-lot recording - learn who a physiotherapy practice can actually disclose CCTV footage to, and how to document it without breaching GDPR.
When and why the Polish DPA inspects a physiotherapy practice, how the inspection unfolds, and which GDPR documents the inspector will ask for - plus the realistic scale of fines for small entities.
A complete map of the 7 GDPR documents every physiotherapy practice needs - policy, ROPA, information clause, authorizations, processing agreement, breach procedure. Ready-made templates instead of PLN 2-5k for a lawyer.
A lost laptop, an email sent to the wrong patient, a ransomware attack - when it counts as a data breach, when you must report it to UODO within 72 hours, and when a register entry is enough.
Who at a physiotherapy practice needs written authorization to process personal data, how it differs from a data processing agreement, and how to keep a register of authorized persons under GDPR Article 29.
The 11 mandatory elements of a GDPR information notice under Art. 13, the layered model, and whether patients need to sign it (spoiler: they don't).
Even a small physiotherapy practice must keep a ROPA - the exemption for entities under 250 employees doesn't cover health data. See what to include in the register and check out sample completed rows.
Who a physiotherapist must sign a data processing agreement with - booking software, accounting firm, hosting, IT - and what it must contain under GDPR Article 28.
An insurance company called Anna's practice asking for a patient's records after an injury. Anna emailed a copy of the file, thinking "the patient wants the…
Michał built a nice website for his practice with a "Book an appointment online" form. Patients entered their name, phone number, email, and sometimes a…
A mother brings her 8-year-old son to Mr Marcin's practice after a sprained ankle. She fills in the consent form, everything seems fine.
RODO is the Polish name for GDPR (the General Data Protection Regulation) -- the EU tells you how to safely store your patients' data.
The minimum IT security measures a physiotherapy practice must implement without an IT specialist: named accounts, passwords, disk encryption, 3-2-1 backups, and separate patient Wi-Fi.
A patient file on the desk, a monitor visible from the waiting room, a phone call about results overheard by others - the most common data leaks at a practice are analog. A practical clean desk checklist.
An internal data protection policy is not the same as a website privacy policy - without this document a practice cannot demonstrate GDPR compliance to UODO, even if it actually follows the rules in practice.
Is CCTV at a physiotherapy practice legal? Where you may install cameras, where it's forbidden, the legal basis, retention limits and required signage.
Regulatory changes and practical tips for physiotherapy practices. No spam.