Police, a Patient, or an Insurer Asks for
Police demand footage, a patient wants proof of a fall, an insurer wants the parking-lot recording - learn who a physiotherapy practice can actually disclose.
All articles
GDPR & Data Protection
Privacy notice, consents, privacy policy - GDPR in a physiotherapy clinic. Ready-made templates and checklists to download.
A UODO Inspection at Your Physiotherapy
When and why the Polish DPA inspects a physiotherapy practice, how the inspection unfolds.
GDPR at Your Practice Without a Lawyer or
A complete map of the 7 GDPR documents every physiotherapy practice needs - policy, ROPA, information clause, authorizations, processing agreement.
A Data Breach at Your Practice
A lost laptop, an email sent to the wrong patient, a ransomware attack - when it counts as a data breach, when you must report it to UODO within 72 hours.
Staff Authorization to Process Personal
Who at a physiotherapy practice needs written authorization to process personal data, how it differs from a data processing agreement.
GDPR Information Notice for Patients
The 11 mandatory elements of a GDPR information notice under Art. 13, the layered model, and whether patients need to sign it (spoiler: they don't).
SMS and Email to Patients under GDPR
Does an SMS appointment reminder require patient consent? When a message becomes marketing.
Records of Processing Activities (ROPA)
Even a small physiotherapy practice must keep a ROPA - the exemption for entities under 250 employees doesn't cover health data.
GDPR Training for Practice Staff
Who at a physiotherapy practice needs GDPR training, what scope makes sense.
Data Processing Agreement
Who a physiotherapist must sign a data processing agreement with - booking software, accounting firm, hosting.
Register of Medical Records Disclosures
An insurance company called Anna's practice asking for a patient's records after an injury. Anna emailed a copy of the file, thinking "the patient wants the…
Your Practice Website and GDPR
Michał built a nice website for his practice with a "Book an appointment online" form. Patients entered their name, phone number, email, and sometimes a…
Paediatric physiotherapy
A mother brings her 8-year-old son to Mr Marcin's practice after a sprained ankle. She fills in the consent form, everything seems fine.
GDPR in a Physiotherapy Practice
RODO is the Polish name for GDPR (the General Data Protection Regulation) -- the EU tells you how to safely store your patients' data.
IT Security at Your Practice
The minimum IT security measures a physiotherapy practice must implement without an IT specialist: named accounts, passwords, disk encryption, 3-2-1 backups.
Clean Desk Policy
A patient file on the desk, a monitor visible from the waiting room.
Internal Data Protection Policy
An internal data protection policy is not the same as a website privacy policy - without this document a practice cannot demonstrate GDPR compliance to UODO.
CCTV at a Physiotherapy Practice
Is CCTV at a physiotherapy practice legal? Where you may install cameras, where it's forbidden, the legal basis, retention limits and required signage.