Practice Software: 10 Vendor Questions
Processing agreement, data export, backups, outages. 10 questions to put to your practice software vendor before you enter any patient data.
The vendor of your records software keeps your patients' health data on its servers. This is among the most sensitive data processed in Poland. Before you enter your first patient, it is worth asking the vendor a few questions. You will most often find the answers in the terms, the contract and the security documentation, but sometimes you need to write to support.
This article is not legal advice. It is worth having a lawyer review the contract with the vendor, especially when more people work in the practice.
In brief
- In relation to the software, you are usually the controller of patient data and the vendor is the processor. Article 28(3) GDPR requires a contract or another legal instrument.
- The ten questions below turn the elements of that contract into specific questions for the vendor. Five of them follow directly from Article 28(3) GDPR.
- Write down the answers with a date and a source. They will be useful during an inspection or when you change software.
- A vendor's declaration that the program is "GDPR-compliant" concerns the tool. The controller's documents remain on your side.
- Free software calls for the same questions as paid software.
Why you ask, not just the vendor
In relation to the software, you are usually the controller of patient data and the vendor is the processor. Article 28(3) GDPR requires processing by a processor to be based on a contract or another legal instrument. It is to set out, among other things, the subject matter and duration of processing, its nature and purpose, the type of data, the categories of data subjects and the rights and obligations of the controller. The contract must also bind the vendor to several specific things, which we turn into questions below.
A vendor may declare that its program is GDPR-compliant. That is information about the tool, not about your practice's documents. That is why you ask the questions and keep the answers on your side.
10 questions and what to look for in the answer
| # | Question | A good answer | A warning sign |
|---|---|---|---|
| 1 | Do you sign a data processing agreement, and can I see it before I buy? | A template available before purchase or accepted when the account is created, with the scope of data described | No agreement, or "it is not needed" |
| 2 | What happens to the data after the contract ends? | I choose: return or deletion of the data, deletion of copies, a specific deadline | Data disappears automatically with no way to download it |
| 3 | In what format can I export the records? | A readable, standard format, export of the whole database as well | Export of single records only, or only to a file that only this program opens |
| 4 | Where is the data physically stored, and does it leave the European Economic Area? | Server location stated outright, transfer outside the EEA only on my instruction | No information on location |
| 5 | Do you use subprocessors (hosting, SMS, email), and how do you notify of changes? | A list of subprocessors and advance notice of changes | Subprocessors "not specified" |
| 6 | How quickly will you report a personal data breach to me? | A specific deadline in the contract, shorter than my own | "We will inform you in due time" |
| 7 | How often do you back up, and do you test restoring? | Regular backups, a restore test, a stated recovery time | No answer about testing |
| 8 | Who on your side has access to my data, and is it logged? | Access limited to technical support, logged, people bound by confidentiality | Broad access with no logs |
| 9 | Does every user have a separate account and roles? | Separate logins, front desk without access to patient records | One shared account for the whole team |
| 10 | What happens when the program is down? | An availability status, support response time, clear rules in the contract | No information on response time |
An example of answers to questions 1, 2 and 3 can be seen on one vendor's website: ZenMed says that the data processing agreement is signed at onboarding, and that after the contract is terminated it hands over the data in JSON and CSV formats within 30 days and deletes it within the following 60 days (zenmed.pl, 3 November 2026). This is a vendor declaration that you verify in the contract and terms, not an assessment of the program.
Where these questions come from
Questions 1, 2, 4, 5 and 8 correspond directly to elements that Article 28(3) GDPR requires the contract to cover. They include: processing only on the controller's documented instructions (including transfers of data to third countries), confidentiality of the persons processing the data, the conditions for engaging another processor (Article 28(2) requires the controller's prior specific or general written authorization) and deletion or return of the data after the end of the services (at the controller's choice, together with deletion of copies, unless the law requires storage). The provision also requires making available the information necessary to demonstrate compliance and allowing for audits, so under question 1 check whether the contract provides for this.
Question 6 also follows from Article 33(2) GDPR: after becoming aware of a personal data breach, the processor notifies the controller without undue delay. It is worth putting a specific deadline in the contract, because the controller has its own obligations connected with breaches. We write about this in the article personal data breach at a practice.
Questions 3, 7, 9 and 10 are practical. They do not follow directly from a single provision, but they decide whether the records will be safe and available when you need them. The requirements for the system in which you keep records are covered in Choosing EDM software for your practice.
What to do with the answers
- Write them down. A note with a date and a source (a link to the terms, an email from support) will be useful during an inspection or when you change software.
- Add the vendor to your record of processing activities as an entity to which you entrust data (see record of processing activities).
- Write down the rules of access to the system in the practice: who has an account, what permissions they have, what happens to the account when an employee leaves. Authorization to process data for staff and the article on IT security at a practice will help.
- Prepare a procedure for a software failure. What staff do when the system stops working during appointments is described in the article EDM failure.
The PREMIUM package contains templates for the first steps: a data processing agreement template (to compare with the vendor's contract), a record of processing activities, authorizations to process data and a personal data breach procedure. The vendor usually presents its own contract. The template is there so that you know what to look for before you sign. The packages contain neither an IT system management instruction nor a procedure for a software failure, so you write steps 3 and 4 following the articles indicated.
Chosen your software? Prepare the documents on your side. The PREMIUM package contains a data processing agreement template to compare with the vendor's contract, a record of processing activities, authorizations to process data and a personal data breach procedure. See the PREMIUM package or compare all packages.
Frequently asked questions
Do I have to have a data processing agreement with the software vendor?
If the vendor processes patient data on your behalf, Article 28(3) GDPR requires a contract or another legal instrument. The vendor usually has its own template. Read it before signing. If in doubt, consult a lawyer. Details are in the article on the data processing agreement.
Is a contract with the vendor enough to meet my GDPR obligations?
No, it is one element. As the controller you also have your own obligations, for example informing patients about the processing of data and keeping the practice's data protection documentation. The full picture is described in GDPR at a physiotherapy practice.
What happens to my records when I change software?
Before you give up a program, export your records and check what the contract says about data after the end of the services. Article 28(3)(g) GDPR provides that the controller chooses between deletion and return of the data, and copies are deleted unless the law requires the data to be stored. The retention period for medical records follows from the law.
Does free software have different rules than paid software?
Processing of patient data works the same way, so the questions for the vendor are the same. A comparison of the free plans is in Free software for physiotherapists.
Legal status as of: 3 November 2026
Legal basis: Regulation (EU) 2016/679 (GDPR), Article 28(1)-(4) (in particular (3)(a)-(h)) and Article 33(2), checked in the Polish language version from the Publications Office of the EU on 3 November 2026. We did not check: Article 32 GDPR, the European Data Protection Board guidelines on controllers and processors, templates of contracts or the terms of specific vendors (apart from the example from zenmed.pl indicated), the rules on retention periods for medical records in this article, or borderline cases in which the vendor is not a processor (to be verified with a lawyer).
Last reviewed: 3 November 2026
Related articles:
- Data processing agreement at a physiotherapy practice
- IT security at a physiotherapy practice
- EDM system down in the middle of appointments
- Is records software enough for a physiotherapy practice?