Taking Over a Physiotherapy Practice - What to Check

Karolina has worked as an employed physiotherapist for five years and dreams of running her own practice. Instead of building everything from scratch, she got an offer: a colleague is closing her practice and selling a "ready-made practice with patients." It sounds perfect -- premises, equipment, a patient base. But before Karolina signs anything, she needs to know exactly what she's taking over and what risks come with it.

Taking over a practice isn't like buying a car -- you take on not just equipment, but also liabilities, patients' personal data, and a history that isn't visible at first glance. This article walks through what to check step by step before you say "yes."

What you're actually taking over

The most important question to start with: are you taking over the company itself, or just its assets? These are two different legal scenarios.

• Purchase of assets (equipment, fixtures, lease agreement) -- you buy things, but you run your own, new practice under your own entry in the Register of Healthcare Entities (RPWDL).
• Takeover of the business / shares in a company -- you step into an existing legal entity together with its history, contracts, and liabilities.

Note -- a physiotherapist's professional practice is tied to the person and their Physiotherapist's Professional Practice Licence (PWZFz). It cannot be "sold" like a company. When you buy a "practice" from someone running an individual practice, you're actually buying assets and setting up your own registration. It looks different with a company running a healthcare entity.

Legal due diligence -- RPWDL and status

Before signing anything, check:

1. The RPWDL entry -- whether the seller is registered, in what form, whether the entry is current and not suspended.
2. Legal form -- individual practice, group practice, or a healthcare entity (company).
3. Title to the premises -- whether the lease can be transferred/continued, and the notice period.
4. Approvals and inspections -- sanitary opinions, compliance of the premises with requirements.
5. Outstanding liabilities -- unpaid dues to the Chamber of Physiotherapists (KIF), taxes, ZUS (Social Insurance Institution) contributions, or amounts owed to suppliers.

Patient records and GDPR -- the trickiest element

This is the most underestimated point of the whole transaction. Patients' medical records are not a plain "asset" that can be freely sold. A takeover requires resolving:

• Who becomes the data controller for patients after the takeover.
• Whether there is a legal basis for transferring the records to the new entity (when a practice ceases operating, special rules apply to transferring and storing the records).
• Whether patients have been informed (GDPR notices, possible consent).
• How continuity of the retention periods is secured (generally 20 years).

Taking over a patient base "on the fly," without settling the controller status and the legal basis for processing, is one of the most common sources of GDPR fines in the medical industry.

Due diligence checklist

Area	What to check	Risk if neglected
RPWDL	Entry is current and correctly filed	Operating without a legal basis
Premises	Legal title, sanitary inspection	Loss of premises / no approval
Patient records	Basis for transfer, retention	GDPR fines
Contracts	Lease, equipment, waste, servicing	Hidden liabilities
Finances	Outstanding ZUS/Tax Office (US)/KIF dues	Liability for debts
Liability insurance	Scope and continuity	Gap in coverage
Staff	Contracts, PWZFz, GDPR	Employee claims

Equipment and fixtures

Check medical and rehabilitation equipment for more than just "does it work":

• Technical documentation and inspections (especially physiotherapy devices).
• Current inspections / technical passports for medical devices, where required.
• Purchase invoices -- proof of ownership and basis for depreciation.
• Actual condition vs. declared condition -- worth inspecting in person.

Formalities after the takeover

Once the transaction is finalised, depending on the scenario:

1. Your own RPWDL entry (when buying assets) -- you register your own practice at the given address.
2. Updating the entry (when taking over an entity) -- changing the data, the managing person.
3. New GDPR documentation -- a record of processing activities, notices, authorisations made out to you as the controller.
4. Organisational regulations -- in your own name.
5. Liability insurance -- your own policy covering the whole practice.
6. Contracts -- transferring the lease, medical waste, and servicing agreements to yourself.

Example -- Solo Practice [SP]: Karolina buys equipment from her colleague and takes over the lease of the premises, but sets up her own practice in the RPWDL. She doesn't automatically take over the patient base -- her colleague informs patients that the practice is closing, and those who want to continue register with Karolina as the new data controller.

Example -- Group Practice [GR]: An investor buys shares in a limited liability company running a healthcare entity. Here, everything is taken over -- including liabilities and controller status -- which is why full financial due diligence and checking outstanding dues and staff contracts is essential.

The takeover agreement -- what to pay attention to

Regardless of the scenario, the agreement itself should precisely define what is being transferred to the buyer, and for how much. Pay attention to:

• A precise list of the subject of the transaction -- equipment, fixtures, rights under contracts, the practice's branding.
• The seller's representations and warranties -- about the absence of outstanding liabilities, the validity of contracts, the legal status of the premises.
• The matter of patient records -- a clear settlement of who becomes the data controller and on what basis.
• Liability for obligations predating the transaction -- who is liable for debts and claims from the period before the takeover.
• The terms and schedule of handover -- when and in what condition the premises, equipment, and system access are transferred.

Well-constructed seller representations are your shield if hidden defects or outstanding liabilities surface after the transaction.

The most common mistakes when taking over a practice

• Buying a "practice with patients" without settling GDPR -- a patient base with no legal basis for processing.
• Failing to check outstanding liabilities -- taking on ZUS/Tax Office (US) debts together with the company.
• Relying on the seller's word -- no due diligence on records and contracts.
• Forgetting to update the entry / no own entry in the RPWDL.
• A gap in liability insurance -- no continuity of coverage between seller and buyer.

Frequently asked questions

Can I simply buy a physiotherapy practice together with its patients?

A physiotherapist's professional practice is tied to the person and their PWZFz, so it cannot be sold like a company. You buy the assets (equipment, lease) and set up your own entry in the RPWDL, while the status of patients is settled separately in line with GDPR.

What happens to patient records after a takeover?

Medical records are subject to special rules. You need to establish the legal basis for their transfer and who becomes the data controller. When the seller ceases operating, regulations on transferring and further storing the records apply, while keeping to the retention periods.

What liabilities might I take on together with the company?

When you buy shares in a company, you step into its entire legal and financial situation: ZUS dues, tax arrears, amounts owed to the KIF, obligations under lease and servicing contracts, and towards staff. That's why financial due diligence is essential before the transaction.

Do I need a new entry in the RPWDL?

If you're only buying assets, you set up your own, new entry in the RPWDL for your practice. If you're taking over an entity (a company), you update the existing entry with changes to the data and managing persons.

CTA: Taking over a practice and want to be sure your documentation is complete? The STANDARD package includes a template of organisational regulations, GDPR documentation, and checklists ready to implement in your newly acquired practice. See FizjoReady packages →

Related articles:
- Professional practice or healthcare entity -- which legal form should you choose?
- RPWDL registration for physiotherapists -- instructions with examples
- GDPR in a physiotherapy practice -- a practical guide for physiotherapists