Which legal ground do you pick for health data?
Want to note an allergy, medication, skin condition or pregnancy for a client? Salonnare first asks you to pick a legal ground. It sounds legal, but it is really just the answer to the question: "why am I allowed to store this sensitive data?" This guide explains the four choices in plain language and tells you when to use each one.
Why is this handled separately?
Health data is special category personal data (GDPR Art. 9). Think of allergies, medication, skin conditions or a pregnancy. This data is extra sensitive, so the law asks you to record on what basis you store it. In Salonnare it also lives in a separate, encrypted vault, apart from your regular client notes.
You do not need to be a legal expert. In the vast majority of cases the choice is simple: Explicit consent. The other three are there for exceptional situations.
The four legal grounds
Explicit consent
The client explicitly gives you permission to store this health data, for example on your intake form or verbally at the desk.
- When do you pick this? In almost every case. For a salon this is the normal, correct choice.
- Example: a client tells you she is allergic to a certain product so you can take that into account.
Vital interest
You record data because the client's life or health is directly at stake and it is impossible to ask for consent at that moment.
- When do you pick this? Almost never, only in a genuine emergency.
- Example: a client becomes unwell and you have to record medical information while asking for consent is not possible.
Contract performance
The data is strictly necessary to carry out the agreed treatment safely.
- When do you pick this? Rarely, and only when explicit consent genuinely does not work. In practice, asking for consent is almost always the clearer and better choice.
- Example: a treatment cannot be performed safely without certain health information.
Public health interest
You process the data because of an exceptional public-health situation, for example at the request of the authorities.
- When do you pick this? Almost never for an ordinary salon.
- Example: a mandatory registration during an outbreak, on instruction from the authorities.
In short: what do I pick?
| Situation | Legal ground |
|---|---|
| The client gives you consent (the normal case) | Explicit consent |
| Emergency where asking for consent is impossible | Vital interest |
| Strictly needed for a safe treatment | Contract performance |
| Exceptional public-health situation | Public health interest |
So in the vast majority of cases you pick Explicit consent.
How do I record it in Salonnare?
- Open the client's profile under Clients.
- Go to the health notes block (special category data).
- Click Record consent and choose the legal ground.
- You can then store the health notes safely in the encrypted vault.
Without a recorded legal ground you cannot store health notes for a client. Does the client withdraw consent later? Then choose Change ground or Withdraw consent in the same block.
For more about privacy, exporting and deletion, see Privacy and GDPR. For recording client data in general, see Managing clients.