Health details in your AI tools: a GDPR Article 9 check sheet for small clinics, therapists, trainers and salons
What you get: a finished health-data check sheet for a small practice that uses AI tools: 12 columns, one row per tool (what health details it sees, the Article 9 condition you rely on, consent, supplier contract, supplier use of your inputs, records, DPIA screening and a keep-or-stop verdict), a do-not-paste list for staff, a line for your client notice, and a do-this-week list. Made for physiotherapists, psychotherapists and counsellors, dentists, osteopaths, personal trainers, nutritionists and beauty or aesthetic salons.
The short answer
Health details about an identifiable person are special category data (Article 4(15) and Article 9(1) GDPR). Processing them is prohibited unless an Article 9(2) condition applies: for care or treatment by a health professional bound by secrecy that is usually Article 9(2)(h) with 9(3); for many salons, gyms and coaches it is usually explicit consent under 9(2)(a). An AI note-taker, booking chatbot or writing assistant that sees those details is part of that processing, so each tool needs a row: condition, supplier contract (Article 28), a written record (Article 30, because the small-business exemption in 30(5) does not cover Article 9 data) and a DPIA screening (Article 35).
The sheet (one row per AI tool)
| Column | Fill in | Rule |
|---|---|---|
| A. AI tool | [name, e.g. note-taker, booking chatbot, email or letter writer, transcription app] | |
| B. Health details it can see | [e.g. session notes, symptoms in chat, injuries, allergies, pregnancy, medication, skin conditions] | Article 4(15); Article 9(1) |
| C. Whose data | Patients / clients / staff (sick notes) / children | |
| D. Who you are for this purpose | Health professional bound by secrecy · Y/N | Article 9(3) |
| E. Condition you rely on | 9(2)(h) care or treatment · 9(2)(a) explicit consent · 9(2)(b) employment law (staff) · none yet | Article 9(2); also a lawful basis under Article 6 |
| F. Explicit consent kept? | Only if E = 9(2)(a): date, wording, specified purpose, how to withdraw | Article 9(2)(a); Article 7 |
| G. Supplier contract | Processing agreement signed · supplier acts only on your instructions · Y/N | Article 28(3)(a) |
| H. Supplier uses inputs for its own purposes? | [from the supplier terms: e.g. model training on/off, how long it keeps recordings] | Article 28(10): a supplier that decides its own purposes becomes a controller for that processing |
| I. Outside Europe? | [supplier country] → see the transfer sheet | Chapter V |
| J. In your written record | Y/N | Article 30(1); 30(5) exemption does not apply to Article 9 data |
| K. DPIA screening done | Y/N · result | Article 35(3)(b); Recital 91 |
| L. Verdict | Keep · keep with changes [list] · stop putting health details in this tool |
Verdict formula idea (Google Sheets): in L2, =IF(E2="none yet","stop putting health details in this tool",IF(OR(G2="N",J2="N",K2="N"),"keep with changes","keep")). Add your own conditions for H and I.
Do-not-paste list for staff
| Do not paste into a general AI tool | Instead |
|---|---|
| Full names with diagnoses, symptoms or medication | Use initials or a client number, or a tool covered by row G |
| Photos of skin, injuries or scans | Keep in your clinical or client system |
| Mental health, sexual health or pregnancy details | Only in tools that pass rows E, G and H |
| Children's health details | Only in tools that pass rows E, G and H, with the parent's or guardian's involvement as your rules require |
| Staff sick notes and reasons for absence | Payroll or HR system only; 9(2)(b) depends on national employment law |
| Anything a client told you in confidence | Ask: would they expect this text to leave the practice? |
Line for your client or patient notice
We use [tool type, e.g. a transcription tool] to help us write [session notes / appointment summaries]. It is provided by [supplier], which processes the information only on our instructions under a written agreement. [It does / does not] keep recordings after [period]. [If consent: You can say no, and you can withdraw consent at any time by telling us; this will not affect your care.] Questions: [contact].
Do this week
- List every AI tool staff use, including free ones on personal phones, and fill one row each
- For each tool, read the supplier terms on training and retention and write the answer in column H
- Get a processing agreement for every tool that sees health details, or stop using it for them
- Put the do-not-paste list where staff write notes
- Add the tools to your written record of processing and run the DPIA screening sheet
- Check your professional body's guidance and national rules on health data (Article 9(4))
This sheet is a working aid, not a legal opinion or proof of compliance. References are to Regulation (EU) 2016/679 (Articles 4(15), 6, 7, 9, 28(3)(a), 28(10), 30, 35(3)(b) and Recital 91). Professional secrecy rules, health-records law and national conditions on health data can add obligations. Checked on 22 October 2026. Spot an error in this guide? Write to mininglife7@gmail.com.
For accountants and practice managers
If you keep the books for clinics, therapists or salons, this is one sheet you can hand them alongside their client AI inventory. Stay inside your professional rules and refer legal questions on.
Keep each sheet next to your AI register
The EURO AI Register free edition runs in your browser with no account and no upload. It covers your first 10 AI systems and 10 evidence records, the screening questions, duties by role with dates, and a printable Article 4 AI-literacy record. List each AI tool once, and keep this sheet as its evidence record.
When you need more than 10 systems, the EURO AI Register membership starts at $19 a month and adds unlimited systems, rule updates and email help. Neither tool is legal advice or proof of compliance.
Partner programme opening soon
Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.
Free start: list your AI tools in the EURO AI Register free edition, then fill this sheet. Related: AI meeting note-taker setup sheet · DPIA screening sheet · records of processing sheet · international transfer sheet.
Sources
- Regulation (EU) 2016/679 (GDPR): Articles 4(15), 9, 28, 30, 35 and Recital 91
Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.