What this guide is, and what it is not
This article offers general information about the EU General Data Protection Regulation, the GDPR, as it commonly applies to small businesses that take appointments. It is not legal advice and cannot cover your specific situation. National laws add their own rules, for example Spain's LOPDGDD, and data protection authorities publish guidance that may change over time.
If you handle sensitive information, employ staff, work across borders or simply want certainty, speak with a qualified data protection professional or lawyer. Many professional associations and chambers of commerce also offer templates and advice for their members. Use this guide to understand the vocabulary and prepare better questions, not as a replacement for professional support.
Why does it matter for a salon, a clinic or a coach? Because every booking involves personal data: a name, a phone number, an email address, appointment history and sometimes notes about preferences or health. The GDPR applies to all of it, whether it lives in software, a spreadsheet, a paper diary or a WhatsApp chat on your phone.
Collect only what you need, for a clear reason
One of the core GDPR principles is data minimisation: collect only the personal data you actually need for a specific purpose. For a booking, that is usually a name, a way to contact the client and the service requested. Asking for a date of birth, home address or ID number "just in case" increases your responsibility without helping the appointment.
Every use of personal data needs a lawful basis. For taking and managing a booking, businesses often rely on the processing being necessary to provide the service the client asked for, which the GDPR calls performance of a contract. Sending marketing, newsletters or promotional offers is a different purpose and commonly requires separate consent that clients can refuse without losing their appointment.
Keep purposes separate in practice too. A phone number given for appointment reminders should not automatically end up on a promotional broadcast list. Make marketing opt-in a distinct, unticked choice, record when and how consent was given, and make withdrawing it as easy as giving it. Clear separation keeps clients' trust and makes your records easier to explain.
Health data and other sensitive information
Article 9 of the GDPR defines special categories of personal data, including data concerning health. For physiotherapists, psychologists, nutritionists, dentists and similar professionals, the mere fact that someone booked a treatment, together with any notes about symptoms or conditions, can be health data. Processing it is generally prohibited unless a specific exception applies, which makes extra care essential.
Even outside healthcare, sensitive details appear: an allergy noted by a beautician, an injury mentioned to a personal trainer, or a pregnancy noted before a massage. Ask yourself whether you truly need to record it, who can see it, and how it is protected. If you must keep such information, find out from a professional which legal basis and safeguards apply to your activity.
Practical measures help regardless of the legal details: restrict who can open client notes, avoid writing sensitive information in booking comments or chat messages, use strong passwords and two-step login where available, and avoid shared devices left unlocked. Health professionals often have additional professional and record-keeping duties, so a booking tool should not be treated as a clinical record system.
Software vendors, retention and client rights
When a software company stores or processes client data for you, it usually acts as a processor, and Article 28 of the GDPR requires a written agreement, often called a DPA, setting out what it may do with that data. Before choosing booking, email or messaging tools, read each vendor's privacy policy, ask whether it offers a data processing agreement, and check where data is stored and which subprocessors are involved. If a vendor processes data outside the EU/EEA, ask which transfer safeguard applies, such as an adequacy decision or standard contractual clauses.
Decide how long you keep data and why. Appointment records may be needed for a while for accounting, disputes or follow-up care, but not forever. Define retention periods by type of data, write them down, and delete or anonymise inactive client records when the period ends. Remember old copies in spreadsheets, email attachments and phones, which are easy to forget.
Clients have rights over their data, including access to it, correction, erasure in many cases, restriction, objection and portability. Prepare a simple process: who receives requests, how you verify identity and how you find the client's data across your tools. Responses are generally due within one month. Being able to export and delete a client's information from your booking software makes this much easier.
Tell clients clearly at booking time
Transparency is required under the GDPR: people must be told who is collecting their data, why, on what basis, who receives it, how long it is kept and how to exercise their rights. For appointment businesses, the natural moment is the booking itself. A short notice next to the booking form with a link to your full privacy notice covers most situations.
Write the privacy notice in plain language that matches what you actually do. Mention the tools you use for booking, reminders and messaging, and avoid copying a template full of activities you do not carry out. Review it whenever you add a new tool, start sending a new type of message or change how long you keep information.
Your booking software is part of this picture, but responsibility for your clients' data stays with your business. SkedEz, like any vendor, publishes its own privacy policy and terms, which you should read before deciding; where you need one, ask whether the vendor offers a data processing agreement. Whichever tool you choose, combine its features with your own habits and, when in doubt, ask a data protection professional to review your setup.