GDPR when a third party books your patients: who is the controller?
Whoever decides why and how patient data is used is the controller, and a company that handles it for the clinic is a processor that needs a written contract.
Is a booking enquiry health data?
Treat it as health data: the GDPR's definition includes "the provision of health care services" (GDPR, Article 4).
Who is the controller?
The one who "determines the purposes and means of the processing", whatever the contract calls them (EDPB Guidelines 07/2020).
What must the contract say?
That the processor (GDPR, Article 28):
- uses the data only on your documented instructions,
- binds its staff to confidentiality,
- secures the data,
- brings in another processor only with your written approval,
- deletes or returns the data at the end.
What if there is no contract?
That is itself an infringement, says the EDPB.
What should you ask a booking company?
- Who decides which data is collected and how long it is kept?
- Do you use patient data for anything of your own?
- Which other companies handle it, and in which countries?
- What happens to the data when our agreement ends?
- Is each patient introduced to one clinic or to several?
This is not legal advice.
Want appointments that show up and match your criteria?
See if your clinic qualifies →Sources
- Regulation (EU) 2016/679 (General Data Protection Regulation), Articles 4 and 28. Text as adopted on 27 April 2016, read at legislation.gov.uk on 13 October 2026. legislation.gov.uk/eur/2016/679
- European Data Protection Board. Guidelines 07/2020 on the concepts of controller and processor in the GDPR, version 2.1. Adopted 7 July 2021, minor corrections 20 September 2022. edpb.europa.eu