GDPR for homeopaths — a practical guide
For any homeopath treating patients in the EU or UK, case notes are not ordinary personal data — they are health data, a "special category" the General Data Protection Regulation singles out for heavier protection at Article 9 of Regulation (EU) 2016/679. Processing special-category data is prohibited by default and lawful only under a named exception. For clinical care the usual route is Article 9(2)(h): processing necessary for health-care provision by or under the responsibility of a professional bound by confidentiality. Software choice therefore starts with knowing which articles the clinic, as controller, must satisfy.
The articles that govern a homeopathic practice
| Obligation | Article | What it means for a clinic |
|---|---|---|
| Lawfulness of processing | Art. 6 | A general legal basis is required for every processing activity |
| Special-category data | Art. 9 | Health data needs an Article 9(2) condition on top of the Article 6 basis |
| Data-subject rights | Arts. 12–22 | Access, rectification, erasure, portability, and objection, answered within one month |
| Controller–processor contract | Art. 28 | A written contract with documented processing instructions before a vendor processes data |
| Security of processing | Art. 32 | Encryption and resilience "appropriate to the risk," including a confidentiality, integrity, and availability standard |
| Breach notification | Arts. 33–34 | Notice to the supervisory authority within 72 hours; to individuals when risk is high |
The Article 28 contract is the GDPR analogue of a HIPAA business associate agreement. Any cloud host, transcription service, or AI provider that handles patient material is a processor, and the clinic must put an Article 28 contract in place before data flows.
Consent, cookies, and the ePrivacy layer
GDPR does not act alone. The ePrivacy Directive 2002/58/EC, as amended by Directive 2009/136/EC, governs cookies and similar tracking; its Article 5(3) requires informed consent before non-essential storage or access on a user's device. A practice website that loads analytics or marketing tags must obtain that consent, distinct from any clinical lawful basis. Patient-facing AI features add a further consent layer: where AI processes case notes, images, or audio, a specific consent is the cleaner basis.
Similia offers privacy and GDPR consent alongside a separate AI-processing consent, both manageable from Settings > Privacy; applies data minimization; encrypts data in transit with TLS 1.3 and at rest with AES-256; and supports export and account deletion subject to legal requirements. Configurable consent and export tools support a clinic's GDPR posture; they do not by themselves discharge the controller's accountability duty under Article 5(2).
A short verification checklist
- Identify your Article 6 basis and your Article 9(2) condition for clinical processing.
- Sign an Article 28 contract with every processor, including AI subprocessors.
- Build a one-month workflow for access, rectification, erasure, and portability requests.
- Confirm Article 32 measures — encryption, backups, access control — and a 72-hour breach plan.
- Implement ePrivacy-compliant consent for any non-essential cookies on the practice site.
Obligations turn on jurisdiction and facts. Verify any vendor's claims with the vendor directly and confirm your duties with legal counsel before relying on them. Practices wanting to inspect one platform's published consent and export controls against this checklist can review the Similia clinic settings.
References
European Parliament and Council (2016) Regulation (EU) 2016/679 (General Data Protection Regulation), Articles 5, 6, 9, 12–22, 28, 32, 33–34, Official Journal L 119, https://eur-lex.europa.eu/eli/reg/2016/679/oj.
European Parliament and Council (2002) Directive 2002/58/EC (ePrivacy Directive), Article 5(3), as amended by Directive 2009/136/EC, Official Journal L 201, https://eur-lex.europa.eu/eli/dir/2002/58/oj.
Similia (2026) "Is my patient data secure?", Similia Help Centre, https://similia.crisp.help/en/article/is-my-patient-data-secure-sxmdfd/, fetched 2026-04-22.
Verdict
Ready to act on this?