Wellness forms can contain special-category data: a GDPR design checklist

A wellness or massage business may ask customers about allergies, pregnancy, injuries, medication or recent surgery.

Those questions can reveal health data and move a simple booking form into GDPR special-category territory.

Minimize before you secure

The first control is not encryption. It is deciding whether each question is actually necessary.

Ask:

• does this answer change the service?;
• do we need the diagnosis or only a contraindication?;
• who needs access?;
• how long is the information useful?

Separate purposes

Health information used to adapt a service is not the same purpose as email marketing.

Do not bundle health processing and promotional consent into one checkbox.

Understand the signature tool

A finger-drawn signature is personal data, but it is not automatically biometric identification. Check whether the software stores an image only or extracts pressure, speed or other behavioral characteristics.

Map the whole booking stack

The customer may interact with a website, booking platform, email provider, messaging app and cloud database.

A “local server” statement does not describe the entire data flow.

Restrict access

Health-related information should not be visible to every staff member by default. Use individual accounts, permissions, device security and a defined retention policy.

The small size of a form does not determine sensitivity. One checkbox about a medical condition can matter more than a page of ordinary contact data.

Full Spanish guide: Health data in massage, beauty and wellness businesses.