sales CRMGuidesDiagnoses, next-of-kin contacts, call recordings — a leak of this data hurts both the patient and the clinic's reputation. Here are the core GDPR principles and a practical protection checklist.
Health data is "sensitive" data: disclosing it can lead to discrimination, pressure or harm. That is why the law asks more of it than of ordinary contact details.
For a clinic this means two things: know the lawful basis for processing each category of data, and protect it in proportion to the risk.
GDPR applies to clinics established in the EU, and the UK has its own equivalent (UK GDPR). It can also reach clinics outside the EU — including in Ukraine — if they offer services to people in the EU or monitor their behavior (for example, running ads and website analytics aimed at an EU audience). Ukrainian data protection law is also moving toward European standards, so GDPR principles are a sound benchmark in any case.
GDPR sets out its principles in Article 5. Here is what they mean for a clinic.
| Principle | What it means | Clinic example |
|---|---|---|
| Lawfulness and transparency | There is a lawful basis; the patient knows who processes the data and why | Consent to data processing, notice at booking |
| Purpose limitation | Data is collected for specific purposes | A phone number collected for booking isn't used for third-party marketing |
| Data minimization | Collect only what you need | The front desk doesn't need a diagnosis to confirm a visit |
| Accuracy | Data is kept up to date, errors corrected | Updating a next-of-kin contact |
| Storage limitation | Data isn't kept longer than needed | Rules for archiving and deleting old records |
| Integrity and confidentiality | Protection against leaks, changes, loss | Roles, 2FA, encryption, backups |
| Accountability | The clinic can demonstrate compliance | Audit log, policies, contracts with vendors |
As a data subject, a patient has the right to know what data about them is processed and by whom, to access it, to have errors corrected, in certain cases to have it erased or its processing restricted, and to withdraw consent. A clinic needs a clear procedure: who receives these requests, how fast they are answered and how that is recorded.
GDPR fines can reach €20 million or 4% of annual worldwide turnover (Article 83) — the maximums, reserved for the most serious violations. Ukrainian law also sets liability for data protection violations.
If a clinic relies on patient consent (for example, for marketing messages or processing not directly tied to care), the consent must be specific and clear. It usually states:
Store the signed consent with the patient record, not in a separate folder — then it's easy to find when the patient asks or an inspector checks. Have a lawyer review the consent text.
Most clinic data leaks are not hacks. They come from everyday habits:
| Measure | Why | Do you have it? |
|---|---|---|
| Personal login for every employee | You know who did what | ☐ |
| Roles and permissions enforced on the server | Staff see only what they need | ☐ |
| Two-factor authentication (2FA) | A password alone isn't enough to sign in | ☐ |
| Auto-lock of inactive sessions | Protects shared computers | ☐ |
| View and end active sessions | Cut off a lost phone | ☐ |
| Encryption of sensitive fields | Diagnoses are unreadable without the key | ☐ |
| Audit log, including exports | You can see who downloaded the database | ☐ |
| Copy and print restrictions, watermark | Harder to take data out via screenshots | ☐ |
| Documents and consents stored in the system, not messengers | Access control over scans | ☐ |
| Data processing agreements with vendors | Accountability | ☐ |
| De-identification before sending data to AI services | Minimization | ☐ |
| Ability to export and move your own database | Control over your data | ☐ |
Below are the technical and organizational measures built into 95sales CRM. They help you meet legal requirements but don't replace your clinic's own processes and documents.
Full details: data security: roles, 2FA, encryption, audit log.
A CRM holds the patient flow, communications and money. Clinical records belong in an electronic health record (EHR) or medical information system — in Ukraine, one connected to Ukraine's national eHealth system. 95sales CRM is not an EHR and is not connected to eHealth, so official clinical documentation stays in your EHR. The CRM holds the data needed for scheduling, care, payments and sales, plus doctor notes with ICD-10 diagnoses: the note text is encrypted, and a doctor sees only their own patients. The difference is covered in CRM vs EHR.
For how a clinic CRM balances day-to-day convenience with data protection, see CRM for private clinics.
You pay nothing and owe nothing.
We discuss a subscription only if you want one after the demo. The price is known before you start.
FAQ
It can, if the clinic offers services to people in the EU or monitors their behavior. Ask a data protection lawyer to assess your situation.
Yes. Article 9 of GDPR treats health data as a special category whose processing is prohibited except under listed conditions, such as explicit consent or healthcare provided under professional secrecy. Ukraine's data protection law has a similar rule.
Use personal logins, least-privilege roles, two-factor sign-in, session auto-lock, encryption of sensitive fields and an audit log, and sign a data processing agreement with the vendor.
Only with a lawful basis and data minimization in place. In 95sales CRM, the call text is de-identified before scoring, and transcripts and scores are stored encrypted.
Stop the leak, assess whose data and what data was affected, record the incident, and notify the supervisory authority and patients in the cases and timeframes the law requires. Under GDPR, the supervisory authority must be notified within 72 hours.
We store a traffic source marker in your browser so we can tell which ad or link brought an enquiry. Nothing is stored without your consent. Learn more