Most rules about personal data treat all of it roughly alike: collect what you need, keep it safe, delete it when you’re done. Health data is different. Under GDPR it sits in a protected tier — a “special category” defined in Article 9 — and if your wellness business holds client records, that classification quietly raises the bar on almost everything you do with them.
What “special category” actually means
Article 9 singles out certain kinds of information as more sensitive than the ordinary sort: data concerning health among them. The starting position for special-category data is that processing it is prohibited unless a specific condition applies. In practice you can process it — that is what consent and other lawful bases are for — but you have to clear a higher bar to do so, and you have to be able to show your working. It is the difference between “we may hold this” and “we may hold this, for this reason, on this basis, with these protections.”
For a wellness practice, the reach of “health data” is broader than a diagnosis. Intake questionnaires, notes about a condition or a course of sessions, allergy information, even booking patterns that reveal a treatment — much of what a clinic, spa, studio or telehealth service records is capable of being health data. If in doubt, it is safer to assume the higher standard applies than to discover later that it did.
Consent that carries its weight
Where you rely on consent for special-category data, GDPR expects it to be explicit, informed, specific and freely given — and withdrawable as easily as it was granted. That is a heavier instrument than a pre-ticked box buried in a sign-up flow. It means telling clients plainly what you collect, why, who processes it and where it goes, and honouring a change of mind without friction. Good consent is not a legal nicety; it is part of the trust a wellness relationship runs on. People share sensitive things with you because they believe you’ll handle them with care, and the paperwork should reflect the relationship rather than contradict it.
Where and how records are stored
The higher bar does not stop at collection. It follows the data through storage and processing. That raises practical questions worth answering before an auditor or a client asks them: Where do the records physically live? Which third parties can technically access them? What happens to them when a client leaves, or when you change a supplier? Every additional party that holds a copy is another place the standard has to be met, and another relationship you must be able to vouch for.
This is also where NIS2 now presses. The directive reached full effect across the EU in 2026, bringing audits, a 24-hour incident-reporting duty, fines up to EUR 10 million or 2% of turnover, and the prospect of personal liability for management. Germany’s BSI issued an early EUR 850,000 fine for weak incident detection, as reported by Reed Smith and Freshfields. The message for anyone holding special-category data is consistent with Article 9’s spirit: know where it is, know who can reach it, and be ready to prove both.
An honest caveat
None of this is legal advice, and it is not a reason for alarm. Wellness businesses have handled sensitive information responsibly for a very long time, and Article 9 is a framework for doing that well, not a trap. The genuinely useful takeaway is simpler than the regulation looks: the fewer places your health records live, and the clearer your answer to “who can see them,” the easier every one of these obligations becomes to meet. Complexity is where duty-of-care gaps hide.
Fewer moving parts, by design
One way to shrink the surface is to reduce the number of outside parties who hold your data at all. A self-hosted platform keeps the client records, the customer relationship and the billing inside infrastructure you govern, in your own jurisdiction, rather than scattered across tenants on systems you don’t control. VBWD is a full-stack, self-hosted SDK — one Python backend core serving web, native iOS and native Android from a single build — with a plugin architecture (booking, payments, memberships, catalogue, CMS, chat) that toggles on and off without a restart. Because you run it, storage, access and consent records stay under one roof you can actually audit. VBWD’s sovereign-by-default write-up walks through the same reasoning in more depth.
It is source-available under BSL 1.1 — free for commercial use while annual VBWD-attributable sales stay below the value of 6.7 BTC a year. It is younger than the long-established incumbents and trades some edge-case maturity for auditability and control; a sensible trade for many practices, not for every one.
If your practice is wrestling with any of this — the booking system that fights you, the client data you’re not sure you truly control, the fees that grow every year — the useful next step is concrete: see it running for your own business. Request an enterprise installation and bring the numbers you want to improve.
Sources: EU GDPR Article 9 (special-category health data); Reed Smith and Freshfields (NIS2, BSI fine).
