Asking health questions lawfully
Consent you can actually produce, and what happens when it is withdrawn.
A cycle date, a diagnosis, a medication, an allergy — the law calls these special category data, and it holds them to a higher standard than a name and a phone number. You are allowed to ask. You need the person’s explicit permission to do it, and you need to be able to show that you had it.
Booked does the showing for you. This page is what to switch on, and what changes when you do.
Mark the questions as health data
Services › open the service › Questions. Below the questions and the document upload there is a switch: These are health or personal questions. The questions themselves are set up as described in Screening questions and eligibility.
What you ask before they book, and the rules that decide who can.
Health, sex life, ethnicity, religion and biometrics are special category data. Every answer is stored with the exact wording below, the date and the address it came from — so if anyone ever asks what your customer agreed to, you can show them. The consent can be withdrawn from the customer’s record.
The bottom of the Questions tab: the switch, and the wording it makes compulsory.
- 1These are health or personal questions — turns the consent statement below from a notice into a recorded, withdrawable permission.
- 2Consent statement (required) — the label changes from “(optional)” once the switch is on. Leave it empty and the field warns “Write this before you save.”, and Save service is refused.
Writing the statement
The statement appears as a tick box under the questions, and customers cannot continue until they tick it. Say plainly what you will do with the answers, and who “you” is. A good one names the business, names the purpose, and says it can be withdrawn:
| Statement | |
|---|---|
| Good | “I agree that Meridian Pharmacy may record my answers about my cycle and my health, use them to provide my care, and contact me about it. I can withdraw this at any time by asking any member of staff.” |
| Not enough | “I accept the terms and conditions.” — it does not say what is collected, what it is for, or how to stop. |
Keep it separate from your general booking terms. Bundling health consent into a terms tick is exactly the thing the rule exists to prevent.
What gets recorded, and when
When the booking is made — or, for questions answered later, when the customer sends their answers — Booked writes down four things:
- The wording they saw, word for word.
- When they agreed.
- The internet address the answer came from.
- Which questions it covered, along with the booking and the service.
It happens whether they answer during booking or later through a secure link — the same permission is needed either way.
The wording is copied into the record, not linked to it. Rewrite the statement in six months and every consent already given still shows the words that were actually on screen at the time. That is the difference between a record and a reference.
Seeing it on the customer
Customers › open the person › What they have told you. The green panel shows the consent currently in force: what they agreed to and when, quoted exactly.
2 answers, kept against this person rather than one appointment.
The consent sits next to the answers it covers, on the customer’s record.
- 1Stop everything — the button for when messages must stop altogether. It is not the same as withdrawing consent; see below.
- 2They agreed to this — the consent in force, with the date and the statement quoted in full. This is what you show anybody who asks. Withdraw ends it.
- 3The answers it covers — the newest answer to each question, with the date they gave it, directly underneath so the two are never read apart.
Withdrawing it
Anyone can change their mind, and they do not have to give a reason. There is no button for this in the customer’s own account, so when they tell you, press Withdraw on their record and confirm.
Three things happen:
- The consent record stays, marked as withdrawn with the date and the name of whoever pressed the button. It is not deleted — being able to show that you had permission, and when it ended, is the point of keeping it. The green panel disappears from their record, and a data request lists the consent as withdrawn.
- Follow-ups timed from their answers stop. Any follow-up already running for them that counts from a date they gave you (“A date they gave you comes round”) is ended. A milestone that comes round later can still start a new one, so if they want nothing further, press Stop everything as well.
- Ordinary messages carry on. A confirmation or reminder for an appointment they have still booked is unaffected — that is a different thing on a different basis. The answers stay on the record too.
If a customer has answers but no consent
Their record says so in red: “No recorded consent for these answers. If any of them are about health, ask again on a service that has consent wording set.” It appears when answers were collected on a service without the switch on, before you turned it on, or after the consent was withdrawn. Nothing breaks, but for health answers you are holding them without a recorded basis — either ask again on a service that has consent wording set, or delete them.
Deleting and exporting
- Deleting a customer from the Customers list deletes their answers and all their consent records. There is nothing left to justify, so the justification goes too.
- Erase their data, on the customer’s record, is for a request to be forgotten. It removes answers and consent records except those belonging to appointments that went ahead, which are kept with the rest of the record of care.
- A data request includes what they agreed to, in the words they were shown, with the date and whether it has since been withdrawn. See Customers and their records.
What this does not do for you
Booked records consent properly. It cannot write your privacy notice, decide your retention period, or be your Data Protection Officer. If you are collecting health data at any scale, the things still on your side are:
- A privacy notice that says what you collect and why.
- A decision about how long you keep answers, and sticking to it.
- Knowing whether your business needs to be registered with the ICO — most in the UK handling health data do.