Notes and documents

Keep clinical notes and collected files against a booking or a customer.

Booked keeps two kinds of private record beside your appointments: written notes, and files. Both are staff-only — customers never see them, and neither goes out in an email or a text. The catch is that each lives in two places, and one of the two file stores is protected while the other is not.

Notes live in two separate places

Every customer record has a Notes card, and every saved appointment has its own Notes section. They behave the same but they are separate stores: a note written while you are looking at Wednesday's travel consultation never appears on that person's customer record, and the reverse is true as well.

One rule keeps it tidy. Anything that stays true of the person — anxious about needles, brings her daughter to interpret — goes on the customer. Anything true of one visit — which batch you used, why they were turned away — goes on the booking.

• 1Notes — type in the box, press Add note. The newest sits at the top, stamped with who wrote it and when.
• 2Documents — attachments for this person, one file at a time. Not private; see below.
• 3Activity log — a read-only trail of every note and document added or removed. It appears once the record is saved.

Writing and removing a note

1. Open the recordIn Customers, click the person's row. On an appointment, open it from Bookings and expand Notes — that section starts collapsed.
2. Type into the boxThe placeholder reads "Add a note…". Add note stays disabled until you type, and a note of nothing but spaces is refused with "The note is empty."
3. Press Add noteIt appears at the top as "Oliver Ball · 26 Aug 2026, 14:32". Line breaks are kept; pasted formatting is stripped.

Notes cannot be edited. If one is wrong, press Delete beside it, confirm "Delete this note?" and write a fresh one — there is no undo, and the deletion is itself logged under your name.

Two things catch people out. On an unsaved record both cards read "Save the customer first, then you can add notes and documents." — and saving a new customer returns you to the list instead of keeping them open, so you have to find the person again to write that first note. And if the author's WordPress account has since been deleted, the byline reads "Unknown".

Attaching a document

The Documents card on a customer and the Documents section on a booking work the same way: one file at a time, with Upload document. Each row shows the file name as a link, with who uploaded it and when.

Those files go into your site's ordinary WordPress Media Library. They get a normal, guessable web address, so anyone holding the link can open the file without logging in. They show up in the Media Library for any member of staff with media access. And deleting a row deletes the file itself, after one "Delete this document?" confirmation.

• 1Notes — staff notes about this one appointment. Collapsed by default, so it is often overlooked.
• 2Documents — ordinary attachments, as on the customer record. Public web address; nothing sensitive.
• 3Eligibility & secure documents — the verdict (Eligible, Flagged for review or Ineligible), the customer's answers and any protected files. Only on a saved booking.
• 4A protected file — name, size, and whether it is encrypted. View opens it and logs the view; Delete asks "Permanently delete this document?" then shreds it.

Collecting ID and health information securely

Secure documents are the place for anything you would not want a stranger to open. They are kept outside the Media Library, under a random file name, in a folder that refuses direct web requests, and are locked the moment they arrive. There is no public address: the only way in is View, which checks permission and logs the view under your name.

You switch collection on per service, on its Eligibility tab under Business › Services.

• 1The two switches — Collect eligibility / intake for this service turns on the screening questions and is the gateway to everything else. Require secure ID / document upload then asks for files.
• 2Upload label and Minimum files — what you ask for, and how many files (1 to 5) must arrive. Too few and the customer is stopped with "Please upload the required identification / documents."
• 3Consent statement (optional) — wording the customer agrees to when sending health or ID information. Worth filling in: the form has no consent tick of its own.
• 4The safety reminder — its last sentence is the one people skip: delete documents once you no longer need them.

Customers can upload JPG, PNG, WebP, HEIC/HEIF or PDF files up to 12 MB each, and can finish later through the "Complete your screening" link emailed to them. Your team can add files with Upload, several at once — but save the booking first, or the panel says only "Save the booking first to attach secure documents."

Two warnings. If your web host cannot lock files, uploads are still accepted but each row is labelled "NOT encrypted" and the Eligibility tab shows a red "Secure uploads aren't ready yet" warning — stop collecting ID until that clears. And unless the encryption key is set in your site's configuration file, Booked keeps it in the database, so a database restored onto a fresh server without that key leaves existing documents unreadable.

Who can see any of this

• Notes, documents and the Activity log all need Booked's booking-management permission. Staff on the built-in Employee role have none of it and cannot browse customers.
• Uploading or deleting under Documents needs WordPress's own "upload files" permission too, so a colleague may see the list yet fail to add to it.
• Secure documents can only be opened, added to or deleted by staff with booking permission, and every one of those actions is logged.
• Notes never reach the customer, in any email or text.
• There is no per-customer view of secure documents — each file belongs to the appointment it was collected for, so work through that person's bookings.

Retention, privacy and deleting

Booked has no retention rule you can set, so it has to be a habit. Delete secure documents once the visit is done and you no longer need the evidence — that deletion is permanent and shreds the file, which is what you want.

Booked has no CSV export and does not plug into WordPress's own personal-data export or erasure tools, so a subject-access or erasure request is handled by hand: the customer record, their bookings, the notes and documents on each (and the files behind them in the Media Library), any screening answers, and the Activity log. The trail under Settings › Activity log is the quickest way to find what was uploaded, and when.

Finally, the booking form has no consent tick of its own. If you need one, add it as a required screening question or through the custom HTML in the Booking Form designer — and fill in Consent statement (optional) whenever you collect ID.