Guide · Clinics
Treatment consent vs. GDPR data consent
A signature on a treatment consent form is not the same thing as consent to process personal data, even though many clinics collect both on one piece of paper. GDPR treats health data as a special category with its own rules. This guide separates the two consents clearly and shows when each one is actually the right legal basis.
- GDPR treats health data as a special category under Article 9
- Treatment itself usually needs no separate data-processing consent
- A different, explicit consent is needed for anything beyond direct care
Why does GDPR treat health data differently from other personal data?
GDPR Article 9(1) starts from a general prohibition on processing special category data, which includes health data, precisely because this kind of information carries higher risk if it is misused or exposed: it can affect someone's employment, insurance, relationships or reputation in ways an address or a phone number cannot. Processing is only allowed where one of the specific conditions listed in Article 9(2) applies. For a clinic, the two conditions that matter most in daily practice are the direct-care exception and explicit consent, and knowing which one you are actually relying on for a given piece of processing is the point of this guide.
What is 'consent to treatment' actually consent to?
Consent to treatment is a clinical and, in most countries, a separate legal concept: the patient agreeing to a specific medical act, examination, procedure or course of care, after being told what it involves and what the risks and alternatives are. It answers the question 'may we treat you in this way', not 'may we use your data in this way'. A patient can validly consent to a procedure while having no clear idea what happens to the record of that procedure afterward, which is exactly the gap the data-processing consent is meant to close.
What is 'consent to processing' actually consent to, and how is it different?
Consent to processing, where it is the legal basis being relied on, covers how the clinic handles the patient's personal and health data: what is recorded, who can see it, how long it is kept, and whether it moves to any other system or party. It answers a data question, not a clinical one. In practice, for the core activity of providing care itself, GDPR does not require this consent as the legal basis at all, which is the point covered next; the consent question becomes central mainly for anything the clinic wants to do with the data beyond direct treatment.
When can a clinic process health data without asking for consent at all?
Article 9(2)(h) of GDPR allows processing health data without patient consent where it is necessary for the provision of health or social care or treatment, or the management of health or social care systems, provided the processing is carried out by, or under the responsibility of, someone subject to a duty of professional secrecy, per Article 9(3). In plain terms, recording, storing and using the medical information needed to actually treat the patient does not need a separate consent tick-box as its legal basis. The clinic still has other GDPR duties around this data, security, retention, and telling the patient how it is used, but consent specifically is not the basis for this core activity.
What happens if a clinic wants to use patient data for something else later (research, marketing)?
Anything beyond the direct-care exception, using a patient's data for research, including them in promotional communications, or sharing it with a third party for a purpose unrelated to their treatment, needs its own legal basis, and Article 9(2)(a) explicit consent is the relevant condition in most such cases. This consent has to be specific to that purpose: a patient agreeing to be treated, or even to a general data-processing notice at intake, has not thereby agreed to appear in a case study or receive marketing emails. Each additional use needs its own clear, separately recorded yes.
How a clinic collects both consents cleanly at intake, without confusing the patient
The workable pattern is presenting these as two distinct steps at intake: a treatment consent, worded clinically and specific to the procedure or care being provided, and a separate data-processing notice or consent, worded around what happens to the patient's information, with any optional uses, research or marketing, as their own separate, unticked checkbox rather than bundled into one blanket agreement. Keeping a timestamped record of each one separately means the clinic can show exactly what the patient agreed to, and when, if either question is ever raised later.
In Braigest
Two separate, tracked consents at the same intake step
A Braigest intake form can present treatment consent and data-processing consent as two distinct, separately logged steps, each with its own timestamp. Workflow building is included from the Solo plan at €29/month.
Frequently asked questions
Do I need patient consent to keep their medical record?
For processing necessary to provide care itself, GDPR Article 9(2)(h) allows this without consent as the legal basis, provided it is handled under professional secrecy. Other GDPR duties, security and retention among them, still apply.
Can one signature cover both treatment and data processing?
It can, but it should not. Bundling them into one blanket agreement makes it unclear what the patient actually consented to for each purpose, which is a problem if either is ever questioned. Keep them as two separate, clearly worded consents.
Is marketing to existing patients covered by their original consent?
No. Marketing is a use beyond direct treatment and needs its own specific, explicit consent under Article 9(2)(a), separate from whatever was agreed at the time of treatment.
What if a patient refuses the data-processing consent but wants treatment?
Since core treatment relies on Article 9(2)(h), not consent, a clinic can generally still provide care using the direct-care legal basis even if the patient declines any optional, consent-based uses of their data.
Explore more of the platform
Ready to fix your onboarding?
See the whole flow in a 30-minute call, or explore the full Braigest platform.