Health data in intake forms

Version: July 19, 2026 (draft)

1. Why this page exists

FlexBookz lets salons configure intake forms that end customers fill in before or during an appointment. For certain verticals, such as tattoo studios, pedicure practices and massage practices, these forms may contain information about allergies, skin conditions or medical history. This is a 'special category of personal data' under Article 9 of the General Data Protection Regulation (GDPR), which is subject to stricter rules than ordinary personal data.

2. What is special category data?

Article 9 GDPR explicitly lists health data as a special category of personal data. Processing it is prohibited in principle unless an exception applies. For most salons, that exception is typically the data subject's explicit consent (Article 9(2)(a) GDPR).

Examples of data collected via intake forms that may qualify as special category data:

• Allergies, for example to ink, latex, numbing creams or massage oil
• Skin conditions, such as eczema, psoriasis or open wounds
• Medical history, such as diabetes, blood thinners, pregnancy or previous surgeries
• Medication use that is relevant to the treatment

3. Who is responsible for this?

The salon that configures and presents the intake form to end customers is the data controller for this data. That means the salon itself is responsible for having a valid legal basis (typically explicit consent), informing the end customer, and assessing whether collecting this data is necessary for the treatment. FlexBookz acts as the processor here: we provide the platform that lets the salon configure these forms and store the answers, but we do not decide which questions a salon asks or which data is necessary for a specific treatment.

4. What safeguards actually exist in the platform?

The following technical measures are actually present in the FlexBookz platform:

• Access control via Row Level Security (RLS): a salon's intake form data is only visible to that salon's own staff with the appropriate role or permission ('services.manage'), not to other salons or unauthorized users
• Form answers submitted via the public booking widget are processed through a secured, API-key-verified route and linked to the relevant salon's account
• This data is not used by FlexBookz for email marketing, advertising or analytics purposes
• Encrypted connections (TLS/HTTPS) between the browser, the platform and the database
• Storage with Supabase, which applies encryption at rest as part of its standard infrastructure; this still needs to be confirmed against Supabase's own documentation

5. What still needs to be confirmed

To avoid overpromising, we explicitly call out here what has not yet been verified or formalized:

• Whether Supabase's encryption and storage terms meet the requirements that specifically apply to special category data
• Whether a separate, additional review is needed for verticals that structurally process health data
• The exact retention period for intake form answers; currently the same general retention periods apply as described in our Privacy Policy

6. What salons should arrange themselves

If you run a salon that uses intake forms with health-related questions, we recommend considering at least the following. This remains your own responsibility as controller; FlexBookz cannot fully solve this for you:

• Ask for explicit, separate consent to process health data, for example via a dedicated checkbox with a clear explanation, not buried in general terms and conditions
• Only collect data that is actually necessary for the treatment (data minimization)
• Inform end customers about the purpose of the question and how long the data will be retained
• Train staff in handling this data confidentially
• Consider whether a separate data processing agreement or additional arrangements with FlexBookz are needed given the nature of your services
• When in doubt, consult your own legal advisor, especially if health data is a structural part of your services

7. Related documents

See also our Privacy Policy for the general explanation of data processing, and our Data Processing Agreement (DPA) for the contractual arrangements between FlexBookz and salons. Privacy Policy · Data Processing Agreement (DPA)

8. Contact

FlexBookz – Zonnelaan 13, 7771ER Hardenberg, The Netherlands

legal@flexbookz.com | +31 618994895