Medical Questions on Your Booking Form: The GDPR Rules Most Owners Miss

Midterm camps wrap up this Friday, and most of the swim schools, dance studios and activity centres running them already have Christmas and January bookings open. Over the next few weeks a lot of parents will type their child's asthma, allergies or diagnosis into a small business's website.

That one question on your booking form, the one about medical conditions, puts your website into a different legal category from the contact form on your homepage. Most owners never notice. The form looks identical. Same plugin, same layout, same submit button. Different rules entirely.

Why a Health Question Changes the Rules

Most of what your website collects is ordinary personal data: a name, a phone number, an email address. GDPR keeps a separate shelf for the sensitive material. The Data Protection Commission lists "data concerning health" among the special categories, alongside religious belief and biometric data, and states that processing them "is prohibited, except in limited circumstances" ^[1]. Prohibited, unless. That is a different starting point from everything else on your site.

For a Pilates studio asking about injuries, a cookery class asking about coeliac disease or a camp asking about a child's epilepsy, the exception that usually fits is explicit consent. Not the tickbox at the bottom saying the person agrees to your privacy policy. Explicit means they have agreed, specifically, to you holding their health details for a stated reason. Some sectors rely on a different exception, so a solicitor or data protection adviser who knows your business is the right person to confirm which applies to you. If your general privacy basics are still on the to-do list, start with what GDPR actually asks of a business website and come back to this.

On the form itself, explicit consent tends to look like this:

• A separate, unticked checkbox beside the health question, never bundled with your terms or a newsletter opt-in
• Wording that names the information and the reason, such as "I agree to the swim school holding the medical details above so instructors can keep my child safe in the pool"
• One line on who sees it and how long you keep it
• A simple way to withdraw, like replying to the confirmation email

None of this replaces your other obligations. It just gets the starting point right, which is more than most booking forms manage.

Ask Only What You Will Act On

GDPR's data minimisation principle is blunt. Collect what you need for the purpose. Nothing more.

Booking forms break it constantly, and almost always out of good intentions. Somebody typed "any medical conditions?" into the form builder three seasons ago because it felt responsible, and nobody has read the question since. You know how it goes: the form works, bookings arrive, and nobody wants to touch something that works.

So run one test on every question. What would you do differently if the answer were yes? If the honest answer is nothing, the question goes.

The question as often written	What it actually collects	A narrower version
"List any medical conditions"	Everything, relevant or not	"Is there anything our instructor needs to know to keep your child safe? If yes, we will ring you."
"Anything else we should know?"	Whatever people decide to type	Remove it, or ask only about access and timing
"Upload a letter from your GP"	A full medical document	Ask them to bring it on day one, if you need it at all

The open medical question

Free-text boxes invite people to write far more than you need. A parent who wants to be helpful will list a diagnosis, the medication, the dose and the consultant's name. You needed to know that the child might need their inhaler. The narrower version flags that something exists and moves the detail to a phone call, where you note only what the instructor has to act on. Your call notes are still personal data, so they need the same care, but there are far fewer of them.

The catch-all box at the end

"Anything else we should know?" is where unsolicited health information lives. People are generous with detail when a form invites it, and once it is typed and submitted, you hold it. If the box exists because a customer once needed wheelchair access, ask about access. That is a question you can act on.

The document upload

An uploaded GP letter is the heaviest thing a small business can collect through a website. It usually holds far more than the one fact you wanted, and depending on the plugin, the file can sit on your server long after the form entry itself has been deleted. If you genuinely need sight of a letter, look at it in person and hand it back.

Where the Answers Actually Go

The question on screen is the part you see. What matters more is where the answer travels after the parent presses submit.

On a typical WordPress site, one booking can end up in four places:

1. The notification email. It goes to whatever address was typed into the form settings, sometimes years ago, sometimes by someone who no longer works for you.
2. The form plugin's entries. Contact Form 7 keeps no copy of submissions on its own; it emails them and stops. Others keep every entry. Gravity Forms, for example, offers a choice between keeping entries indefinitely, trashing them or deleting them automatically after a set number of days ^[6].
3. Every device that inbox is open on. The owner's phone, the office laptop, the instructor's tablet.
4. Your backups. They copy the database every night, entries included.

Consider an Offaly swim school opening bookings for its January block. The notification address was set up by a coach who left over the summer, and nobody changed it. Every new booking, every note about a child's seizures or a nut allergy, still lands in a former employee's personal inbox. Nobody finds out until a parent asks, quite reasonably, why someone who no longer works there knew about her son's medication.

That is not an exotic failure. The Data Protection Commission's annual report for 2025 records roughly 6,500 breach notifications, and says about half of them arose from correspondence sent to the wrong recipient ^[3]. A form notification pointing at the wrong address is that same mistake, repeated automatically with every booking. Now try explaining that to the parents' WhatsApp group.

Three checks worth doing this week

• Verify the notification address on every form. Use a business address you control, never a personal account.
• Strip the health answer out of the email. Where your form plugin lets you choose which fields go into the notification, send "New booking received" and read the detail in the dashboard instead.
• Decide who needs access. Section 36 of the Data Protection Act 2018 lists the kinds of safeguards expected around sensitive data, including limits on who can see it inside a workplace and strict time limits for erasure ^[2]. Remove anyone who does not need to see the answers.

What backups do with a deleted entry

Here is the honest limitation. Deleting an entry today does not reach back into last week's backup. Backups exist to keep a copy of what was there on a given night, so a deleted booking sits in older copies until they are overwritten. That is the deal. The alternative, no backup, means a crash or a hack takes every booking with it, which is why a proper security and backup routine still matters more than the edge case. Just mention in your privacy notice that backups are kept for a limited period and then replaced.

Children's Details Raise the Bar

A lot of the forms opening this week are about children. For data protection purposes in Ireland a child is anyone under 18, and the DPC's Children's Fundamentals set out a higher standard for services directed at or likely to be used by children ^[4].

For a camp or class, the parent fills in the form, which is exactly right. A few practical habits follow from that:

• Address the form to the adult. Put "parent or guardian" in the heading and collect their contact details first.
• Keep the child's section short. First name, age group, emergency contact and the safety question. A full date of birth is rarely needed when an age group will do.
• Separate the purposes. A parent who gave you their daughter's allergy details for a week of camp did not sign up for your newsletter. Marketing consent is a separate box, or a separate conversation.
• Treat photos as their own question. Permission to photograph a child for your website is a different consent from the medical one, and it should never ride along with it.

How Long Is Too Long?

Every form entry has a natural end date. A January block finishes in March; summer camps end in August. After that, the health answers have done their job.

"We might need it someday" is not a retention policy. Pick a period that matches the purpose, write it down, and set your form plugin's retention setting or a recurring calendar reminder to delete the rest, from the dashboard and from the inbox. Accident and incident records are the exception that catches people out: your insurer may expect those kept for longer, so agree that period with them or your solicitor rather than guessing.

Small Businesses Are Not Invisible

There is a comfortable assumption that the regulator only looks at big tech. The numbers say otherwise. The DPC took in just over 16,000 new cases in 2025, somewhere around 45% more than the year before, though that counts every kind of query and complaint rather than enforcement alone ^[3]. The Law Society Gazette's reading of the same report notes about a dozen site visits during the year to organisations that had ignored a complaint or a rights request, including restaurants, a GP's surgery, a solicitor's office and several sole traders' addresses ^[5].

What starts these is rarely an audit. It is a parent asking what you hold about their child. You have a month to answer that properly. If the honest reply is "it's somewhere in Gmail, I think", that is the problem, and it is a reputational one long before it is a legal one. Parents talk, at the school gate and in the group chat, and trust in a children's business is slow to win back.

When a Website Form Is the Wrong Tool

To be fair about it, a website form is not always the right home for health information. If you run a physiotherapy clinic, a dental practice or anything where clinical notes build up over months of appointments, a dedicated practice-management or clinical records system built for healthcare is the better tool. Those systems are designed around patient records in a way a booking form never will be.

A WordPress form is excellent at taking the booking and flagging that a conversation is needed. It is not a medical records system, and it should not try to become one.

What to Ask of Your Hosting

Hosting cannot rewrite your questions or fix a notification address. That part is yours. But the server holding your form entries should meet a few plain standards:

• Data stored in a jurisdiction you understand, ideally without leaving the EU at all
• An encrypted connection on every page, so answers are not sent in the clear
• A patched, hardened server with malware scanning, because a hacked site exposes every entry in the database
• Backups you can restore without raising a ticket and waiting
• Full control over which form plugin you use and how its retention settings are configured

Web60 meets that list. Sites run on Irish-hosted infrastructure where every form entry stays in the country, with free SSL, server-level hardening, fail2ban intrusion prevention, automatic malware scanning, and nightly backups with one-click restore. Because it is full WordPress, you choose the form plugin that suits your bookings and set its retention rules yourself, with no agency in the middle charging by the hour to change a question.

And if you are only now setting up online bookings, the AI website builder will put a WordPress site in place in under a minute for €60 a year, which leaves your time for the part that matters: deciding what you actually need to ask.

Conclusion

Booking season is the right moment to open your own form and fill it in as a parent would. Read every question. Ask what you would do with each answer. Check where the notification lands, who can see the entries, and when they get deleted.

Most of the fixes take less than an hour: a separate consent box, a narrower question, a corrected email address, a retention period written down. Done before the January rush, they mean that every parent who trusts you with their child's details is trusting a business that has thought about it first.

Frequently Asked Questions

Am I allowed to ask about allergies or medical conditions on a booking form?

Yes, if you genuinely need the answer to deliver the service safely. Health information is special category data under GDPR, so processing it is prohibited unless one of the Article 9 exceptions applies. For most small businesses taking bookings, that means explicit consent from the person, or the parent for a child. Ask only what you will act on, and confirm the right basis for your sector with a solicitor or data protection adviser.

Is the privacy policy tickbox enough consent for health information?

Usually not. Explicit consent for health data should be specific to that information and that purpose. In practice that means a separate, unticked checkbox beside the health question, with wording that says what you are collecting and why, kept apart from your terms, your privacy policy agreement and any marketing opt-in.

Can my booking form email me the medical answers?

It can, but every email is another copy sitting in an inbox, on a phone and often in a shared account. Where your form plugin allows it, leave the health answer out of the notification and read it in the WordPress dashboard instead. At a minimum, verify that the notification goes to a business address you control, not a personal account or a former staff member.

How long should I keep medical information from a booking form?

Only as long as you need it for the purpose you collected it for. For a class or camp, that is usually the length of the block plus a short buffer. Accident or incident records may need to be kept longer for insurance reasons, so agree a period with your insurer or solicitor, write it down, and set your form plugin or a calendar reminder to delete the rest.

Who should fill in a booking form for a children's camp or class?

The parent or guardian. For data protection purposes in Ireland, a child is anyone under 18, and the Data Protection Commission expects a higher standard of care with children's data. Address the form to the adult, collect their contact details first, and keep the child's details to what the session needs: first name, age group, emergency contact and the safety question.

What should I do if booking form answers went to the wrong email address?

Correct the notification address immediately, ask the recipient to delete the emails and confirm they have, and write down what happened and when. Health details reaching the wrong person may be a personal data breach. Where a breach is likely to put people at risk, the Data Protection Commission must generally be notified within 72 hours of you becoming aware of it, so take advice from your solicitor or data protection adviser quickly.

Sources