Definition
The GDPR (General Data Protection Regulation, EU 2016/679) governs personal data in the European Union. Organisations that offer services to people in the EU or process their data can fall within its scope even if they're based outside the EU. In the United Kingdom, similar rules apply under the UK GDPR.
Under the GDPR, health data is "special category" data. Its core principles include having a lawful basis, transparency, data minimisation, rights of access and erasure, and appropriate security.
Why it matters for clinics
Many clinics treat patients from Germany, the Netherlands, the UK and Scandinavia. GDPR obligations can apply to those patients' data. Being able to find, export or delete a patient's data when they ask depends on keeping it in one well-organised system. Work with your legal adviser on compliance.
Example
A patient from the Netherlands asks for a copy of the data held about them. Because conversations, notes and files are all on a single patient record, the clinic can respond without searching through several phones.