How can a practitioner offer online appointment booking without collecting health data?

A practitioner's practice (sophrology, naturopathy, reflexology, relaxation, and more broadly wellbeing or coaching support) can offer online appointment booking on its WordPress site, on one condition: do not collect health data in the booking form. Health data falls under a stricter regime (article 9 of the GDPR) and, in France, when it is entrusted to a provider as part of care, under certified health data hosting (HDS). GDA Kraft Booking, the plugin from Global Digital Agency, is not presented as an HDS-certified solution: use it to book a time slot, not to build a client file.

This article gives general guidance, not legal advice. Sources consulted on 12 October 2026; check your situation with your professional body or a specialist adviser. The GDPR applies across the EU; the French rules mentioned below (HDS, French Public Health Code) apply in France only, and rules in other countries may differ.

What is health data?

According to the CNIL, the French data protection authority, health data is personal data relating to a person's past, present or future physical or mental health that reveals information about their state of health. The CNIL distinguishes three cases (“Qu'est-ce ce qu'une donnée de santé ?”, cnil.fr, in French, consulted on 12 October 2026):

In practice, a free-text “reason for the appointment” field will almost always collect health data (“lower back pain”, “insomnia since my pregnancy”), even if you do not intend it to.

What does the GDPR say about this data?

Article 9 of the GDPR lists data concerning health among the “special categories of personal data”: processing it is prohibited in principle, except in narrowly defined cases (text of article 9 on cnil.fr, consulted on 12 October 2026).

For self-employed health professionals in France, the CNIL notes in particular that they must inform their patients and set out in a contract the terms for providers who process data on their behalf (“RGPD et professionnels de santé libéraux : ce que vous devez savoir”, cnil.fr, in French, consulted on 12 October 2026).

What is health data hosting (HDS)?

In France, health data hosting is governed by article L1111-8 of the French Public Health Code. This rule applies in France only. When health data collected during prevention, diagnosis, care or social and medico-social follow-up is hosted by a third party on behalf of the professional or the patient, that host must be HDS-certified. The French digital health agency publishes the rules and the list of certified hosts (“Hébergement des données de santé”, esante.gouv.fr, in French, consulted on 12 October 2026).

With GDA Kraft Booking, your clients' data is stored in your WordPress site's database, with your web host. Standard web hosting is generally not HDS-certified. Hence the cautious rule in this article: do not let health data into it.

Which data should the form collect?

The GDPR principle of data minimisation requires you to collect only what is necessary for the purpose. To book a slot, that comes down to very little.

In practice, the GDA Kraft Booking appointment form only asks for First name, Last name, Email, Phone and a free-text “Message (optional)” field. No field can be added to it (Kraft Fields is for the site's listings and content, not for the appointment form), and there is no file field. The point to watch is therefore this “Message (optional)” field:

• in Kraft Booking › Settings › “Texts and labels”, rename “Message (optional)” to an explicit label, for example “Message (optional, no health information)”;
• add a sentence above the form, on the page, such as: “Please do not include any information about your health in this form; we will discuss it during the session.”;
• if you need organisational information (first session or follow-up), create two separate services instead (“First consultation”, “Follow-up session”).

Kraft Fields and its uses are presented in Custom fields: Kraft Fields and ACF compatibility.

Can service names reveal health data?

Yes, this is the “by combination” case. A booking in a person's name for a service called “Stop-smoking support” or “Post-cancer session” reveals information about their health, and that information appears in the calendar, emails and reminders (the service name is always included).

Prefer neutral names that describe the format rather than the reason: “Individual session 60 min”, “First consultation”, “Follow-up session”. The details of your approach can go on a presentation page, with no link to your clients' identities.

What if you are a health professional?

If you practise a regulated health profession and the appointment is part of a course of care, your calendar and records are fully subject to the rules above. A specialised medical appointment tool, with HDS-certified hosting in France, is then generally more suitable. GDA Kraft Booking is better suited to wellbeing and support activities whose booking requires no health information.

How do you set up the rest of the practice?

The usual settings apply: services, staff members, schedules, buffers and reminders (Setting up appointments). Appointment mode requires the free Kraft GDA account, with no bank card required to sign up; the plugin downloaded from the client area already includes it, with no add-on to install, and your clients' data stays on your site. Two points specific to practices:

• discreet reminders: appointment emails have fixed text and include the service, date, time and location; one more reason to choose neutral service names;
• remote sessions: see How do you offer video call appointments?, choosing a video conferencing tool whose privacy policy is suitable for personal conversations.

Finally, think about your privacy policy and retention periods, which you set yourself (the plugin has no retention setting or automatic purge); export and erasure go through the WordPress privacy tools: see GDPR and personal data.

Frequently asked questions

Is GDA Kraft Booking HDS-certified?

No, the plugin is not presented as an HDS-certified solution. Booking data is stored on your WordPress site, with your host; so do not collect health data in the form.

Can I ask for the reason for the appointment?

It is better not to do so in the online form: a reason typed as free text almost always contains health data. Discuss it during the session, using your own tools, and state in the label of the “Message (optional)” field that it must not contain any.

Is a date of birth health data?

On its own, no. But ask yourself whether it is necessary for the booking: if it is not, do not collect it, in line with the principle of data minimisation.

Do my clients have to give their consent?

The legal basis depends on your situation. In every case, inform them in your privacy policy of the purpose, the retention period and the providers involved (Stripe for payment, Global Digital Agency as technical provider).