Set up

Data protection impact assessment (DPIA)

Your written check of how you protect clients’ health information: a template filled in for you to finish, sign off and print.

DPIA

1. About this assessmentBusiness, address, phone and email3. What information we collectFilled in for you14 gaps in [square brackets] still to fill in.

Sign-off

NameDr Sarah MitchellReview by21 Oct 2027Save DPIA

How we protect your health informationWe have carried out a Data Protection Impact Assessment (DPIA), signed off on 12 October 2026. You can ask us for a summary of it at any time.

Print or save as PDFKeep a copy for your records and your insurer.

1. Pulosa fills in your details, services, team and how records are protected.

What it is

A DPIA is a written check of how you collect and protect clients’ information, the risks to them, and what you do about those risks. UK GDPR expects one from businesses that regularly keep health information, such as medical histories, consent forms and before and after photos. It’s yours: as the business you decide what’s right and sign it off.

Filling it in

1Admin → Treatments → DPIA.
2Pulosa starts you off with a template filled in with your business name, address, phone and email, your services, your team and how Pulosa protects records.
3Fill in each gap in [square brackets], such as your ICO registration number and how many clients you have. The box at the top counts how many are left.
4Read every section and change anything that isn’t true for you. You can rename sections, Add a section, or Start again from the template (filled in with your current details).
5Tap Save DPIA. It’s kept in your encrypted records, and saving is noted in the audit log.

Signing it off

Under Sign-off, the person responsible for data protection adds their name, role and the date they signed. Review by is set a year later; change it if you like. The page shows Signed off with the date, and Review due once that date has passed.

On your privacy policy

With Mention it on your website’s privacy policy on (it starts on), a signed-off DPIA adds a short section to your website’s Privacy Policy, after How we keep it safe: How we protect your health information. It says you’ve carried out a DPIA, the date it was signed off, how records are protected, and that clients can ask you for a summary. Only that summary goes on your website: the assessment itself is never published, because it sets out your risks and how you guard against them. If your Privacy Policy already mentions a DPIA, nothing is added. Switch it off and save to take the section away.

Printing or saving a PDF

Tap Print or save as PDF. The printed copy has your logo, business name and contact details at the top, every section, and the sign-off at the end. Choose Save as PDF in the print window to keep a file.

In the app

Good to know

Look at it again once a year, and whenever you change how you work with client information, such as a new supplier or a new kind of treatment.
The template is there to help and isn’t legal advice. The ICO’s website has free guidance on DPIAs.
Needs the Business settings permission.