Operations

Updated Oct 2026

Client data privacy basics for small service businesses

You are not a data company. You still hold health notes, phone numbers and payment details for hundreds of people, and that deserves more care than a shared spreadsheet.

What you actually hold

Most owners underestimate this until they list it. A typical booking system contains names, phone numbers, email addresses, appointment history, free-text notes about skin, allergies or preferences, sometimes photographs, and increasingly card details or deposit records. Add the message threads on staff phones and the paper intake forms in a drawer, and the picture is larger than it feels.

Some of that is ordinary contact data. Some of it — allergies, medical conditions, pregnancy, medication — is sensitive, and the rules around it are stricter in most jurisdictions. This guide is general practice, not legal advice; if you operate in a regulated sector or across borders, check your obligations with someone qualified.

Four habits that cover most of the risk

1. Collect less. Every field on an intake form is a field you must store, protect and eventually delete. Date of birth is useful for a handful of services and a liability for the rest.
2. Keep it in one place. The system of record should be the booking platform, not a notebook, a phone gallery and three message threads. Data you cannot find is data you cannot correct or delete when asked.
3. Limit who can see it. Staff need the notes required to perform the service. They do not need the full client list exported to a personal device.
4. Delete on a schedule. Old notes are the most common problem: they were reasonable to keep for a year and are now an unmanaged archive.

Where small businesses leak

None of these require a security budget to fix. They require a decision about where client information is allowed to live, and a habit of enforcing it when the shop is busy.

Consent and intake forms

Ask for the things you will genuinely use, in plain language, at the moment you need them. Marketing consent is separate from service consent — a client agreeing to be contacted about their appointment has not agreed to receive offers. Keep the record of when and how consent was given; if you cannot show it, you cannot rely on it.

Digital intake forms are easier to manage than paper because the answers land in one place, are legible, and can be corrected. They also make retention practical: you can see what you hold and remove it. If you are still on paper, moving intake online is usually the single biggest privacy improvement available to a small business, and it also saves time at the desk.

What the platforms do and do not cover

Booksy, Fresha and Square Appointments each handle storage, access control and backups to different degrees, and each has its own terms about who owns the data and what happens if you leave. Check current terms and pricing before you commit, and read the section on data export — a platform that will not give you your client records is a platform that owns your business relationships.

Responsibility does not transfer with the subscription, though. If a staff member exports the client list to a personal account, the platform's security is irrelevant.

A retention schedule you will actually follow

Pick three categories and write them down: booking and payment records (keep as long as your tax rules require), service notes (keep while the client is active, plus a defined period after), and marketing consent (keep while it is valid, and remove it promptly when withdrawn). Anything that does not fit a category should not be collected.

Then do one thing this month: open your client list, sort by last visit, and look at how many records are years old with no activity. That number is your real privacy exposure, and reducing it is the work.