Physiotherapy, counselling and therapy clinics run on three flows of sensitive information at once: clinical notes about a person's body or mind, a booking system holding their contact details and history, and card payments for the sessions. Each is manageable on its own. The risk creeps in when they all end up in the same convenient tool, one that was really built for salons and simple appointments rather than health records.

There is nothing wrong with using an off-the-shelf booking system, and for scheduling it is often exactly right. The question to ask is where the clinical notes actually live. If treatment notes are being typed into the free-text box of a general booking app, you are trusting a haircut-grade tool with special category health data, and you may not know what that provider does with it, where it is stored, or how well it is protected.

The practical checks are straightforward. Find out whether your booking and notes system is designed for healthcare and says so in writing, or whether it is a general tool being stretched. Protect every account with a strong password and a code on the phone, because a single reused password is the commonest way these systems are breached. And keep card payments on a proper payment provider, never by storing card numbers yourself in a notes field or a spreadsheet.

None of this needs to be expensive or disruptive. Most clinics we look at are one or two changes away from being genuinely tidy: notes in the right place, accounts properly protected, payments handled by someone whose job that is. Getting there also makes the conversation with an insurer, a regulator or a professional body far shorter, because you can simply show them how it works.