Why your clients' records should be yours, not your booking app's

This is general guidance, not legal advice. Your insurer or professional body can tell you what applies.

You are the one responsible

If you keep names, phone numbers, appointment histories, consultation answers or notes about your clients, you decide why you hold that information and how it is used. Official UK data protection guidance calls that person a "controller", and describes a controller as the one who determines the purposes and means of processing personal data. For a one-person business, that is you.

The software you use to hold the records is usually a "processor", which the same guidance describes as an organisation that processes data on your behalf. The guidance says plainly: "If you are a controller, you are responsible for complying with the UK GDPR." Picking an app does not change that.

Health and consultation details need extra care

Many appointment businesses collect allergies, medical history, skin conditions or injuries on a consultation form. The guidance lists health data, meaning personal data related to a person's physical or mental health, as "special category" data. Answers like these are likely to count as health data. That kind of data needs more protection than ordinary details, and you need to meet specific conditions before using it. The guidance puts more emphasis on explicit consent for this kind of data. That is another reason to know exactly where those forms are stored and who can see them.

What goes wrong when records only live inside someone else's platform

None of this means booking apps are bad. It means you should know the risks before you rely on one.

• Access. If your login is lost, your account is suspended or the company has an outage, your diary and client notes go with it, possibly on the morning you most need them.
• Export. Some tools let you download everything, some let you download a partial list, and some make it awkward. Find out which before you need it, not after.
• Closure. Companies change their prices, get taken over or shut down. If your records sit only in their system, you may be given a short window to get them out.
• Terms. Read what the terms say about who holds the data, what happens to it when you cancel and how long it is kept. If you cannot find the answer, that is an answer in itself.
• Your clients' rights. The guidance on data portability says people can ask for the data they gave you in a structured, commonly used, machine-readable format, and names CSV, XML and JSON as suitable examples. If a client asks, you need to be able to produce their information, and that is much easier when you hold it yourself.

What owning your records looks like

Owning your records does not mean building it all yourself. It means a few plain things are true.

• The accounts are in your name, with your email address, and you hold the passwords.
• Your domain and your system are yours, so nobody else can switch them off.
• You can export your client list, appointment history and forms in a format you can open without the original software.
• You have backups. The data security guidance describes a "3-2-1" approach: three copies, on two different devices, with one stored off-site.
• You know who else can see the records. The guidance says to allow access only to people you have authorised, and where a supplier handles data for you, to choose one that offers sufficient guarantees about security and to have a written contract.

The tools do the work, but the records, the accounts and the domain belong to you.

Do this next

1. List every place your client information lives today: booking app, phone contacts, paper cards, email, messaging apps.
2. Find the export option in your booking system and run one. Check you can open the file and that it includes appointment history and consultation answers.
3. Check the login for each important account is in your name and your email, and set up a second way to recover it.
4. Set a monthly reminder to save a fresh backup to a second place, such as an encrypted drive or a separate cloud account.
5. Read the cancellation and data sections of the terms of every tool you use, and write down what happens to your records if you leave.

If you would rather have one finished website and back office where the accounts, domain and records are yours from day one, have a look at how The Finisher works for your craft: our page for your craft

Sources

Official UK data protection guidance on controllers and processors, data security, special category data and data portability, read on 22 October 2026.

Last checked 22 October 2026. General guidance, not legal or tax advice.

Read next

• Consultation and consent forms: what to ask, what to keep, how long

  A good consultation form protects your client and your business, and it only works if you ask the right things, keep it safe and keep it long enough.

  3 min read

• Patch tests explained: when, how often and how to record them

  A patch test is a small, early check for an allergic reaction, and the record you keep of it matters as much as the test.

  3 min read

• Working from home or on the road: addresses, safety and travel time

  A few simple routines make visiting clients, or welcoming them to your home, safer and less stressful.

  4 min read