The personal data protection law and your clinic
· 6 min read
Most clinic owners know there is a personal data protection law. Far fewer know that, from the point of view of that law, their clinic is not an ordinary business but one of the few sectors subject to stricter requirements.
The reason is simple. A clinic processes health data every day, and Armenian law classifies it as a special category of personal data.
This article is not legal advice. We are a software team, not lawyers. But working with clinics, we see that a simple, jargon-free explanation of the main requirements is badly missing. Here it is.
What the law says: the essentials
In Armenia, the processing of personal data is governed by the Law "On Personal Data Protection", adopted in 2015. The supervisory body is the Personal Data Protection Agency of the Ministry of Justice, whose website is pdpa.am.
For a clinic, the three most important points are these.
1. Health data is a special category
The law classifies as special category information relating to a person's race, national origin, political views, religious beliefs, trade union membership, health and sex life. A diagnosis, a treatment plan, the purpose of a visit, even the fact that a person consulted a particular specialist — all of this is health data.
2. Before processing — notify the agency
This is the point clinics most often miss. By law, before processing biometric or special category data, the processor must notify the agency. That is, not "if they ask", but in advance.
3. Consent, except in cases provided for by law
Processing special category data without the person's consent is prohibited, except where processing is directly provided for by law. In practice this means the clinic must clearly know on what basis it stores each type of patient data, and where written consent is needed.
Who is responsible: the clinic or the software?
This is an important distinction, and many people confuse it.
The clinic is the data processor. It is the clinic that decides what data to collect, for what purpose and how long to keep it. Notifying the agency, obtaining patient consent, and answering a patient's request about what data is stored about them are the clinic's obligations.
The software provider acts on behalf of the clinic. The CRM stores and processes data on the clinic's instructions. The provider's job is technical and organisational measures: making sure data is not lost, not seen by outsiders and not used for other purposes.
In other words: good software does not exempt a clinic from the law. It simply makes it possible to comply with the law without Excel files and paper cabinets.
What Plano helps with
The law requires technical and organisational measures to protect personal data. Here is what Plano takes on.
Minimal access. Every employee sees only what they need for their work. A doctor sees only their own patients. Finances are seen by the owner and those the owner has allowed. This directly matches the principle that only those who truly need access to data should have it.
Clinic separation. Your clinic's data is separated from other clinics at the database level.
Personal logins. There are no shared passwords. An employee leaves — their access is removed.
Only what you have approved on the public website. Patient reviews appear on the clinic's website only after the clinic approves them. A doctor's profile is published only when it is marked as public.
The patient's choice about messages. Every email has an unsubscribe link, and unsubscribed addresses no longer receive emails.
Where the data is located. The law restricts transferring data to another country if that country does not provide an adequate level of protection. So it is worth asking any software provider, including us, in which country your clinic's data is physically stored.
What the clinic must do itself
Here is a short list you can print and go through with your team. For each point, if you are unsure, consult a lawyer.
1. Check whether you have notified the agency. If not, the pdpa.am website has guidelines and templates.
2. Look at your consent forms. Does the patient consent to the processing of their data, and does the form state for what purpose.
3. Decide what data you actually need. The law prohibits collecting excessive data. If you don't need the patient's home address, don't ask for it.
4. Know how you will answer the patient. The patient has the right to know what data you store about them. Who in the clinic is responsible for such a request.
5. Eliminate "shadow" copies. Excel files on the reception computer, patient lists in messengers, printed lists on the desk. From the law's point of view, each one carries the same responsibility, but without any protection.
Conclusion
For a clinic, personal data protection is not an abstract "IT question" but a legal obligation, because health data is a special category. Software can take on the technical part. The organisational part — notification, consent, team habits — stays in the clinic's hands.
If you want to understand which Plano tools help with the technical side of these requirements, contact us, and we'll go through it with your clinic step by step.
Frequently asked questions
Is patients' health data special category personal data in Armenia?
Yes. The Law "On Personal Data Protection" classifies information relating to health as special category personal data, to which stricter rules apply.
Must a clinic notify the Personal Data Protection Agency?
By law, a processor of special category data must notify the agency in advance. Since a clinic processes health data, this requirement usually applies to it. Consult a lawyer about your specific case.
If we use a CRM, who is responsible for the data?
The clinic remains the data processor and is responsible for notification, consent and patient requests. The CRM provider is responsible for technical protection: data storage, access control and separation.
Can a patient demand to see what data the clinic holds about them?
Yes, the law gives the patient the right to access their personal data. The clinic must be ready to respond to such a request.
Where can I find official guidelines?
On the website of the Personal Data Protection Agency — pdpa.am, which has legislation, guidelines and templates.