Data subject export
A client may ask what you hold about them, or ask for their data in a form they can reuse. The data subject export answers both: it collects everything go flow holds about one client into a single zip file that you download from the client dialog.
Data protection law gives a person two related rights, and the export keeps them apart. The right of access entitles them to see what you hold and who looked at it. Data portability entitles them to the data they provided in a structured, reusable form. Each part of the export is labelled with the right it serves.
The readable copy names the law behind each right by the Country of the client's organisation (set in the organisation settings):
| Country of the organisation | Right of access | Data portability |
|---|---|---|
| A member state of the EU or the EEA (Iceland, Liechtenstein, Norway) | GDPR Art. 15 | GDPR Art. 20 |
| Switzerland | Swiss FADP Art. 25 | Swiss FADP Art. 28 |
| Any other country | No law named | No law named |
The content of the export is the same in every country; only the citation changes.
A client may instead ask you to forget them. That is a separate action, Erase a client, and it cannot be undone: if the client also wants a copy of their data, export it first.
Who may export
You need the Clients right on the client's organisation, at View or Manage. The Audit log right is not needed. An export covers one client at a time and only clients of the tenant you are working in. Without the right the export is refused and you read the failure message described below.
Exporting a client
- Open the client: on the Clients page choose the eye icon at the end of the client's row, or double-click the row. The client dialog opened from anywhere else, for example from a session's participants, works the same way.
- In the client dialog's toolbar, choose More actions (the three dots), then Export client data. A new client that has not been saved yet has no More actions.
- Wait while the file is built. The More actions button shows progress, and no second export can start meanwhile.
- Your browser downloads a zip named Client export, with the date and time and the first characters of the client's identifier, for example
Client export 20261009 1430 3f2a9c1b.zip.
The export needs a connection: Export client data is disabled while you are offline. It makes one attempt per click and gives up after two minutes. If it fails you read "The export could not be created. Please try again." and can simply choose it again.
What the zip holds
Two files:
package.json— the whole export in a structured, machine-readable form that another system can read. It names its format version, the client, the organisation and the time of export, then lists the parts below, each markedaccessorportability.readable.html— the same parts as plain tables, titled Personal data export, to open in any browser and read or print. It names the organisation, the client's identifier, the time of export (in UTC) and the format version, and under each part the right it serves with the law described above. It is written in English, whatever language you work in.
The parts
| Part | Right it serves | What it holds |
|---|---|---|
client | Access | Email, status, when created and last changed, and the organisation's name. |
fields | Access | The client's answers to every field that is not marked portable, including answers whose field has since been removed. |
fields.portable | Portability | The client's answers to the fields marked Included in data portability export. |
participations | Access | The client's bookings: session, start and end, treatment, status, places, language, when booked or cancelled, and the answers given at booking. |
holds | Access | Places held for the client that are not yet confirmed, and when each hold ends. |
orders | Access | Orders with reference, status, totals, discount, VAT, credit applied, payment method and date paid, and every order line. |
wallet | Access | Wallet entries: credits, debits, expiry and the order they belong to. |
vouchers | Access | Vouchers with name, code, original and remaining value, validity and status. |
feedback | Access | Feedback submissions with each question, answer and score. |
journals | Access | Consent and process records the client has signed. |
messages | Access | The emails and SMS sent to the client, with subject and body. The newest 5,000. |
staffNotes | Access | The notes your staff wrote on the client and on its bookings, orders, payments, wallet entries and vouchers, each with its date and text but not who wrote it, and the tags on those records. The readable copy titles it Staff notes. |
access | Access | Who looked at the client's record: the newest 20,000 entries of the Access category on this client, with date, purpose, kind and source, but without the name, address or device of whoever looked. |
Access and portability
Whether an answer belongs to the access part or the portability part depends on the field. In the field's privacy settings, Included in data portability export puts the answers to that field into fields.portable; leave it off and they stay in fields. By default the box follows Self managed: what the client entered about themselves counts as provided by them, and what your staff recorded does not. Adjust it per field, see Audit settings and the health profile. The setting is read when an export is built, so a change applies to every later export, including answers given before the change.
Who looked: what the access part can hold
The access part lists only what was recorded. Openings of the client are there only for the time the organisation logged reads, and views of protected fields only while those fields were logged (see Read logging); earlier exports of the client are there whether or not reads were logged. Synchronisation counts name no client and are not part of it. Entries older than the organisation's Audit retention (months) have already been removed by the daily clean-up and are not part of it.
Staff notes and what is left out
Notes and tags your staff recorded about the client are the client's personal data, so they are part of the export. Before you hand the file over, read the staff notes and remove anything they say about other people, such as another client or a family member; the zip is yours to edit until you send it.
PINs, claim codes, receipt files and payment-provider data are not part of the export. Every part is filtered to this one client and its organisation.
Health care profile
Under the health care profile the export carries one more thing: a standard FHIR Bundle, the format health systems exchange, in package.json and as the section Health data (FHIR) at the end of readable.html. It holds a Patient for the client, then one resource for each answered field with the data category Health that also has a FHIR resource set. A field set to Condition or AllergyIntolerance carries the answer as text; any other value, for example Observation, becomes an observation. Answers of dropdown and similar fields carry the stored option identifiers.
Limits
- 20 MB. An export above 20 MB is not built: you read "The export is too large to download (more than 20 MB).", nothing is downloaded and nothing is recorded. It cannot be split in this version.
- 5,000 messages and 20,000 access entries. A package holds the newest of each.
- One at a time, with a connection.
What is recorded
Every export that is built and returned is recorded in the audit log as Client data exported (client.export), in the Access category, naming the client and the parts the file holds. It is recorded even when read logging is off, and before the file leaves. A refused export, for example one over 20 MB, is not recorded. The export therefore shows up in the access part of a later export of the same client.