Who Can See a Client's Home Exercise Program

A physiotherapist gives a patient a home exercise program, a Pilates instructor leaves a member a weekly list of exercises. These lists often carry information about the person's health. A row appearing in your software does not mean everyone on your team should see it or change it.

Why you need to be careful

An exercise list can point to pain, recovery after surgery or a condition. Turkish data protection law treats health data as special categories of personal data and attaches stricter conditions to processing it; data protection laws in other countries have similar rules. Confirm with your legal adviser which conditions apply to your studio. This article focuses only on who within your team should see what.

Write a role table

For each role on your team, answer these questions: who can view the home program, who can create it, who can change it, who can delete it and who can export it? The answers often look like this:

• The instructor or physiotherapist who gives the program. Sees and changes the lists of their own clients.
• Front desk. Sees what is needed to schedule appointments; does not need the exercise content.
• Studio owner or manager. Think separately about what you need to see to run the business. You do not automatically need to see every health detail.
• The client. Sees their own list and marks what they have done.

"Not needed" is a valid answer too. Write a short reason for each role.

A fictional example

At a fictional clinic, the colleague at the front desk can book appointments but cannot see home programs. One day they want to open a list to answer a patient's question and cannot. Instead of logging in with someone else's account, they ask the manager. The manager checks the role table and passes the question to the physiotherapist who wrote the program. Getting the question to the right person is often better than widening access.

Hiding a button is not enough

A button not appearing on screen does not mean the information cannot be reached another way. Access through a direct link or a different screen must be blocked as well. The OWASP authorization cheat sheet recommends the principle of least privilege and checking every request again on the server. Do not try to test this yourself; when you choose software, ask the vendor and have them demonstrate it with different roles in a test account.

Update access when your team changes

When an instructor moves to another location or leaves the studio, when does their access to former clients' lists close? Write a short process for this: the date of the change, the new scope of the role, who removes access and how that is checked.

Review the role table at least once a year and whenever a role changes. Do not test with real patient information; use sample records.

This article is general information and not legal or medical advice.