Client journals guide

This guide is for clinics and therapists using the journal module in PW Booking Pro. With the journal module, a clinic keeps client journals on its own website: encrypted, with a history of changes and a log of who has seen what.

What is the journal module?

The module is made for beauty clinics, therapists and salons that write notes about their clients, e.g. skin type, treatment, products used, reactions and agreed follow-up.

What you get:

One journal per client with date, treatment, notes, consent and attached files (e.g. before/after photos).
Encryption. Notes and files are stored encrypted. Without the clinic’s key they cannot be read, not even by the web host.
History. A note can be corrected, but the original is never deleted. It is kept as an earlier version.
Access log. Every opening, correction, export and deletion is recorded with name and time.
Export. A whole journal can be printed or saved as PDF, e.g. when a client asks for access.
Retention period. You choose how long journals are kept. A journal can only be deleted when the period has run out.
Access control. Only the staff you give access can see the journals.

The journal module is part of PW Booking Pro and is found in WordPress under PW Booking → Journals.

Before you start: the encryption key

Journals can only be used once an encryption key has been added to the website. This is usually done by your web designer or whoever installed PW Booking.

Go to PW Booking → Journals. The page shows a line starting with define( 'PW_BOOKING_JOURNAL_KEY', ....
Add the line to the file wp-config.php in the website’s root folder, just above the line /* That's all, stop editing! */ (or above require_once ABSPATH . 'wp-settings.php';).
Save the file and reload Journals. When the warning is gone, the module is ready.

Important about the key:

Keep a copy of the key somewhere safe, e.g. in a password manager. If the key is lost, the journals can never be read again, not even by us.
Never change the key once journals have been written. Old notes can then no longer be read.
Never share the key by email, screenshot or chat.
If the website moves to a new web host, the key must go into the new wp-config.php.
Website backups must include the folder wp-content/uploads/pw-booking-journal/, where the files are stored.

Settings

The settings are at the bottom of Journals and can only be changed by an administrator. Go through them once before writing the first note.

Keep journals for … years after the latest note

Choose the period that applies to your clinic. In Denmark the rules are:

Who treats	Retention
Doctors, e.g. cosmetic treatment with botox and fillers	At least 10 years after the latest note
Other authorised health professionals, e.g. nurses and physiotherapists	At least 5 years after the latest note
Not authorised, e.g. beautician, reflexologist and hairdresser	No legal requirement. Choose a period and state it in your privacy policy

The period runs from the latest note in the journal. If there is a complaint, supervision or compensation case, the journal must be kept until the case is closed. Outside Denmark, check your local rules.

Client information version

Enter the version of your privacy policy or client information that clients receive, e.g. Privacy policy v1 – 01.11.2026. It is added to new notes automatically, so you can later document what the client was told. When you update the policy, update the version here too.

Who has access

Tick the staff who treat clients and need the journal. Administrators always have access. Do not give access to e.g. receptionists or staff who only need to see bookings. When an employee leaves, remove the tick straight away.

Click Save when you are done.

Find or create a client

Each journal belongs to a client in PW Booking. Clients who have booked online already exist.

Find a client

Go to PW Booking → Journals.
Type a name or email in the search field and click Search.
Click the client’s name to open the journal.

Without a search, the list shows the clients who most recently got a note.

Create a new client

If the client is not found, use the New client box below the list:

Enter name, email and optionally phone.
Click Create and open journal.

If the email already exists, the existing client is opened, so no duplicates are created.

Write a note

Write a note after each treatment, preferably the same day. Open the client’s journal and fill in the New note form at the top:

Date: the day of treatment. Today’s date is pre-selected.
Treatment: e.g. Facial, Botox forehead or Reflexology.
Notes: the journal text itself (see tips below).
Consent: tick when the client has been informed and has agreed to the treatment and to notes being stored.
Information given: filled in automatically with the version from the settings. Change it if the client received something else.
Attach files: e.g. before/after photos or a signed consent form (JPG, PNG, WEBP or PDF). You can select several files at once.

Click Save note. The note now appears under Notes with date, treatment and your name. Files are shown as links and only open for users with access.

Tips for the content

Write briefly and so a colleague can understand it. Avoid internal abbreviations.
Write what matters for the treatment: relevant health and medication, allergies, skin type, what was done, which products were used, reactions, advice given and agreed follow-up.
Do not write more about the client than the treatment requires.
Do not write personal opinions or private information unrelated to the treatment.
For cosmetic treatment by a doctor or nurse: record the informed consent and which patient information (version) was given. Danish health authorities check this during inspections.

Correct a note

A note can be corrected, but the original note is kept. That way you can always see what it said before.

Click Correct on the right of the note.
The form at the top changes to Correct note and contains the current text.
Make the correction and click Save note. Click Cancel to undo.

The corrected note is now shown. Below it, Earlier versions shows how many there are. Click to see the old versions with date, time and the name of the person who wrote them.

Single notes cannot be deleted. If something is wrong, correct it and, if useful, write in the text why it was corrected.

Export and print

Click Export / print journal at the top of a journal. The journal opens in a new tab with all notes, earlier versions and the names of attached files. Click Print / save as PDF to print it or save it as PDF.

When a client asks for access

Clients have the right to a copy of the information you hold about them. Reply within 1 month.

Check that the request comes from the client, e.g. by replying to the email address you have on file.
Create a PDF with Export / print journal.
Send it securely, e.g. by encrypted email or as a printout the client collects. Do not send health information by ordinary, unencrypted email.
If the client also needs photos, open them from the journal and send them the same secure way.

Do not keep exported PDFs on the desktop or in downloads. Delete them once sent.

Access log

At the bottom of each journal is the Access log. Click it to see the latest 50 actions with time and name.

The log records: opened journal, added note, corrected note, uploaded file, opened file, exported journal, imported notes and deleted journal.

Check the log now and then. If someone has opened a journal without reason, talk to them. If it is misuse, it may be a personal data breach that must be reported (see the checklist below). The log cannot be deleted or changed from WordPress.

Deletion after the retention period

A journal can only be deleted when the retention period has run out, counted from the latest note. Only administrators can delete.

Open the journal and go down to Delete journal.
If the period has not run out, it shows the date until which the journal must be kept.
If the period has run out, click Delete journal permanently and confirm.

All notes and files are deleted permanently, and it cannot be undone. The deletion itself is recorded in the access log.

Nothing is deleted automatically. Set up a fixed routine, e.g. once a year, where you go through old journals. If a client asks to be deleted early and a legal retention duty applies, explain to the client that the journal must be kept for the full period.

Journals are not deleted if the plugin is uninstalled.

Import from an old system

Journals from your current booking system can be imported from a CSV file. Only administrators can use the import.

1. Get your data out

Ask the old system’s support for an export of the journals as CSV or Excel. You own your data and have the right to get it. If the system can only provide one PDF per client, see the PDF section below.

2. Prepare the file

The file must have one row per note and column names in the first row. Click Download template to see an example.

Column	Required	Examples of names that are recognised
Email	Yes	email, e-mail, mail
Date	Yes	date, dato, created
Notes	Yes	notes, note, journal, text
Name	No	name, client, customer (or first name + last name)
Phone	No	phone, mobile, tlf
Treatment	No	treatment, service, type

Dates can be written as 15-03-2025, 15.03.2025 or 2025-03-15. If the file comes from Excel, save it as CSV UTF-8.

3. Run a test

Go to Journals → Import journals.
Choose the file. Optionally change the text in Mark notes as, e.g. Imported from previous system.
Leave Test ticked and click Import.
Check the result: which columns were found, how many notes and clients, and whether any lines were skipped (they lack email, date or notes).

4. Import for real

If the test looks right, remove the tick in Test and import the same file again. Clients are found by email or created. Only import a file once, or the notes will be duplicated.

Imported notes have no recorded consent, because it cannot be read from the old system. Keep the old system’s consents separately if needed.

PDF journals

If the old system can only create one PDF per client, open the client’s journal, write a note such as “Journal transferred from previous system”, attach the PDF and save. The file is stored encrypted.

When everything has been transferred and checked, delete the export files from your computer and ask the old system to delete your data.

Checklist: security and GDPR

The clinic is the data controller for the journals. The plugin handles encryption, access and logging, but the clinic must take care of these things itself:

A privacy policy for clients on the website, linked in the footer and at the booking form
The retention period in the settings matches the privacy policy
The client information version is filled in under settings
The encryption key is stored safely outside the website
Only therapists have access to journals
All users have strong, personal passwords, preferably with two-factor authentication (2FA)
Nobody shares a login
A data processing agreement with the web host and with your web designer, if they have access to the site
The website runs on https, and WordPress and plugins are kept up to date
Backups are taken, including the folder with journal files
A record of processing activities (an internal document the data protection authority can ask for)
A routine for access, correction and deletion, and a yearly review of old journals
A plan for data breaches: a breach must be reported to the data protection authority within 72 hours
If the clinic is registered as a treatment site with the Danish Patient Safety Authority: also follow the Danish journal rules (journalføringsbekendtgørelsen)

This guide is not legal advice. If you are unsure which rules apply to you, ask your trade association, a lawyer or your data protection authority.

Troubleshooting and FAQ

Journals shows a yellow box about wp-config.php. The key is missing or not added correctly. Check that the line is in wp-config.php above /* That's all, stop editing! */ and that the whole key is there.

It says “Cannot be decrypted”. The key in wp-config.php is not the one the note was written with. This typically happens after moving the site. Put the original key back.

The search does not find the client. The client does not exist in PW Booking yet. Create them under New client.

A staff member cannot see Journals. They must be ticked under Who has access. Only users with the role Administrator, Editor, Shop manager or Instructor appear in the list.

A file was skipped. Only JPG, PNG, WEBP and PDF are allowed. If the file is very large, the web host’s upload limit may have been reached. Save a smaller image or contact your web designer.

Can clients see their own journal? No. Journals can only be seen by the clinic’s staff with access. The client gets a copy via export.

Can I delete a single note? No, only correct it. The whole journal can be deleted when the retention period has run out.

What if we stop using PW Booking Pro? The journals stay in the database, also if the plugin is uninstalled. Export them first if they need to move to another system.

Need help? Email contact@pw-booking.com or see Contact.