Classification
The regulator places a system in class A3, A2, A1 or B, from its purpose, its Kanta connectivity, the nature of the client data and the risk. Nothing else can begin until this does, and we are not classified.
Suomi · GDPR · asiakastietolaki 703/2023 · valvontalaki 741/2023 · potilaslaki · Kanta
In Finland the first honest sentence is about what we are not. The second is about what nobody else does.
We are not certified as a Finnish patient-record system, we have not been through joint testing with Kela, and we are not in the national system register. A clinic that adopted us as its patient-record system would be breaking its own obligation, not only ours. That sentence belongs in the first five minutes of a meeting, not the fourth month.
What is worth the rest of the meeting is the security plan every Finnish provider must hold whether or not it touches Kanta — and the roles the supervision act makes each provider name. Those are records rather than a document somebody writes once, and records are what this platform is made of.
Yksityiset ammatinharjoittajat
Palveluyksikön vastuuhenkilö
Tietosuojavastaava
Psykoterapeutit
4supplier gates we do not hold
§ 11the patient's log right
2 yrshow far back it reaches
2 moto answer a request
12 / 120the retention years
01 — The wall
Four gates, not one, and we hold none of them
People describe this as “A-class certification”, as if it were a single step. A Finnish buyer knows it is four, in order, and that the last of them has to stay valid rather than being obtained once.
Certification
Assessment against the essential requirements for that class. Not held.
Joint testing
Testing of the features that run through Kanta; for the higher classes Kela issues the interoperability statement. Not held.
A current information-security certificate
Issued by an accredited assessment body, and it must be in force — a standing cost rather than a one-off. Not held.
And the duty runs to the customer, not only to us
A Finnish provider must ensure that the A-class systems it uses are certified, that the features it runs through Kanta have passed joint testing, and that the security certificate is valid. So this is not a hard sell we should push through — it is a segment that is closed until the gates are held. If you keep patient records in Kanta, we are not your patient-record system.
02 — The door
The security plan is the clinic's own duty, and it is made of records
Under § 77 of the client data act, every provider must hold a tietoturvasuunnitelma, detailed by a binding regulation. It applies whether or not the provider touches Kanta, and it is new enough that most clinics have rebuilt the document recently.
What the regulation asks for is not prose. It is access rights documented and every change to them, the logs, the risk work, the processing register, the processor agreements, the training, the physical safeguards, incidents — and a named person answerable for the plan. Those are the registers this platform already keeps, which is why this is the conversation worth having.
Closed by default, reviewed, and drift reported
Access derives from a role plus a current care relationship. Authorisations are recorded with their basis and reviewed annually, and the review reports drift against the live permissions rather than trusting the list.
Every read, not only every change
An append-only hash-chained log nobody can edit or delete, verified on a schedule so that tampering is noticed rather than merely evident afterwards.
Processing, processors and incidents
The record of processing activities, the processor register with its assurances and the subcontractor chain, and an incident and breach register nothing can be deleted from.
It did not replace your self-monitoring plan
The security plan replaced the older plan for information systems. The service unit's omavalvontasuunnitelma under the supervision act still exists, is public, and is reviewed every year. The regulator says the two must not be merged — and the software refuses to mark one document as both.
03 — Who may practise
Two tiers, and most private therapy sits in the second one
Finland splits health professionals in two, and the difference decides what a profile may say. Both tiers sit in the national register, which anybody can search.
Licensed — the right to practise the profession
Psychologist, doctor, physiotherapist, nurse, occupational therapist, speech therapist. The licence is the right to do the work.
Protected title — the right to the name
Psykoterapeutti is here, along with practical nurse, trained masseur, chiropractor, naprapath and osteopath. Anyone may counsel; only a registered person may use the title. Most private therapy in Finland is sold under this word.
Tier, registration number, and the employer's check
An employer must verify the right to practise before hiring and watch for changes afterwards. The record keeps the number, the date of the check, who made it and whether it was a register lookup or the decision document. A typed number is a claim, and counts as declared.
Publication is refused
In a Finnish company, a profile using a protected title without the matching checked registration cannot be published — on create and on write, so the sync cannot get round it. The tiers are not interchangeable: a psychotherapist recorded as “licensed” is still unregistered for the title.
Kela, and the one thing we do not count
Only a practitioner with the psychotherapist title and a provider registration can be a Kela rehabilitative-psychotherapy provider, and that status is recorded here. Kela's session limits are not counted — up to 80 a year and 200 over three years. That is on the list of what we have not built, in section 08.
04 — The service unit
A provider registers once; each place it works registers too
Since 2024 the supervision act treats a sole trader — a psychotherapist with a toiminimi — as a service provider like any clinic. Each place where care is actually given is a palveluyksikkö, and each unit has a named person answerable for it.
Address, services, registration
A multi-site clinic is one company with several units, which is how the national register sees it and was not something the platform could represent before.
Named per unit, with education and experience
Held as a designation with a start and an end, so the continuous-coverage rule applies: the finding is the fortnight with nobody answering for a unit, which a “current holder” field cannot even represent. A daily job reports it.
Public, and reviewed at least once a year
Attached to the unit as a versioned policy, with where it is published, and the yearly review chased rather than remembered.
A complaint about care goes to that person
Recorded against the unit, routed to its responsible person, and closed only by a written answer — not by a status change. There is a field for what changed as a result, and it may be empty; a register in which nothing ever changes is the finding.
The patient ombudsman is no longer yours to employ
Since 2024 the potilasasiavastaava sits with the wellbeing area, for private patients too, and the service is free. The clinic still has to tell patients where to find theirs, so the contact is recorded on the company and shown to the patient in the portal.
05 — The log right
Who used my data, who got it, and why
Section 11 of the client data act gives a patient the right to know who has processed their data, to whom it was disclosed and on what basis. It is free, it reaches back two years, and it is answered within two months of a written request.
Two years, with the recipient and the basis
On the portal at /my/records/log: when, what happened, who did it, who it
was given to and why. Records the patient cannot open appear by kind, never by title.
A written request, with a reason
Further back is given for a special reason — a suspicion that somebody looked without cause, for instance. The request records the period and the reason, and the software refuses to record one without the other.
Two months, and something to be late
The due date is computed from the day the written request arrived, not from when somebody picked it up, and a daily job names the requests that have run out of time.
A decision with a reason, never a shorter list
The law allows withholding where answering would seriously endanger the patient's health or care, or another person's rights. That is recorded as a refusal with its reason. A quietly shortened list is not an answer to a wider question.
06 — Minors
Finland sets no age, so the software records a judgement
This is the sharpest difference from Norway, which counts 12, 16 and 18. Finnish law asks a health professional to decide whether this young person is mature enough to decide this matter, and requires the record to show whether they allow their guardian to be told.
Who judged, when, about what, and why
Maturity is assessed for the matter at hand, so “the whole file” is not an answer. The reasoning is required, because that is what somebody asks about later.
Refused — and the refusal says which
Without a recorded judgement, a disclosure to a minor's guardian is refused, and the message says the judgement is missing rather than that the answer is no. It is “somebody has to decide this first”, which is exactly what the law asks.
Respected, and recorded
Where the assessment says they are mature enough and they did not allow it, the disclosure is refused. A young person judged not capable cannot withhold, and the record refuses to express that combination.
Danger to life or health
Information a guardian needs to avert a danger to the child's life or health reaches them, and a guardian cannot block treatment needed for the same reason.
07 — Retention and closure
Twelve years, or a hundred and twenty
Twelve years from death, else 120 from birth
Seeded as a retention rule rather than written in a policy nobody applies. Where the death is not known the 120-year limb applies; where neither date is known the record is kept, which is the safe direction.
The key, not the row
As everywhere else: two approvals, and destroying the encryption key leaves the audit trail intact.
Records not in Kanta go to Kela's archive
They then fall under joint control with the wellbeing areas, and the Kanta customer relationship is ended separately. We have not built this transfer — section 08.
What we destroy is our copy
We market erasure by key destruction, and in a Kanta-connected deployment the national archive copy is governed by statutory retention that overrides a deletion request. That claim must never be made loosely in Finland.
08 — The boundary
What we have not built for Finland
Kanta and its four gates
Section 01. Everything else on this list is small beside it.
The transfer to Kela's archive
The export machinery exists and is used for the Norwegian archives; the Finnish recipient is not wired up yet.
The registration check is by hand
We could not confirm an open interface to the national register, so a person looks the number up and records that they did. Scraping a public register is not the answer.
Session counting, and Finnish text
Kela's 80-a-year and 200-in-three limits are not counted. The module ships English strings with the Finnish terms beside them; the portal is not translated into Finnish, although the guides on this site are.
09 — The division of work
What stays with you
The judgements
Whether a young person is mature enough, whether a data protection officer is required, what the answer to a complaint says. We record who decided and why.
Continuity, backup and malware protection
The security plan asks for all three. Two of them are your hosting arrangement and one is an operating-environment control. Self-hosted means they are yours, and we will not claim them.
The registers the plan asks for
Access rights and their changes, the read-level log, the processing register, the processor assurances, the training records, the physical safeguards, the incident register.
Saying the first sentence early
We are not a certified patient-record system. A supplier who leads with that is easier to trust on everything after it.
Not legal advice
This page was written from published summaries of Finnish law and checked against the code, not settled with Finnish counsel. The national sites were not reachable from the environment it was written in, so treat every section number as a starting point for that conversation rather than as its conclusion.