A koulutettu hieroja in Finland is not simply a massage practitioner. The title is protected, the holder is registered with Valvira as a health care professional, and that changes what the law expects. If you record client health information electronically, joining the Kanta services is a legal duty rather than a recommendation. The transition period for private health care ended on 1 January 2026 — it is behind us, not ahead.
This article is not about what a system costs. It is about whether the duty applies to you and what it requires in practice.
Checked on 6 August 2026 against public sources from Kanta services, Valvira and Finlex. Legislation and interpretations change — always confirm your own position with the authority.
Who has to join
The duty does not cover everyone who offers massage. It comes from two conditions that must both be true.
First, you are registered with Valvira as a health care professional. A koulutettu hieroja is a nimikesuojattu ammattihenkilö — a professional with a protected title — and is entered in the Terhikki register. Calling yourself a massage practitioner without that training and registration does not create the same status.
Second, you process patient data electronically. If you record a client’s complaint, a treatment plan or how a session went into any electronic system, this condition is met.
Neither one alone is enough. A registered professional who keeps only a name and a time slot in a calendar is in a different position from the same professional who adds notes about the client’s condition.
This is a good moment to be honest with yourself. Plenty of sole practitioners believe they do not “process patient data” because they keep no formal patient record — and then type into the booking notes field: “neck locked up, work-related, follow-up from last time.” That is health data.
What changed at the start of 2026
The Act on the Processing of Client Data in Health and Social Care (703/2023) came into force on 1 January 2024. It did not invent the Kanta obligation. It tightened it and extended it to a wider group of private providers.
The act set staggered transition periods. For private health care, the deadline to connect was 1 January 2026. Where a provider’s retention duty begins later, the connection is made by the time that duty starts.
The awkward consequence: in August 2026 this deadline is not approaching. It has passed. If the duty applies to you and you have not connected, waiting does not fix it.
Why a normal booking calendar falls short
This is where money gets wasted most often.
Kanta can only be joined using a certified class A information system. Certification means the system has been through a conformity assessment and is listed in a register maintained by the authorities. A normal booking calendar is not a patient information system — not even when it offers a free-text field and you write whatever you like in it.
| Situation | Kanta duty | What you need |
|---|---|---|
| Koulutettu hieroja, electronic health notes | Yes | Certified class A system and a Kanta connection |
| Koulutettu hieroja, calendar holds only name and time | Depends on what you record | Audit what you actually store |
| Practitioner without Valvira registration | No | A normal booking system is fine; GDPR still applies |
| Wellness service, not health care | No | A normal booking system |
The second row causes the most trouble. The line is drawn by what you put into the system, not by what the system is called.
What this means when choosing a system
Once the duty applies, you are buying two separate things: patient data processing and appointment booking. They can come from one system or from two.
One system is simpler to run, but it ties your online visibility to the same contract. Two tools — a certified system for clinical notes, your own site for bookings and marketing — give you more room to move, at the cost of two logins and a little more thought about which data goes where.
Neither is automatically right. We suggest two tools when getting new clients is the problem: the certified system covers the legal side, your own site covers being found. If your calendar is already full and you need no new clients, one system is plenty.
We broke down the price side separately in our article on booking system costs for massage therapists: tiers with Kanta start at roughly 30–48.90 €/month against 7.90 €/month for a plain calendar.
Independent practitioner or organisation
This choice is made at registration and is worth settling before you buy anything.
A therapist working alone usually registers as an itsenäinen ammatinharjoittaja. If you employ people or run a company with several professionals, you register as an organisation.
The difference is not paperwork. It decides whose register the patient data accumulates in and who answers for it. If you rent a chair to a colleague or bring a second therapist into the same room, your position changes — better to work that out before it happens.
A worked example
Take a therapist in Riihimäki. One treatment room, around 60 client visits a month, a koulutettu hieroja listed in Terhikki.
For two years she has used a booking system at 7.90 €/month. The notes field has filled up with entries like “lower back, recurring, work ergonomics” — memory aids as far as she is concerned, health data as far as the law is concerned.
She has three options. Move to a certified system and join Kanta, taking the monthly cost to roughly 30–48.90 €. Stop recording health information electronically altogether and move it to paper in a locked cabinet. Or carry on and hope nobody asks.
The third is the one we see most often. It is also the only one that is not really an option.
The gap between the first option and what she pays now is about 22–41 €/month, or 264–492 € a year. One 60-euro treatment a month covers it.
What you may ask on a website form
This question turns up in the same conversation almost every time, so here is the short answer.
Health data is a special category of personal data under Article 9 of the GDPR, and the conditions for processing it are stricter than for ordinary contact details. The simplest solution is to not ask about symptoms on a web form at all.
A booking form needs a name, phone, email and the service. Background details are recorded at the appointment, in the system built for patient data. Your website then stays a website instead of turning into a system that health care requirements apply to.
That is also why we deliberately build sparse booking forms for therapists. It is not laziness — it is where we draw the line.
What to do next
Three questions, in order:
- Am I in the Valvira register? Check Terhikki. If you are not there, the duty does not apply to you.
- What do I store electronically? Go through the notes fields in your booking system for the last three months. Honestly.
- Is my current system certified? Ask the vendor directly: is this a class A system, and can I join Kanta with it?
If the answer to the third is no while the first two are yes, you have something to fix.
All our material for this field sits in the massage section, and we compared system prices on the comparison page.
If you want a site that handles being found and leaves patient data where it belongs — see what it costs.