In the case of patients attending for healing, do they really need to sign to say they accept the privacy statement, as Healing and the Law goes a bit further than GDPR?

Patients need to be made aware of the Privacy statement which states by submitting your personal data you declare that you have read, understood and accepted the statements set out in this data protection clause and are giving your consent to the processing of the information submitted in relation to membership or services. Therefore by signing the healing card they are acknowledging acceptance of the privacy statement.