a website for a medical practice: what you can and cannot say

business · 2026-10-29 · 4 min

a form that never asks for symptoms

people who land on a practice site are often not patients yet: they want opening hours, a phone number, or to know whether you are taking new patients. what they type into a form, though, stays data. "briefly describe the reason for your visit" sounds like a courtesy to the front desk, and it is the line that turns a generic form into the processing of health data.

health data is a special category under article 9 of the gdpr: a consent checkbox is not enough, you need a clear legal basis, a stated purpose and a retention period. if nobody ever explained the difference between personal data and a special category, i wrote about it in what the gdpr means, in plain words. the form needs a name, a contact, and two choices: appointment or information. everything else is asked on the phone, or in the room.

hours, acceptance, prescriptions

the three questions that come before all others: where are you, when are you open, how do i book. a page called "how to access the practice" that answers them in that order is worth ten paragraphs about professionalism.

say whether you accept new patients, whether there is a waiting list, how a report is collected and how the electronic prescription works. list what to bring to a first visit: health card, referral if needed, any tests already done. if you work in a team, say who does what: front desk, nurse, specialist. people do not call to find out whether you are good, they call to find out whether they can come on tuesday at five.

no promises, no before and after

a practice site does not sell an outcome, it offers a path. "healing", "guaranteed results", "cutting-edge technique" are words a patient reads as a promise, and when the subject is health, promises weigh. a doctor's obligation is one of means, not of results: the site should speak the same language.

before and after photos, even with written consent, are an extra problem on a public site: they show a clinical case, and a clinical case is health data. keep them for scientific communication, not for the homepage. reviews are fine, but they should not contain diagnostic details, and they should not be pushed with incentives.

the pages you actually need

home, team, where you are, how to book, privacy. on the homepage, write in plain language what you treat: "cardiology visits" is fine, "cardiovascular wellbeing pathways" is not. one page per area of competence, with the name of the doctor who covers it and the exact specialisation: "specialist" only if the title exists.

remove the blog written by someone else about generic topics, the newsletter with no reason to exist, and the "book online" button that leads to no calendar. add the map, the parking and the lift: that is health information too, the moment someone has to get there on a broken leg.

this week: open the form and delete the field that asks for the reason for the visit.

faq

can i ask for symptoms in the form?

no. you can ask for a contact and whether the request is about an appointment or information. clinical details are collected in the practice or on the phone, with the necessary care.

should i publish patient reviews?

you can show them, but without clinical details and without pressing for them. a review that describes a diagnosis is published health data, and the patient may not have realised it.

do i need a privacy consent in the form?

yes, and it must say who processes the data, for what purpose and for how long. a checkbox with no informative text is not consent, it is a click.