Skip to content
M2Seed M2Seed

Clinics and healthcare

Health data: the part the website can genuinely get right.

A clinic handles the most protected category of data there is. Its website cannot solve everything, but it can stop being the weak link.

On a clinic website, compliance is settled in three concrete places: what the forms ask for, what the legal texts say about the legal basis for processing, and what gets loaded into the visitor’s browser — and all three can be got right without touching the medical records.

Last reviewed:

What the website touches and what it does not

It helps to separate two worlds. One is the medical record, the archive, informed consents and contracts with laboratories: that lives in the clinic, is governed by Spain’s Law 41/2002 alongside the GDPR, and no website fixes it.

The other is what the website does: a booking form, a contact button, some analytics, some legal texts. It is a small slice and it is the one visible from outside, so it is also the first thing anyone wanting to complain will look at. That part can be got entirely right, and that is what we do.

Forms that do not ask too much

The most useful rule of all: if a piece of data is not needed to give the appointment, do not ask for it. An open «tell us about your case» box turns an ordinary contact form into processing of health data, with everything that implies for legal basis, safeguards and retention. Article 9 of the GDPR is clear about the reinforced protection of that category.

A practice’s privacy policy cannot be a shop’s with the name swapped. It has to say who the controller is, what data the website collects, on what legal basis, how long it is kept, who it is shared with, and what rights the patient has and how to exercise them. The AEPD guide for healthcare professionals is the reference for writing it without inventing.

Cookies and third parties

On a healthcare website, an advertising pixel can end up telling a third party that somebody visited a particular specialty page. So it is worth being more restrictive here than anywhere else: strictly necessary only by default, everything else with prior consent, on the terms set by the AEPD cookie guide of May 2024.

The same thing, explained in general: GDPR and cookies

What we do about it

Part of the maintenance: you never have to ask, and it is never billed apart.

  • Forms with no health data No reason-for-visit field and no open box inviting people to give one.
  • A healthcare privacy policy Controller, legal basis, retention and rights, written for a clinic.
  • A legal notice with real details Owner, tax number, address and contact, permanently available.
  • A restrictive cookie banner Nothing beyond the strictly necessary without prior permission.
  • Information at the point of collection The short layer next to the form, linking to the policy.
  • Revision when the rules change And when what your site does changes, too.

And this you change with one sentence

You write what you want changed and we publish it.

Take out the «tell us about your case» box

Removed from the form and replaced with an explanation of what is dealt with in consultation.

A new company now owns the practice

Controller changed in the legal notice and in the privacy policy.

We are going to advertise on social media

We check what that loads on the site and adjust the banner before switching it on.

Frequently asked questions

Does this make me GDPR compliant?

It settles the website side. Medical records, the record of processing activities, processor contracts and staff training are another job, usually a specialist’s, and we say so plainly rather than letting you assume otherwise.

Can I have a second-opinion form?

You can, but that is deliberately processing health data: it needs its legal basis, its information layer and a secure channel. It is not impossible, it just has to be built properly and not as one more form.

Do I need a data protection officer?

It depends on the volume and the kind of processing you do. It is not a question a website answers, and anyone answering it without knowing your clinic is not answering it.

Can I publish patient photos?

Only with their explicit consent, specific to that, informed and revocable. And it is worth keeping it in writing, because the day somebody changes their mind, the burden of proof is yours.

Where all this comes from

Every figure and every rule quoted above, linked to the official text.

The rest of what a website for clinics and health includes

Online booking

The patient picks a slot from the site and you see it in your diary. Fewer calls, fewer empty slots.

WhatsApp reminders

Automatic reminder before every appointment. Fewer no-shows.

Reviews that build trust

We ask the satisfied patient for a review. Your online reputation, looked after.

Google profile

Hours, specialities and clinic photos always current on Maps.

Local healthcare SEO

So that you come up when someone searches for your speciality near your practice.

A serious domain and email

Your own domain and professional email. No gmail addresses on the door.

Security and backups

Secure certificate and a daily copy of your whole site.

Back to Clinics

What does your website form ask for today?

Open it and look. If there is a box where people describe their case, that is where to start.

Write to us