A website for a doctor: treatments, bookings and health data

A doctor's site works when one screen shows specialty, location, hours and how to book, and when the contact form does not ask for symptoms. The rest, CV, publications, insurance agreements, comes after. A form asking «describe your condition» creates health data nobody protected.

People look for a doctor on a phone, often with a problem already under way. The order is: first visit or urgent case, nearest location, phone. Photos of the waiting room convince nobody; up-to-date hours do.

The pages a medical practice actually uses

Health data: Article 9, not a banner

Health status is a special category of data (Regulation EU 2016/679, Article 9(1)). Processing is lawful for diagnosis and care under Article 9(2)(h), by a professional bound by professional secrecy. For anything that is not care, newsletters, satisfaction surveys, remarketing, you need the explicit consent of Article 9(2)(a).

• The booking form collects only what is needed: name, contact, date, location. The doctor takes the reason for the visit, not the database.
• If the reason is needed to prepare the visit, the field must be declared, protected and kept for a defined period.
• The Article 13 notice states controller, purposes, legal basis, recipients, transfers outside the EU and retention.
• The booking provider is a processor: you need a contract under Article 28.
• The Article 32 measures are mandatory: encryption in transit, named accounts, tested backups.

Cookies and analytics: consent comes first

Directive 2002/58/EC, Article 5(3), requires consent for any information stored on or read from a device that is not strictly necessary. The Italian Garante guidelines of 10 June 2021 add that consent must be collected before the script runs and that refusing must be as easy as accepting. Google Analytics with full IP addresses and a transfer to the United States adds another problem: after Schrems II (CJEU, case C-311/18) transfers need an assessment.

A medical site can live without third-party analytics: aggregated server-side statistics, Search Console for queries, a count of form submissions. Less health data floating around is also less risk.

Health advertising: informative, not suggestive

Law 145/2018, Article 1, paragraphs 525 and 526, opened informative advertising to health professions, with clear limits: no suggestive, comparative or promotional messages, no promises of results. The professional code of conduct adds a ban on testimonials and on advertising that exploits the need for care. On a site the rule is simple: describe what you do and how to book, not how much better you are.

Before-and-after photos and patient reviews need care: they are health data, they need explicit consent and they remain a bad idea. An anonymous clinical case, with no images and no identifying details, is easier to defend than a gallery of results.

Structured data: Physician, MedicalClinic and FAQPage

The JSON-LD uses Physician for the professional (name, specialty through medicalSpecialty, phone, address) and MedicalClinic for the practice, with availableService for the main treatments. Questions go into FAQPage and must match the visible text. Do not expect stars: they do not exist, and for health that is just as well. The procedure is in FAQPage schema without errors.

curl "https://ui.eneawork.it/api/blocks/category/contact?limit=200" | jq '.category.count, (.blocks | length)'

Blocks from the catalogue

Three records. Contact Sections 01 from Creative Tim is the form with contact details alongside, to cut down to the minimum fields. FAQ 01 from shadcn-ui-blocks carries the questions about first visits and cost. The contact category holds 33 blocks, almost all built for marketing rather than health data: strip the fields you do not need.

The limitation to state up front

The catalogue holds React and Tailwind components: there is no clinical system, no medical record, no integration with the electronic health record or with regional booking systems. The blocks cover the interface; real booking comes from an external service, under a processor contract. Previews are free, the full code sits in the Pro part.

Cost and timing

A six or eight page site for a single practice sits in the low thousands of euro; the line that gets missed is compliance: a tailored notice, a contract with the booking provider, a cookie audit. Redoing the notice two years later costs more than writing it properly the first time. The full picture is in what a website costs.

For a nearby case read a website for a dentist, for structured data how to add schema markup, for the platform choice WordPress, Wix or React components. If the site does not appear in local searches you also need to get the site indexed by Google.