A practice manager once asked whether the week's appointment list could go on the website, so patients could check their own slot instead of ringing to ask. It would have saved perhaps thirty calls a week. It would also have published, in public, the names of everybody attending a clinic and when.
That is the shape of nearly every mistake in this area. Not malice, not carelessness exactly, but a sensible operational instinct applied to a surface that is open to the world.
Here is what should never end up on a clinic website, and what to do instead.
Anything that identifies who is a patient
The fact that somebody is your patient is itself confidential. It is easy to forget this because it feels like the least of what you know about them.
So: no appointment lists, no waiting lists, no "welcome to our new patients" posts with names, no photographs of a reception screen, no thank-you note reproduced with a signature. A birthday mention for a long-standing patient is a disclosure. A condolence message is a disclosure.
If a name appears on your website and that person is a patient, the website has said so.
Can a clinic publish testimonials?
Every website template has a testimonials section. Every marketing guide says to fill it. In healthcare it is the most reliable way for a well-meaning practice to get into trouble.
A testimonial in a clinical setting is a patient publicly identifying themselves as a patient, usually describing their condition, often with a full name and sometimes a photograph. Professional bodies across dentistry, medicine and the talking therapies take varying but generally dim views of soliciting them.
There is a harder rule underneath the professional one: never publish a testimonial you did not receive. Inventing reviews, or filling a template's placeholder quotes with plausible text, is illegal in the UK under the Digital Markets, Competition and Consumers Act 2024, across the EU under the Omnibus Directive, and in the US under the FTC's 2024 rule on fake reviews. The penalties are not small, and "it was placeholder text we forgot to change" has never been a defence.
If your website template arrives with example quotes in it, they are a demonstration of a layout. Delete the section or replace it with something true.
What to put there instead: your qualifications, your registrations, how long the practice has been open, what happens at a first appointment, and your prices. That is what a prospective patient is weighing anyway.
Can you publish before and after photographs?
Common in dentistry, aesthetics and podiatry, and a reasonable thing for a patient to want to see. Also a photograph of somebody's body, published.
If you use them, the consent has to be specific, written, and about publication on a website rather than about treatment. Consent given for a clinical record is not consent to appear in your marketing. It needs to be withdrawable, which means you need to know whose photograph is whose, and be able to take it down.
Many practices find the administrative honesty of this makes the question easier: if you cannot confidently say who consented to which image and when, you should not be publishing them.
What your enquiry form collects
A contact form is where clinics most often collect more than they mean to.
A free-text box labelled "how can we help?" will receive medical details, because that is the honest answer to the question. Those details then sit in an email inbox, get forwarded, and live in a system that was never designed to hold them.
Two things help. Label the box narrowly: "Which service are you enquiring about?" collects less than "Tell us about your symptoms". And say under the form what happens to the message, who reads it, and how long you keep it.
If you need clinical detail before an appointment, collect it after the booking, through whatever system you use for records, and not through the website.
Your website is not a records system
A booking diary holds a name, a contact detail, a time and a service. That is the correct amount.
The drift happens through a notes field, used to remember something practical and then used for something clinical. Once that has happened, the information is outside your records policy, visible to anybody with diary access, and included in nobody's retention schedule.
Keep clinical information in the system built for it. A counselling practice website that respects privacy goes further into where that line sits in practice.
What belongs on the site
The restriction is narrower than it sounds. Nearly everything useful is still available to you:
- Who you are. Clinicians, qualifications, registration numbers, how long you have practised.
- What you do, and what it costs. The single most searched thing about any clinic.
- What an appointment is like. What to bring, how long it takes, what happens afterwards.
- Where you are and how to get in. Parking, access, the door that is actually the entrance.
- How to book. Ideally without a phone call.
None of that requires a patient's name. Clinics that do this well read as more professional than those with a wall of five-star quotes, because the information answers the questions a real person arrived with.
What patients look for on a clinic website covers that list in the order patients actually want it.
FAQ
Can we republish a Google review on our own website?
The review is already public, so repeating it is a smaller step than soliciting one. It is still a patient identifying themselves as a patient, on a page you control, and the professional guidance that applies to testimonials generally applies here too. Linking to your reviews avoids the question entirely.
What about a photograph of the team with a patient in the background?
Crop them out or use another frame. Nobody in the waiting room agreed to appear on your website, and the fact that they are incidental to the shot is not something they can be expected to have considered.
How long should enquiry messages be kept?
Long enough to answer them and no longer, with a decision written down. Most clinics keep nothing beyond the point where the enquiry became an appointment, at which stage the information belongs in the records system instead.
Is an anonymised case study acceptable?
It depends how small your practice is. Removing the name does not anonymise a case if the condition, the treatment and the town together identify one person. The test is not whether a stranger could identify them, it is whether their neighbour could.