Health Data and Online Forms: Keeping Clinic Websites Simple and Safe

What counts as health data

Health data is any information about a person's physical or mental health, including the care they receive, that reveals something about their health status. On a clinic website, that can include obvious things such as symptoms, diagnoses and medication, and less obvious ones. A request for "an appointment about my diabetes" is health data. So, arguably, is the fact that someone asked to book at a fertility clinic, because the request itself reveals something about their health.

This guide is not legal advice. It explains why we design clinic forms the way we do, and where to look for the full rules.

What UK GDPR asks for

The Information Commissioner's Office explains that special category data, which includes health data, carries extra requirements. Its guidance says:

• You must identify both a lawful basis under Article 6 and a condition for processing special category data under Article 9^[1].
• You must carry out a data protection impact assessment if you plan to process special category data on a large scale^[1].
• For some Article 9 conditions, you also need an "appropriate policy document" under the Data Protection Act 2018^[1].

A clinic will normally have worked through all of this for its clinical records. The question for the website is whether the form creates a new route for health data that falls outside that work.

How website forms create risk

A typical website form does not keep data in one place. A single submission may be stored in the website's database, sent by email to one or more inboxes, copied into a form plugin's logs, backed up by the hosting company and synced to a phone. Each copy is a place where health data could be exposed, kept too long or forgotten.

Clinical record systems are built with access controls, audit trails and retention rules. A website contact form and a shared reception inbox usually are not. That gap is the main reason to keep clinical details out of website forms.

What a minimal request form looks like

For most clinics, reception needs a small set of details to arrange a first appointment:

Even this form can touch health data, because choosing a service can reveal something about a person. For clinics where the service itself is sensitive, such as sexual health, fertility or mental health, a generic "type of appointment" field and a call back may be better than a detailed service list. Your data protection lead should make that call.

Next to the message box, a short note asking patients not to include health details reduces what arrives by accident. It will not stop everyone, so the inbox that receives submissions should still be treated with care.

Where clinical information should go instead

Some services genuinely need clinical information before an appointment, such as a pre-assessment questionnaire, a referral letter or a safety screen before a scan. Those are better handled by systems built for clinical data:

• Your practice management or electronic record system, if it has a patient portal or secure forms.
• A dedicated secure form or portal service that your clinic has assessed and that is covered by your data protection documents.
• A phone call from a clinician or trained administrator, recorded in the clinical system.

The website's job is to point patients to the right route, explain why, and make it easy to start.

Telling people what happens to their data

People have the right to be told how their data will be used when it is collected. The ICO's guidance on the right to be informed sets out what a privacy notice should cover, including the purposes, the lawful basis, retention periods and who the data is shared with^[2]. The form should link to a privacy notice section that describes that form specifically: what it collects, where submissions go, how long they are kept and how to ask for them to be deleted.

If the form sends data to a third-party service, such as a booking platform or an email tool, the notice should name the type of service and why it is used.

Cookies and tracking on clinic pages

Tracking tools can leak health information too. A marketing pixel on a treatment page can tell an advertising platform that a particular visitor viewed a page about a sensitive condition. The Data (Use and Access) Act 2025 added new exceptions to the cookie consent rules, which came into force on 5 February 2026^[3][4]. The ICO published its final guidance on storage and access technologies on 29 April 2026^[5]. Osborne Clarke's summary of that guidance explains that the new exceptions cover statistical analytics and preference cookies only where the technology is used solely for those purposes and people have a simple and free way to opt out^[6]. Advertising pixels are not covered, so on clinic sites we leave them off sensitive pages entirely unless the clinic has a clear reason and consent in place.

A form review checklist

1. List every field on every form, and remove any that reception does not need for a first contact.
2. Check where submissions are stored, emailed and backed up, and how long each copy is kept.
3. Add a note asking patients not to include health information in free text.
4. Move pre-assessment and referral uploads to a clinical system or secure portal.
5. Update the privacy notice so it describes each form accurately.
6. Review tracking tools on treatment pages, especially for sensitive services.