What GDPR actually requires from a clinic website in 2026 (and what an auditor checks first)

A clinic website is not a brochure. The patient types a phone number into a booking form, leaves an email address when signing up for the newsletter, clicks 'I agree' on cookies, sometimes sends a question about a specific condition through a chat with reception. Every one of these is processing of personal data. Some of it is a special category of data.

Nobody needs a lecture on GDPR. You need to know what gets checked first, where the real gaps are on 90% of clinic websites in Poland, and what to fix so the site keeps selling appointments effectively. No theorising.

A clinic website touches GDPR in five specific places:

A static site with three subpages and an email address in the footer has a minimal scope of obligations. A site with online booking, a calendar, reviews and an advertising pixel has far more. Most private clinics are closer to the second scenario, because those are exactly the elements that fill the calendar.

GDPR distinguishes ordinary data (name, phone, email) from special category data (health, sexuality, origin, biometrics, religion). The latter sits in Art. 9 and requires one of a few specific legal bases, not consent alone.

When a patient selects 'visit to a gynaecologist', 'oncology consultation' or 'root canal treatment' in the booking form, the specialty itself becomes information about health. At that moment we are in Art. 9. For a clinic the most common and safest basis is Art. 9(2)(h) GDPR: processing for the purposes of providing healthcare.

In practice this means two things. First: the patient does not 'consent to the processing of medical data in order to book a visit', because consent is not the right basis here. Second: they must know who processes the data, for what purpose, for how long and to whom it is passed on (laboratory, the national health fund, the practice management system). A notice under the form, clear and specific, covers all of it.

A practical order, whether it is the supervisory authority, an internal auditor or an aware patient checking the clinic before a visit. Everything here can be checked without going inside the clinic's systems, from the website alone:

This whole list is an hour of checking with no special tools. A patient armed with patience or with dissatisfaction will do it themselves. The authority starts from the same place.

No policy is a clear breach and is quick to fix. A copied policy pretends to be compliant, but inside it references entities the clinic never had, legal bases that do not fit, and retention periods taken from e-commerce. An auditor needs 5 minutes.

A privacy policy for a clinic differs from a shop's policy in several places. The legal bases are different (mainly Art. 9(2)(h), not consent). The data recipients are different (laboratories, the national health fund, the practice management system provider, possibly other facilities in the network). The retention periods are different (20 years for medical records, a dozen or so months for bookings that never happened). The patient rights are different (the right to a copy of medical records under the Patients' Rights Act runs in parallel with GDPR and has its own deadlines).

If the clinic's policy mentions a 'buyer', an 'order' or a 'courier' anywhere, it was copied from e-commerce. That is the first thing to cut.

A cookie banner in the 'we use cookies, OK' style stopped being compliant years ago, but it still lives on most clinic sites. Three rules an auditor checks first:

In practice, for most clinics an honest banner with three buttons (Accept all, Necessary only, Customise) and a simple integration with Consent Mode v2 on the Google side is enough. Implementation takes hours, not weeks. More important than the specific tool is the default: the pixel does not fire until there is consent.

Patient reviews are one of a clinic's strongest sales tools. Patients read them before choosing a facility. The problem starts at publication.

The review text itself ('great service, highly recommend') is neutral. But 'Anna Kowalska, root canal treatment' is already two kinds of personal data at once: identifying data and information about a health service. Publishing such a review requires the patient's freely given, separate consent to publish.

Good solutions that work for sales and are safe:

Google Maps reviews embedded in the site are, for 90% of clinics, the best version: they sell effectively, they are credible because the patient sees the star count and the date, and they require no special consent process from the clinic.

A newsletter is a good thing. Patients who came once come back. But a badly set up newsletter earns us both an administrative fine and the patient's distrust at the same time.

An 'I want to receive the newsletter' checkbox cannot be ticked before the patient clicks. A pre-ticked box is not consent within the meaning of GDPR, and every version of the supervisory authority's guidance confirms it.

A consent 'to process data for booking, marketing and sending partner offers' is not one consent, but three glued into one. Separating them is usually an hour of work. Conversion usually does not drop, because a patient who wants an appointment ticks the first checkbox and does not think about it any longer.

The patient leaves an email address, we send an email with a confirmation link, the patient clicks. Only then are they on the list. Filtering out typos, fewer spam complaints, better deliverability and an unambiguous evidence trail that the patient really did want the newsletter.

The maximum administrative fine under GDPR is EUR 20 million or 4% of annual turnover (the higher of the two applies). In practice the Polish authority has already imposed six-figure fines on medical facilities for patient data breaches. The more common route to trouble, though, is not a systemic inspection but a patient complaint.

The pattern is simple. A patient gets a newsletter they did not order, or sees themselves in a photo in the reviews section without consent, or receives information about their condition at the wrong address. They report it to the authority. The authority asks the clinic for an explanation, requests the record of processing activities, copies of consents and the policy. And that is when it turns out the policy is copied, the consents are glued together and there is no record.

An external audit of the site and processes runs into a few thousand zloty. An administrative fine and the cost of fixing things under time pressure are an order of magnitude higher.

A list that closes 80% of the real risks for a typical clinic website:

The first four points can be done in a single day without developers. The rest need support from someone who knows the site from the inside, but still fit within a week.

The line most often repeated in practices: 'GDPR means I cannot show patient reviews or do effective marketing'. That is not true. You can do both, you just have to do it honestly.

A booking form with a correct information notice converts the same as one without it. A cookie banner with 'Reject' next to 'Accept' does affect the number of pixel consents, but that only means we have been collecting consents patients would not have given if they had a choice. A newsletter with double opt-in has a smaller base but a higher open rate and a lower bounce.

Well set up GDPR is invisible to the patient and invisible to the auditor. Badly set up, it goes off at both of those moments at once.

Most GDPR problems on clinic websites come from two sources: a policy copied off the internet, and marketing decisions made before anyone checked their legal implications. It is fixed quickly once you know where to look.

If you are planning a new clinic website, GDPR is cheapest to close at the design stage. See what a clinic website really costs in 2026 and how the decision between booking portals versus your own booking system plays out. In each of these scenarios GDPR looks different and costs different.

EPKO runs a GDPR audit of a clinic website as part of our Audit package. A scanner checks the technical side (HTTPS, headers, pixels, cookie banner), a checklist covers the visible elements (privacy policy, notices, consents, reviews). The result is a report with the three most important things to fix first and a list of smaller corrections. If you decide to work with us after the report, the audit price is deducted from the next package. You will find the current scope and price in our pricing, and to get started, leave your details on the contact page with a note 'clinic GDPR audit' and we will get back to you within one business day.