First, work out which rules apply to you
The requirements differ for a public hospital and a private practice. Public and municipal organisations follow a detailed government list that goes right down to the director's office hours and current job openings. Private clinics offering paid services follow the rules on paid medical services, which are a separate and shorter set.
On top of that, everyone is covered by data protection law and advertising law. The practical step: open the current version of the document that applies to you and walk the list of clauses like a checklist. It's dull, it takes about an hour, and it clears most of the questions an inspector would raise. Wording in regulations changes, so do the final pass with a lawyer who works in the medical field.
The baseline: what has to be reachable from any page
An inspector won't use your site search to find things. Create one section - call it "About the organisation" or "For patients" - and link it from the footer, so it's present on every page.
What goes in there:
- Full legal name, legal form, registration and tax identifiers, registered address plus the address of every location where services are actually provided, opening hours, phone numbers.
- Licence details: number, date, issuing authority, and the list of covered work and services. Add a scan and a link to the official register entry so a patient can verify it independently.
- The price list for paid services and the terms under which they're provided. Show the date the price list was updated - a mismatch between the site price and the price at the desk is a common source of complaints.
- A sample service contract and information on which of those services are available free of charge under state guarantee or insurance programmes. That last point is the one most often left out.
- Patient rights and obligations, how complaints are handled, and contact details for the relevant health and consumer protection authorities.
Doctors and services: build them as data, not images
Each specialist needs a name, position, specialty, education, valid accreditation or certificate, qualification category and years of experience. The key implementation requirement: this has to be text in a database, not an image and not a PDF. Otherwise a year from now you'll be asking a designer to redraw forty layouts because one doctor's category changed.
Ask your developer for an admin panel with proper fields: name, specialties, education, documents, which locations the doctor works at. Then the doctor's profile, the listing on the "Doctors" page and the specialty filter all come from the same data and never drift apart.
Same with services. A service is an entity with a name, price, description and links to doctors and locations. If prices live inside a single price-list image, they'll fall out of sync within the first month.
Personal data: where fines actually come from
Online booking and contact forms are personal data processing, and health information is a special category with stricter rules. Which leads to a practical decision: don't ask for symptoms, diagnosis or medical history in the booking form. Name, phone, service, preferred time - the doctor will get the rest at the appointment. Less data collected means fewer obligations.
What to check right now:
- Every form has a consent checkbox, and it isn't pre-ticked. A pre-checked box is a standard finding.
- There's a link to the privacy policy next to it, and it actually opens instead of hitting a 404.
- Submissions and the patient database are stored on servers in the jurisdiction your data protection law requires.
- The organisation has filed its data processing notification with the regulator. Penalties for missing it have grown noticeably, and you can file it yourself through the regulator's portal.
- Consent to marketing messages and consent for medical services are separate items, not one combined tick.
Copy: what you can't write, even if competitors do
Advertising of medical services is restricted. You can't guarantee recovery or the absence of side effects, you can't cite specific cases of a cure or patient thank-you notes, and you can't create the impression that seeing a doctor is unnecessary. Advertising of treatment has to carry a warning about contraindications and the need to consult a specialist.
What this means for the site: drop "gone for good", "100% results" and "the best clinic in town" from your headlines. Patient reviews on the site are a risk zone - they're regularly treated as references to specific cases of a cure. If reviews matter to you, agree the wording with a lawyer before publishing, not after a letter from the regulator.
Before-and-after photos are also read differently depending on the type of service. There's no universal answer here, and any contractor who says "just put them up, everyone does" is simply shifting the risk onto you.
How to audit your site and what to ask a developer
Open your "About the organisation" section on a phone and note which of the items above are missing. Then send a test enquiry and see where it lands and which services it passes through. If enquiries go to a foreign mailing service or a CRM hosted outside the required jurisdiction, that's a separate migration task.
When discussing a build, ask four questions: where will it be hosted, who fills in the mandatory sections - you or them, can doctor profiles and the price list be edited without a developer, and does the work include forms with correct consent handling. Ask for the quote as a list of blocks and pages. If you get one line with a number, you have no way to tell what's inside it, and the mandatory sections will turn up later as "extra work at extra cost".
One honest note: if you're a single practice with no online booking and your traffic comes from maps and messengers, you don't need a large site yet. A compact site with the mandatory information, services and contacts is enough. A doctor directory, patient accounts and integration with a medical information system make sense once you have several locations or a schedule patients need to see.
If you want help building it
At EFIMOV DEV we build websites for medical clients on React and Node.js: structured doctor and service profiles, an editable price list, forms with correct consent handling, and hosting in the jurisdiction you need. You discuss the work directly with the person running your project, not through a manager relaying messages. Starting ranges for corporate sites, landing pages and support are published on our site; the exact quote comes after a brief, once the number of locations, doctors and integrations is clear.
The mandatory part of a clinic website isn't design, it's data: licence, prices, doctors, patient rights and correct consent handling. Walk the list from the regulation that applies to you like a checklist, and most of the risk is closed before anyone comes looking.
Frequently asked
Does a private clinic need an accessibility version for visually impaired users?
The law requires it of public and municipal organisations. A private clinic formally isn't obliged, and a separate "low-vision version" behind a yellow button is usually useless anyway. It's more valuable to get contrast, readable type size and working keyboard navigation right from the start - cheaper than maintaining a second version of the site.
Can we publish patient reviews on a clinic website?
It's a grey area. Advertising law prohibits references to specific cases of a cure and patient thank-you notes in medical advertising, and a website is often treated as advertising. Safer not to publish reviews that describe a diagnosis and treatment outcome, and to clear the wording with a lawyer before it goes live.
Can a clinic site be built on a website builder?
Technically yes, but check two things: where enquiries are physically stored, and whether you can maintain doctor profiles and the price list as structured data. If data goes to servers outside the required jurisdiction, you're breaching data localisation rules, and no template setting fixes that.
Who fills in the mandatory sections - the studio or the clinic?
Licence details, doctors' diplomas and the price list come from you; no contractor can invent them. The developer's job is to design the fields and sections for that data in advance and tell you exactly what to gather. Put that split in the contract so it isn't an argument at handover.