Creating a website for doctors: GDPR, health data hosting, and ethics
A website for a doctor must reconcile two constraints specific to the profession: enhanced GDPR compliance for any health data, which requires certified health data hosting as soon as a contact or appointment booking form collects medical information, and the regulation of communication by the medical council, which prohibits commercial advertising in favor of fair, non-comparative information.
The real problem: a standard brochure site isn't technically enough
Most website providers build a standard brochure site, hosted on generic infrastructure. For a medical practice, this technical choice becomes a problem as soon as the site offers online appointment booking or a contact form asking for a reason for consultation: this information counts as health data under the GDPR, and its hosting must comply with certified health data hosting requirements, a framework distinct from standard web hosting.
This technical point is often overlooked by practitioners who order a site without asking the question, and by some providers who don't mention it spontaneously. A brochure site with no health data collection (practice presentation, hours, directions, no medical form) does not have this constraint. As soon as a form asks for a reason for consultation or any health-related element, certified hosting becomes necessary. This is a point to explicitly check with any provider before launching the project, VeryAppi included: as of today, this certification is not confirmed in our standard offer, and a practice considering this type of feature should clarify it upfront rather than assume it.
What the medical council regulates in communication
The medical code of ethics has long held to a constant principle: medicine must not be practiced as a business. In practice, this means a doctor's website can inform, but not promote:
- No superlatives ("the best practice," "exceptional results") or comparisons with other practitioners.
- No patient testimonials used as a marketing argument — the profession remains stricter on this point than other regulated occupations.
- A factual presentation: qualifications, specialties, career path, hours, appointment booking methods, health insurance agreement status.
- Fees may be displayed as long as they serve to inform the patient, not to promote.
For any specific question about planned content, the departmental medical council remains the competent authority. No provider, VeryAppi included, can certify that content is "compliant": known best practices are built into the site, but final responsibility for the content rests with the practitioner.
GDPR and health data: technical points to check
| Element | What it involves |
|---|---|
| Appointment booking form with reason for consultation | Requires certified health data hosting |
| Simple contact form (name, phone) | Generally falls outside strict health data hosting scope |
| Retention of patient data | Limited duration, to be defined and documented |
| Patient information | Clear disclosure of how collected data is used, GDPR compliant |
| Securing exchanges (form, any patient portal) | Encryption and restricted access expected |
These are points to validate explicitly with the chosen provider. A medical site that collects no health data (only contact details for a callback) remains simpler to bring into compliance than a site with built-in appointment booking requesting a medical reason.
What patients expect from a medical practice website
Visitors to a doctor's website generally want to quickly verify three things: the practitioner's specialties and career path, practical details (hours, address, transport options, insurance agreement status), and a simple way to book an appointment. The most useful features:
- A clear presentation of specialties and career path, without superlatives.
- Consultation hours and terms (by appointment, emergencies, teleconsultation).
- A link to an existing appointment booking platform (Doctolib or equivalent) rather than a proprietary system, often simpler and already technically compliant.
- A map showing how to reach the practice and insurance agreement information.
- A general information page on conditions treated, written carefully to remain informative rather than promotional.
How much this type of site costs, and in what timeframe
A medical practice going through a traditional agency for a presentation site generally pays between 2,000 and 6,000 euros, over a 4 to 8 week timeframe. VeryAppi does not yet offer a plan dedicated to doctors like the one built for lawyers, but the general subscription website offer applies under the same conditions: 99 euros excl. tax/month all-inclusive (69 euros excl. tax/month for the first three months), delivery in 7 days, unlimited edits within 48 hours, hosting in France. For any project involving health data collection, the question of certified hosting must be asked before signing, regardless of the provider chosen.
Key takeaways
- A medical site that collects health data (reason for consultation, medical history) requires certified health data hosting, distinct from standard web hosting.
- A simple brochure site without a medical form does not have this technical constraint.
- Commercial advertising remains prohibited for the medical profession; only fair, factual information is authorized.
- Linking the site to an existing appointment booking platform (like Doctolib) often avoids recreating a proprietary medical data collection system.
- The departmental medical council remains the reference authority for any specific compliance question, not the site provider.
Frequently asked questions
Is a doctor allowed to advertise on their website? Commercial advertising remains prohibited for the medical profession. However, fair, clear, and non-comparative information about skills, hours, and ways to get in touch is authorized. The line between information and advertising is assessed case by case, with the departmental medical council as the reference authority.
Does a simple contact form require certified health data hosting? It depends on the information requested. A form that only collects a name and contact details to arrange a callback generally falls outside the scope of certified health data hosting. As soon as a reason for consultation, a medical history, or any health-related element is requested, hosting must be certified. When in doubt, the precautionary principle applies.
Can consultation fees be shown on the site? Yes, displaying fees and coverage terms is generally considered useful information for the patient, not advertising. This falls under the duty of fair information toward the patient rather than a commercial approach.
Does the GDPR apply differently to a medical website? The GDPR applies to any site, but health data is classified as a special category requiring reinforced safeguards: certified health data hosting, limited retention periods, clear information for the patient on how their data is used, and secured exchanges.
In summary
A successful medical practice website remains informative rather than promotional, and addresses the question of certified health data hosting from the design stage if appointment booking or a medical form is planned. If you're looking for a fast, affordable solution for a brochure site without health data collection, VeryAppi's subscription website plan applies to medical practices under the same conditions as other professions.
Frequently asked questions
›Is a doctor allowed to advertise on their website?
Commercial advertising remains prohibited for the medical profession. However, fair, clear, and non-comparative information about skills, hours, and ways to get in touch is authorized. The line between information and advertising is assessed case by case, with the departmental medical council as the reference authority.
›Does a simple contact form require certified health data hosting?
It depends on the information requested. A form that only collects a name and contact details to arrange a callback generally falls outside the scope of certified health data hosting. As soon as a reason for consultation, a medical history, or any health-related element is requested, hosting must be certified. When in doubt, the precautionary principle applies.
›Can consultation fees be shown on the site?
Yes, displaying fees and coverage terms is generally considered useful information for the patient, not advertising. This falls under the duty of fair information toward the patient rather than a commercial approach.
›Does the GDPR apply differently to a medical website?
The GDPR applies to any site, but health data is classified as a special category requiring reinforced safeguards: certified health data hosting, limited retention periods, clear information for the patient on how their data is used, and secured exchanges.