Compliance
Hosting doesn’t make you compliant. It can stop making things worse.
A practice website carries exposures a general web host has never had to think about. These are the four we find most often, what the actual obligation is, and where we can and can’t help.
1. Your enquiry form is collecting health data
The moment a patient types “I’ve had knee pain since March” into your contact form, you are processing special category data under Article 9 of the UK GDPR. That’s a higher bar than ordinary personal data, and it applies whether or not you intended to collect it.
The practical problem is usually storage rather than intent. Most WordPress form plugins keep a copy of every submission in the site database by default, and email a copy as well. So the enquiry exists in three places: the database, the recipient’s inbox, and often a plugin’s own log. Practices are frequently surprised to find four years of detailed symptom descriptions sitting in a database they’ve never looked at.
What we do: when you move to us, we tell you what your form plugin is currently retaining and for how long. If you want submissions to stop being stored in the database, we’ll configure that. Setting the retention period is your decision to make — we’ll implement it.
2. The cookie banner probably isn’t doing what you think
Under PECR, non-essential cookies and similar technologies need consent before they are set. Analytics counts. Advertising pixels count. Embedded maps and videos often count.
The common failure is a banner that appears correctly and looks compliant, while the analytics script has already loaded in the page head and fired before anyone clicked anything. This is a configuration issue rather than a legal subtlety, and it’s on a large share of the practice sites we look at.
It’s easy to test. Open your site in a private browser window, decline everything, and check whether tracking requests still go out. If they do, the banner is decoration.
What we do: we’ll set up a consent tool with prior blocking properly configured and show you the before and after.
3. Accessibility — what actually applies to you
There’s a lot of confused advice here, so to be precise: the Public Sector Bodies (Websites and Mobile Applications) Accessibility Regulations 2018 apply to public sector organisations. A private clinic is not usually one, so those regulations generally don’t bite.
What does apply is the Equality Act 2010, which requires service providers to make reasonable adjustments for disabled people — and that duty is anticipatory. You’re expected to have thought about it before someone struggles, not after they complain. WCAG 2.2 AA is the standard used to demonstrate you’ve done so, and it’s what any NHS-facing contract or procurement exercise will ask about.
In practice, the things that fail on practice sites are unglamorous: poor colour contrast on appointment buttons, form fields without labels, PDFs of price lists that a screen reader can’t read, and video without captions.
What we do: we’ll flag the obvious failures on your site. Remediation is design work — sometimes ours, sometimes your web designer’s — and we’ll say which.
4. You need a processor agreement in writing
Your practice is the data controller. We’re a processor for anything held on the site. Article 28 requires that relationship to be governed by a written contract, so you get one as standard rather than on request.
If your practice completes a Data Security and Protection Toolkit return, or fills in supplier due diligence for an insurer or an NHS partner, that agreement plus confirmation of UK data location answers a decent chunk of it.
Where we stop
We’re an IT company, not a law firm and not your DPO. We can tell you what your website is doing and change what it does. We can’t tell you what your retention period ought to be, whether your privacy notice is adequate, or how to handle a subject access request. If you don’t have someone advising on that, get someone — it’s a smaller job than practices expect.
Free check of your current site
Send us the domain. We’ll tell you what your forms are retaining, whether your cookie banner blocks before consent, and what’s out of date. No obligation and no sales call attached to it.