A booking form looks like the least sensitive part of a clinic's website. Name, email, phone, pick a time. But at a blood testing clinic, the test someone chooses can reveal a great deal: a sexual health screen, a PSA test, a fertility panel. Put a name next to that and a simple booking becomes a record about someone's health.
of America's top 100 hospitals had a tracker on their website that sent data to Facebook whenever someone clicked to book a doctor's appointment. Booking pages are where sensitive data quietly leaks.
Source: The Markup, 2022Booking data is health data
Under UK GDPR, data concerning health is special category data, and that includes information revealed by the care someone receives. So treat every booking as health data, not just the results. The clinic is the controller: it decides why the data is collected and answers patient requests. Any booking software it uses is a processor and should be bound by a data processing agreement.
What to leave off the form
- Health questionnaires, unless a clinician genuinely needs the answers before the visit
- Free text boxes like "anything else we should know?". People fill them with symptoms and medical history
- Date of birth, unless you have a recorded reason, such as your lab needing it to match samples
- Pre-ticked boxes of any kind
(opens full size in a new tab)What needs a tick, and what does not
For most clinics, the lawful basis for taking a booking is the contract with the patient, not consent. So the privacy notice is something they read and acknowledge, "I have read the privacy notice", rather than agree to. Marketing is different. It needs its own separate, optional box that starts unticked, and you should record when it was ticked and the exact wording shown. Text reminders deserve their own opt in as well.
Keep test names out of texts and links
Text messages appear on lock screens and shared phones. Links end up in browser histories and email previews. Neither should name the test. "Your appointment on Friday at 08:10" tells the patient everything they need and tells anyone glancing at the screen nothing.
Watch what runs on your booking page
Analytics and advertising pixels are added to websites all the time, often by a marketing agency, and they record what visitors click. On a booking page, a click can be the name of a test. Keep trackers off booking pages entirely, or take bookings through a system that loads none and only lets itself be embedded on your own website.
Be ready for patient requests
Patients can ask to see, correct, restrict, or erase what you hold about them, or to stop marketing, and you generally have one month to respond. That is easy if your booking system can do it in a few clicks, and painful if it means digging through inboxes and spreadsheets.
- Export one patient's full record in a readable format
- Correct their details, with the change logged
- Restrict a record so it cannot be used or changed
- Erase a patient and their bookings, subject to your retention rules
- Stop all marketing straight away
This is general guidance, not legal advice. Check your own obligations with your data protection lead.
We built these rules into Drawn, the booking system for blood testing clinics we are working on. Its demo uses a made up clinic, so you can see how the form behaves without entering anything real.
Sources
Want this built for you?
Tell us what you are trying to grow. We will tell you plainly what we would build and what it should bring back.
Related service: Custom CMS
