Reference

Laws & regulations for UK private clinics.

Every rule that shapes a clinic's website, booking, and patient systems, in plain English. For each one: what it says, what it means for your website, what it means for your systems, and how we handle it when we build for you.

40 rules · 6 clinic types · Last reviewed 10 November 2026

How to read this

Law: An Act of Parliament. Breaking it can mean fines or prosecution.
Regulation: Rules made under an Act, with the same force as the law.
Code: A code a regulator enforces, like the ASA's CAP Code.
Guidance: What a professional regulator expects. Registrants are judged against it.
Standard: A recognised standard, often required by contracts or partners.
Contract: Terms you agree to, like an insurer's recognition terms.

Every clinic

The rules everyone follows.

Whatever kind of clinic you run, these apply the moment you have a website, take a booking online, or send a patient a message.

02RegulationICO

Privacy and Electronic Communications Regulations 2003

Read the source

What it says

Cookies and tracking that are not strictly necessary generally need consent before they are set. Marketing emails and texts need consent, with a narrow soft opt in for existing customers. Appointment reminders are service messages, not marketing. The Data (Use and Access) Act 2025 is changing some of these rules, so check the ICO's current guidance.

Your website: A cookie banner that genuinely holds back analytics and advertising tags until the visitor agrees.
Your systems: Reminders and marketing kept apart, with marketing consent recorded per patient and an unsubscribe link in every marketing message.
How we work: We set analytics up behind consent, and never put tracking pixels on booking or patient pages.

03CodeASA

The CAP Code

Read the source

What it says

Your own website and social posts count as marketing under the CAP Code. Health and beauty claims need objective evidence, testimonials must be genuine, and marketing must not discourage people from seeking essential treatment.

Your website: Claims written in measured terms with evidence on file, and before and after photos treated as claims.
Your systems: No direct impact.
How we work: We flag any claim that needs evidence before the page goes live, and point you to the CAP Copy Advice team when wording is borderline.

04RegulationCMA · Trading Standards

Consumer Contracts Regulations 2013

Read the source

What it says

When people book or buy online, they must get key information before they pay, and most distance contracts carry a 14 day right to cancel. If a client asks for a service to start within those 14 days, they can still cancel, but may pay for what they have used.

Your website: Prices, what is included, and cancellation terms shown clearly before checkout.
Your systems: Cancellation rights built into booking, kit orders, and memberships, with a record when a client asks to start early.
How we work: We set up checkout and confirmation emails to carry the required information, using terms you have approved.

05LawCMA

Digital Markets, Competition and Consumers Act 2024

Read the source

What it says

The CMA can now fine businesses directly for breaking consumer law. Fake reviews, and presenting reviews in a misleading way, are banned outright. Prices should include the fees everyone has to pay.

Your website: Reviews shown honestly, never edited or cherry picked to mislead, and prices that include compulsory fees such as booking fees.
Your systems: Review requests sent to every patient after their visit, not only the ones you expect to be happy.
How we work: We never write, buy, or seed reviews for a client.

06RegulationCompanies House · Trading Standards

Electronic Commerce Regulations 2002 and trading disclosures

Read the source

What it says

A business website must show the business name, a geographic address, an email address, the company number and registered office for a company, and the VAT number if registered. Regulated professions should name their professional body.

Your website: A footer with every required detail on every page, including the clinic's regulator.
Your systems: No direct impact.
How we work: We collect these details at kick off, so nothing is missing on launch day.

07LawEHRC

Equality Act 2010

Read the source

What it says

Service providers must make reasonable adjustments so disabled people are not put at a substantial disadvantage, and that includes booking and using a service online.

Your website: Built to WCAG 2.2 AA: readable contrast, keyboard access, labelled forms, and descriptive alt text.
Your systems: Booking and patient accounts that work with screen readers and without a mouse.
How we work: We test accessibility before launch, not after a complaint.

08RegulationMHRA

Medical Devices Regulations 2002 (software)

Read the source

What it says

Software can count as a medical device if it is intended to diagnose, treat, or make clinical decisions about a patient, which brings its own regulation.

Your website: No direct impact.
Your systems: We build booking, records, and report tools that support clinicians rather than make clinical decisions: results are flagged against the lab's own reference ranges, and a clinician reviews everything before a patient sees it.
How we work: If what you want would make the software a medical device, we tell you before anything is built.

09StandardCard schemes

PCI DSS

Read the source

What it says

Any business that takes card payments must protect card data to the PCI DSS standard.

Your website: Payments taken in secure, hosted card fields from your payment provider.
Your systems: Card numbers never touch your servers or ours, which keeps your compliance burden small.
How we work: We never store card details.

By clinic type

The rules for your kind of clinic.

Built in, not bolted on

Want a site that already follows them?

We build these rules into every clinic website and system we make. This page is a plain English summary, not legal advice. Rules change, so check each source and take advice from your regulator, indemnity provider, or clinical lead.