Patients research symptoms, compare providers, and make booking decisions online, all before ever picking up the phone. Your website must therefore do something most business websites never have to: establish clinical trust and handle sensitive data correctly, at the same time.
Healthcare websites carry obligations that a normal commercial site does not, and they are also judged more harshly by visitors. This article covers what applies to Dutch healthcare providers, the design choices that build confidence, and the technical decisions that keep you compliant.
The rules that apply to Dutch healthcare providers
Health data is a special category under the GDPR, which means the baseline requirements are considerably stricter than for ordinary personal data.
Special category processing needs a specific legal basis. For care providers this is normally the provision of healthcare under professional secrecy, rather than consent. This matters practically: you cannot rely on a checkbox to justify processing that has no other basis.
The WGBO applies to the treatment relationship, including record-keeping obligations and the twenty-year retention period for medical files. Your website is not a medical record system, but any intake form that captures health information becomes part of that chain.
NEN 7510 is the Dutch information security standard for healthcare. Larger providers are expected to work to it. Smaller practices are not always formally certified, but the expectations around access control, logging, and encryption increasingly filter down through insurers and partners.
Advertising rules restrict what you may claim. The Geneesmiddelenwet and professional codes limit claims about treatment outcomes. Testimonials describing clinical results are a particular risk area.
The intake form problem
This is where healthcare websites most commonly go wrong, and it is worth being direct about it.
A standard website contact form sends its contents by email. Email is not a secure channel. If your form asks a visitor to describe their symptoms, you have just transmitted special category health data in plain text and stored it indefinitely in an inbox.
The correct approaches, in order of preference:
- Do not collect health data on the website at all. Ask only for a name, contact details, and a preferred time, then take the clinical detail through a secure channel. This is the simplest and safest option and it suits most practices.
- Use a dedicated secure intake platform that encrypts at rest, controls access per user, logs who viewed what, and provides a processing agreement.
- If a form must capture health information, it should write to an encrypted store rather than sending email, with notification containing no clinical content.
Whichever route you choose, state clearly next to the form what will happen to the information. Patients notice, and it builds confidence rather than undermining it.
Trust signals that matter to patients
Patients evaluate a healthcare website differently from a commercial one. They are looking for competence and safety, not value.
- Named practitioners with real photographs and credentials. BIG registration numbers where applicable. Anonymity reads as evasion in this context.
- Clear scope. What you treat and, just as importantly, what you do not. Patients respect a provider who refers appropriately.
- Practical logistics. Address with parking and public transport, opening hours, what to bring, whether a referral is needed, insurance arrangements. These questions dominate the enquiries a practice receives.
- Honest treatment information. What happens, how long it takes, what recovery involves, and what the risks are. Providers often fear that discussing risk deters patients; in practice it is one of the strongest trust signals available.
- Transparent complaints and privacy information. Easy to find, plainly written.
Accessibility is not optional here
Healthcare audiences include people with visual impairments, motor limitations, cognitive difficulties, and older visitors using older devices. Accessibility failures exclude precisely the people most likely to need care.
The practical baseline: sufficient color contrast, text that scales without breaking the layout, full keyboard navigation, descriptive alternative text on images, properly labelled form fields, and no information conveyed by color alone.
Public sector healthcare bodies in the Netherlands have formal obligations under the Tijdelijk besluit digitale toegankelijkheid. Private practices generally do not, but the WCAG 2.1 AA standard is the sensible target regardless, and it is far cheaper to build in than to retrofit.
Speed and mobile, in a healthcare context
A person searching for a symptom at eleven at night is on a phone, possibly anxious, possibly on a poor connection. A slow site does not merely lose a conversion here; it sends someone who needs care to a competitor or, worse, to an unreliable source.
Keep the pages that matter light: the homepage, treatment pages, and the contact page. Large hero videos and heavy image galleries are exactly the wrong trade-off for this audience.
What to avoid
- Analytics and marketing pixels on treatment pages. The page a visitor views can itself reveal health information. Loading a marketing tracker on a page about a specific condition creates a genuine privacy problem, and it is one regulators have commented on.
- Externally loaded fonts and embeds that transmit visitor IP addresses before consent.
- Patient stories used as marketing claims. Beyond the regulatory risk, consent for publication must be explicit, specific, and withdrawable.
- Live chat that invites clinical detail without a secure back end and a clear notice.
Frequently asked questions
Can we use Google Analytics on a healthcare website?
With care. It requires consent, and you should consider excluding pages that reveal specific conditions, since the page path alone can constitute health data. Several practices we work with choose a privacy-focused, EU-hosted analytics tool instead, which avoids most of the difficulty.
Do we need NEN 7510 certification for a website?
Formal certification is generally aimed at organizations processing significant volumes of patient data in clinical systems. A brochure website that does not store health data usually falls outside it. If your website connects to a patient record system, the question changes and you should take specific advice.
Can patients book appointments online?
Yes, provided the booking system is designed for healthcare: encrypted, access-controlled, EU-hosted, and covered by a processing agreement. Avoid generic scheduling tools that were not built with special category data in mind.
How do we handle reviews?
Carefully. You cannot confirm or deny that a reviewer is a patient without breaching confidentiality, which constrains how you may respond publicly. Agree a response policy in advance, keep replies general, and never reference any clinical detail.
Where to begin
If you have an existing site, start with the intake form, because that is where the real exposure usually sits. Then check what loads before consent, then work through accessibility.
We build healthcare websites with these constraints designed in from the start rather than bolted on, including secure intake, EU hosting, and accessibility as standard. You can see our approach on the business website page, or tell us about your practice and we will be specific about what your situation requires.
This article is general information, not legal or medical-regulatory advice. For obligations specific to your practice, consult a specialist adviser.