GDPR for medical practices: where the risk hides on your website and digital tools
A medical practice’s website collects health data more often than you think: in an appointment form, in a pixel, in a Viber message. Here is where the risk hides and what the authorities have already penalised.
Why patient data needs extra care
Under the GDPR, health data is a “special category” of data (Article 9). You may process it for medical care, but not for anything else without a proper legal basis. For doctors, medical confidentiality applies on top of that.
The Court of Justice of the EU has ruled that health data isn’t only the medical record. It can even be a visit to a page with sensitive content or an order from a pharmacy. So GDPR for medical practices also covers your website, its forms and the tools running behind it.
And enforcement isn’t only about big hospitals. In recent years the Hellenic Data Protection Authority has dealt with private doctors and polyclinics: a parent who wasn’t given access to their child’s data, patient photos that stayed on Instagram after the patient withdrew her consent, and a lost imaging scan that cost a polyclinic €30,000.
Forms and online booking
The appointment form is often the first place a patient writes what’s wrong with them. If the message lands in a shared inbox that many people open, is stored without protection, or asks for more than you need to book the appointment, the risk is yours.
With online booking platforms, the first question is who is responsible for what. When a provider processes data on your behalf, the GDPR requires a written agreement with them (Article 28). Many practices don’t know whether they’ve signed one or what it says.
Cookies, pixels and analytics
Most websites run measurement and advertising tools, such as Google Analytics or the Meta pixel. On a medical practice’s website, these can tell third parties which pages someone viewed, e.g. a page about depression treatment, together with data that identifies them.
The risk isn’t theoretical. In Sweden, the pharmacy Apoteket was fined SEK 37 million, about €3.2 million, in 2024, because the Meta pixel on its website was sending details of health-related purchases. In Norway, a private clinic with online booking was reprimanded in 2025 for Google and Bing pixels running without valid consent.
In Greece, the Data Protection Authority has required consent since 2020 for every cookie that isn’t necessary, with “Reject” as easy as “Accept”. A banner alone isn’t enough, though. What matters is what actually runs on the website before and after the visitor chooses, and that only shows up in a technical review.
Email, Viber and test results
A test result sent to the wrong person is one of the easiest mistakes to make. The Authority has already looked at a diagnostic centre that emailed a patient’s results to a third party. Harm was avoided only because the file was encrypted.
Conversations with patients from a personal phone, in apps the practice doesn’t control, carry the same risk. You don’t need to stop communicating digitally. You need to know which channel you use for what, who has access, and what happens if a phone gets lost.
AI tools and chatbots
Pasting a patient history into ChatGPT to write a medical letter faster seems harmless. In practice, you’re sending health data to a third-party provider. In the Netherlands, the data protection authority described as a serious breach, in 2024, the case of a medical practice employee who entered patients’ medical data into an AI chatbot.
If you’re considering an AI chatbot on your website to answer patients’ questions, the question is what it keeps from the conversations, where and for how long. And since August 2026, the AI Act’s transparency rules apply: visitors must know they’re talking to AI.
When something goes wrong
A lost device, a hacked website, an email to the wrong person. If it involves patient data, the GDPR gives you 72 hours to notify the Data Protection Authority, and in serious cases the patients themselves must be told too.
In 2026 the Authority fined the General Hospital of Thessaloniki “G. Gennimatas – Agios Dimitrios” €25,000. A surgery list with the phone numbers and conditions of 2,820 patients stayed on its website for months and appeared on Google. The notification came after 96 hours instead of 72, and the patients were never informed. The 72 hours go by fast when you don’t have a plan for when a crisis hits.
GDPR in the medical practice FAQ
Do I need a DPO as a doctor?
Usually not, if you’re a private doctor. The GDPR and the Authority itself give the processing of patient data by a private doctor as an example of processing that isn’t “large scale”. For clinics, diagnostic centres and hospitals the answer is often different.
Do I have to register my patient files with the Authority?
No, the old notification requirement was abolished with the GDPR. But you must be able to show that you comply. Even a small practice needs a record of processing activities, because it processes health data.
How long do I keep a medical record?
Under the Greek Code of Medical Ethics (Article 14), private practices keep the record for ten years from the patient’s last visit, while clinics and hospitals keep it for twenty.
GDPR for medical practices isn’t a privacy policy at the bottom of the page. It’s how your website, forms and tools actually work. At CNCTECH we work with more than 150 healthcare clients, and we review the technical side: what the website collects, where the data goes, and what runs before consent. For the legal documents, your lawyer or DPO has the final say.
This article is for informational purposes only and does not constitute legal advice. For specific cases, contact a legal advisor or your data protection officer (DPO).
