Custodiance

ICO / UK GDPR · Clinics

Why your UK clinic's website probably breaks GDPR

By Jordan Gilbert

In brief

Most UK clinic websites fail across four modes — patient enquiry forms on US infrastructure, tracking pixels with no lawful basis, CRMs exporting patient identifiers to US tooling, and email marketing mailing patients from US servers. These collide with UK GDPR Article 9 special-category health data, the Caldicott Principles, and the NHS Data Security and Protection Toolkit. A regulated-grade estate moves intake, CRM, and email into UK and EU jurisdiction and documents the sub-processor flows.

Most UK clinic websites — independent practices in podiatry, dentistry, physiotherapy, mental health, fertility, cosmetic, and veterinary care — were built by a high-street web agency a few years ago on whichever SaaS stack carried a template. WordPress on a US host, a Mailchimp signup, a HubSpot form embed, Google Analytics, perhaps Calendly for appointments. The site works. Patients find it. Bookings come in.

It also quietly fails UK GDPR. That gap is the question a patient — and, increasingly, a professional indemnity insurer, or any ICB or PCN reviewing clinical data flows — will eventually ask. The practice is the data controller. The agency is not on the hook; the practice is.

This briefing sets out what is actually wrong on a typical clinic site, and what a regulated-grade estate puts in its place.

The Four Clinic Failure Modes

Every non-compliant UK clinic site fails on one or more of the same four points. We call it The Four Clinic Failure Modes — the framework Custodiance applies on every clinic-site review:

  1. Patient enquiry forms processed on US infrastructure — HubSpot, Mailchimp, Typeform, or a WordPress plugin routing to a US inbox.
  2. Analytics and tracking pixels with no lawful basis — Google Analytics, Facebook Pixel, LinkedIn Insight Tag.
  3. A CRM exporting patient identifiers to US tooling — HubSpot Free, Salesforce, or Pipedrive Lite holding names, contact details, and clinical context in the notes field.
  4. Email marketing mailing patients from US servers — Mailchimp, ConvertKit, or ActiveCampaign.

Where a clinic site fails any two of The Four Clinic Failure Modes, the Article 30 and Article 28 documentation gap is something a DPO will flag inside an hour.

The statute, in its own words

UK GDPR Article 9(1) — special category data:

“Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation shall be prohibited.”

A patient enquiry that names a condition — “I would like to ask about your fertility services”, “my son sees a mental-health clinician” — is special category data the moment it lands. Article 9(2) carves out the lawful bases (explicit consent, healthcare provision under 9(2)(h)), but the special-category bar is the floor, not the ceiling.

The Caldicott Principles (2020 update, National Data Guardian) add the NHS-adjacent layer. Principle 1: “Justify the purpose for using confidential information.” Principle 4: “Access to confidential information should be on a strict need-to-know basis.” A US-resident enquiry form fails Principle 4 the moment a CLOUD Act request becomes lawful access by a third party the clinic never named.

What the clinic is accountable for

As an independent UK clinic, the practice is a data controller under UK GDPR. That is the same law as before Brexit, enforced by the ICO under the Data Protection Act 2018. Three specific obligations follow:

  1. Article 30 — keep records of processing activities: a written list of what personal data the practice processes, why, where it lives, who has access, and how long it is retained.
  2. Articles 28 and 44–49 — where the practice uses a sub-processor (the website host, the form processor, the CRM), a Data Processing Agreement must be in place; and where the sub-processor transfers data outside the UK and EU, a transfer mechanism is required, comprising Standard Contractual Clauses plus a Transfer Risk Assessment.
  3. Article 32 — appropriate technical and organisational measures to keep the data secure.

In addition, where the practice is NHS-adjacent — most clinics are, at least for referrals — it is expected to align with the Caldicott Principles (justify every use of identifiable patient information) and to meet the Data Security and Protection Toolkit (DSPT) baseline.

None of those laws explicitly requires an “EU-sovereign website”. But every one of them eventually asks the same question: where does the data live, who has access, and can the practice prove it? On a typical clinic site, that is the question the practice cannot answer.

The four specific failures on a typical clinic site

1. Patient enquiry forms processed on US infrastructure

The “Contact us” form on most clinic websites is a HubSpot embed, a Mailchimp form, a Typeform widget, or a WordPress plugin sending to a US-resident inbox. Patient names, telephone numbers, and the conditions mentioned in the message are all processed and stored on US servers.

US-resident SaaS is subject to the US CLOUD Act (2018), which allows US authorities to compel disclosure of stored data even where that data physically sits in the EU. The US Department of Justice has exercised this power against Microsoft, Google, and Amazon since 2019. A patient writing to a clinic about a sensitive condition does not expect that letter to be subject to a US request. Neither does the ICO.

The standard: an enquiry form that posts to an inbox on EU-sovereign infrastructure — Cloudflare Email Routing on UK and EU edges for inbound, an EU-resident relay for outbound. The same experience for the patient; a very different posture for the controller.

2. Analytics and tracking pixels that are not lawful-basis-anchored

Google Analytics, Facebook Pixel, and the LinkedIn Insight Tag are all US-resident, and all process IP addresses and behaviour data that qualify as personal data under UK GDPR. The CJEU’s Schrems II ruling (2020) made bulk transfer of EU personal data to US infrastructure legally precarious. Several EU data protection authorities — Austria, France, Italy — have since ruled that Google Analytics is incompatible with GDPR without significant additional measures.

The standard: a cookieless, EU-resident analytics platform. Plausible (Germany) or Umami self-hosted are the obvious candidates: no cookies, no IP storage, no US-resident pipeline. This is configured as standard across the estate, with white-label reporting for the practice.

3. A CRM that exports patient identifiers to US tooling

Where a clinic uses HubSpot Free, Salesforce, or Pipedrive Lite to track enquiries, the practice is maintaining a US-resident database of patient names, contact details, and — often — clinical context in the notes field. The DPA in place (if any) was probably auto-signed during signup; the Transfer Risk Assessment almost certainly is not on file.

The standard: Capsule CRM (Manchester-based, EU-hosted) or Pipedrive on its EU plan — the same workflow, with the data-residency story intact and documented. The enquiry form is wired to the CRM contact record within the sovereign envelope.

4. Email marketing that mails patients from US infrastructure

Mailchimp, ConvertKit, and ActiveCampaign are all US-resident. Where a clinic sends a newsletter — “our new podiatrist starts next month” — to patients who opted in, that mail goes via US servers. The contents carry identifying information (name and clinic relationship) at minimum, and often health-adjacent context.

The standard: an EU-resident relay for transactional and small-list marketing, with a self-hosted sender on a London-region container for larger broadcasts. The same workflow, with UK and EU residency end to end.

How a regulated-grade estate handles this

Custodiance runs this as a managed estate, in-jurisdiction, to your regulator’s standard. The work that puts a clinic’s site right is the work the estate carries continuously, not a one-off remediation:

  • Audit. The current site and every third-party service it uses — forms, analytics, CRM, email, booking widget. Each sub-processor and its residency, set against the practice’s current Article 30 records, or built from scratch where none exist.
  • Hosting. The site pinned to a London region (lhr1), content and structure carried over, with no change to the patient-facing experience.
  • Intake. The enquiry form migrated to a Cloudflare-routed, EU-relay-backed endpoint, with lawful-basis and retention copy added, and the practice’s privacy notice linked on every form.
  • Analytics. Google Analytics replaced with Plausible (EU-resident, cookieless). Tracking pixels stripped.
  • CRM. Migrated to Capsule or an EU-plan equivalent, with the enquiry data exported, transformed, and imported — no manual re-entry — and the form wired to the contact record.
  • Email. Patient broadcasts moved to an EU-resident sender, with the relay and list both in UK and EU jurisdiction.
  • Documentation. Article 30 records of processing and an Article 28 DPA pack ready for the practice’s DPO or counsel to review, mapped to the sub-processor list.

This is the floor of a Growth engagement (£1,495/mo). Where the practice runs online booking with deposits across multiple sites, or wants a fractional CTO owning the roadmap and the compliance posture, that is an Embedded engagement (from £6,000/mo, bespoke).

What the clinic keeps

Patient relationships. Clinical reputation. The domain. The content. All of it. The practice is not migrating away from anything — it is moving the website the practice runs on to infrastructure that holds up when an enquiry lands from someone who is, quietly, testing the data-handling posture.

The patient who asks “where does the form land?” is increasingly common, particularly among the data-aware professionals who fill private-clinic books. Having the answer is increasingly the price of keeping them.

Where this fits

The equivalent regulatory failures for solicitors, accountancy practices, schools, and estate agencies follow the same residency-gap pattern. The practical NHS-adjacent checklist sits in the DSPT compliance checklist for clinics. The published posture behind all of this is the Custodiance framework. When a clinic is ready, the next step is to request a scoping call.

Sources & methodology

The Four Clinic Failure Modes framework is built from clinic-site audits and the primary regulatory text. Source attribution is given where rules are quoted.

Sources

  1. Information Commissioner's Office, "Special category data" (UK GDPR Article 9(1))
  2. The Caldicott Principles (2020 update) — National Data Guardian for Health and Social Care
  3. CJEU Schrems II ruling — Case C-311/18, Data Protection Commissioner v Facebook Ireland and Maximillian Schrems, 16 July 2020
  4. US CLOUD Act (2018) — Clarifying Lawful Overseas Use of Data Act, Pub. L. 115-141
  5. Data Security & Protection Toolkit (DSPT) baseline — NHS England

Custody, not marketing.

Have a senior partner read your estate against this.

A scoping call is a measured conversation about your obligations, your current setup, and what it would take to run it to your regulator's standard. No obligation, and no pressure.

Request a scoping call More briefings