CQC fundamentals of care
Display your current CQC rating on the website (a legal requirement for rated providers) and link to your CQC profile.
Source: Care Quality Commission
What your website and marketing must show to stay compliant in healthcare
The rules that apply to a UK healthcare business, turned into what your site, ads and social posts must show, or must not say. Each point links to the regulator or the legislation it comes from.
General guidance, not legal advice. Rules change and depend on your circumstances; check the linked source or take advice from a qualified adviser before relying on any point.
Healthcare rules
GMC Good Medical Practice
Name the clinicians you advertise and show registration so patients can check it.
Source: General Medical Council
NMC Code
Show nurse registration where you advertise nursing services.
Source: Nursing and Midwifery Council
HCPC Standards of Conduct
Use protected titles only for registered professionals, and show the registration.
GPhC Standards for Pharmacy Professionals
Registered pharmacies selling online should show their registration details; online medicine sales may need the distance-selling logo.
Source: General Pharmaceutical Council
GDC Standards for Dental Team
Show each dentist's GDC number and follow GDC guidance on advertising.
Source: General Dental Council
Safeguarding Vulnerable Groups Act 2006
Also covers: Enhanced DBS checks.
Say "DBS checked" only for the level of check actually held and kept current.
Source: Disclosure and Barring Service
GDPR Article 9 special category health data
Do not collect health details through a general enquiry form unless you have a stated lawful basis and condition; explain both in the privacy notice.
Caldicott Principles
Keep patient-identifiable information out of marketing, testimonials and case studies unless the person has explicitly agreed.
Source: Caldicott Principles
ICO data protection
Publish a privacy notice that names who you are, what you collect on every form, why, how long you keep it and how people use their rights; link it from every form.
NHS Data Security Toolkit DSPT
Only claim DSPT compliance on the site if your current submission meets the standard; the claim is checkable.
Every UK business site
Whatever the sector, these apply to almost every business website.
Company and trading details
A limited company's site must show its registered name, company number, place of registration and registered office address.
Source: Company and trading details
Privacy notice
Say who you are, what each form collects, why, how long you keep it and how people use their rights.
Source: Privacy notice
Cookie consent
Non-essential cookies and analytics wait for consent, and refusing is as easy as accepting.
Source: Cookie consent
Honest claims
Every claim, review and comparison is true, evidenced and not misleading (CAP Code).
Source: Honest claims
Genuine reviews
No fake, bought or selectively hidden reviews (DMCC Act 2024).
Source: Genuine reviews
See how your site measures up
The free grader checks your site against the visible signals buyers, search engines and AI assistants look for, including several of the points above.
Grade my website Healthcare websites