Clinic Website Compliance: A UK Checklist

On 5 August 2026, a new statutory code on the Equality Act 2010 came into force in Great Britain. It says the Act's obligations on service providers also apply "to the provision of services on a website". Six months before, the UK's cookie rules gained a narrow exception for some website analytics.

This clinic website compliance checklist sets out UK rules for aesthetic, dental and beauty and wellness clinics, page by page. Each check has a source and a date.

Checked against the regulators' published guidance on 1 October 2026. WebAsk is a web agency, not a law firm. This summarises published guidance; it is not legal advice.

So, is my clinic website compliant? No checklist can tell you that. This one shows what to check, and whose rule each check is.

The checklist, and how to read it

Find your type of clinic in the columns. "Yes" means the check applies to that type. "If offered" means it applies if you offer what the check names. A dash means none of the sources we read applies it to that type. "Watch" means nothing is decided yet.

Many rules follow the treatment, not the type of clinic. Others follow the profession, like the GDC's. Where a rule covers only part of the UK, the row says so. Dates are the source's own, or the date we read an undated page. In this post, "the medicine" means the prescription-only medicine that CAP's FAQ (CAP News, 23 January 2020) is about. We leave its name out.

Homepage and navigation

Rule 12.12 of the CAP Code, which the ASA enforces, reads:

"Prescription-only medicines or prescription-only medical treatments may not be advertised to the public."

Our post on the advertising rule covers where the medicine's name should not appear, and what to promote instead.

The FAQ says a "direct link to 'Prices'" that names the medicine "is unlikely to be acceptable". CAP's pages we read do not mention menus or footers. Treating their links the same way is our reading.

Treatment pages and health claims

Rule 3.7 of the CAP Code says marketers "must hold documentary evidence" for objective claims before an ad goes out.

IV drips, vitamin injections and supplements

CAP's advice on IV drips (6 February 2024) calls them IVNTs. It says "The ASA has yet to see convincing evidence" for the benefits claimed for specific drips. A claim of a specific benefit "is likely to be problematic unless the supporting evidence is robust". That "may include" words like "mood", "energy" and "immunity".

CAP News of 22 February 2024 is firmer:

"Medicinal claims are not permitted for IVNTs unless that specific product has been licensed as a medicine for that purpose."

"In the same vein, marketers are reminded that prescription-only IV's or vitamin injections cannot be advertised to the public."

So rule 12.12 can reach a beauty or wellness clinic too.

Section 15 of the CAP Code covers food and food supplements. Its rule 15.1.1 allows only health claims "listed as authorised in the applicable register", or claims with the same meaning to the consumer. In Great Britain that is the GB Register. In Northern Ireland, "the EU Register continues to apply".

Prices

CAP's FAQ says a price list that names the medicine "might be acceptable". The condition is that clients "can only get to the price list after going through a page promoting a consultation". On a price promotion for the medicine, the FAQ's answer is: "No, this is likely to breach the Code." Our post on price lists sets out the route and what the list may say.

For dentists, paragraph 2.4.2 of the GDC's Standards for the Dental Team reads, as at 29 September 2026:

"You must give clear information on prices in your practice literature and on your websites - patients should not have to ask for this information."

Photos, reviews and testimonials

CAP's advice on before-and-after photos (5 June 2025) says marketers "should hold signed and dated proof that the photos are genuine and have not been manipulated". For a prescription-only product, such images are "very likely to be seen as an implied ad". That holds "even in isolation without any accompanying claims".

CAP and the ASA treat these photos "in the same way as testimonials". Rule 3.50 bars a testimonial "without permission". Dentists must also "obtain and record the patients' consent" to use them (GDC Standards, 4.2.7).

For testimonials, rule 3.47 says marketers "must hold documentary evidence" that each one is genuine. Rule 12.18 bars using "health professionals or celebrities to endorse medicines".

Reviews and the DMCC Act

Since 6 April 2025, the DMCC Act 2024 has prohibited submitting or commissioning fake reviews, or reviews that hide an incentive. It also covers publishing reviews "in a misleading way", such as removing negative ones while publishing positive ones. The CMA can impose a penalty of up to GBP £300,000 or 10% of turnover, including turnover outside the UK, whichever is higher (section 182).

The CMA's guidance (CMA208, 4 April 2025) says asking "without predetermining the contents or sentiment" of a review "is not prohibited under the banned practice". But a trader "may infringe the law" if they "selectively promote positive or negative reviews". Cherry picking, it adds, "might be done … by encouraging just those who are satisfied to leave reviews".

Google's Maps policy, read on 29 September 2026, goes further. It says "We do not allow merchants to" offer incentives for reviews, or to "selectively solicit positive reviews from customers". That is Google's rule for its platform, not UK law.

For aesthetic sites, our interim standard keeps reviews on Google, not embedded on the site, since a review can name the medicine. That is our rule, not the law.

Practitioner and practice details

For dental practices, the GDC's guidance on advertising (effective from 30 September 2013) says what a practice website must display. That covers the practice and each dental professional it names. Practice publicity must also make clear "whether the practice is NHS (or equivalent health service), mixed or wholly private". Our reading is that the website is practice publicity.

The CQC, in England only

In England, carrying on a regulated activity without being registered is an offence (Health and Social Care Act 2008, section 10). The rule on showing a CQC rating online applies only "where, and to the extent that, a service provider has received a rating" (Regulation 20A). And the CQC says "we don't give ratings to primary dental providers" (updated 22 December 2025).

For aesthetic and beauty clinics, whether you must register depends on what you do. The CQC's page on surgical procedures (last updated 29 January 2025) says that activity "does not include" "subcutaneous injections to enhance appearance". We read only that page, so we do not say whether another activity applies to you. The page includes the CQC's own check for that activity.

Age rules and the proposed licensing scheme

For ads, rule 12.25 bars aiming ads for cosmetic interventions at under-18s through the choice of media or context. The rule for treatment is criminal law. The 2021 Act (2021 c. 19) covers filler injections for a cosmetic purpose and one named prescription-only medicine. Since 1 October 2021 it has been an offence to administer either, in England, to anyone under 18. Defences in the Act apply to both, and the penalty is a fine.

As at 1 October 2026, the proposed licensing scheme for non-surgical cosmetic procedures in England is not in force. We found no regulations made under the power in section 180 of the Health and Care Act 2022. On 23 June 2026 the Government said it was "preparing a consultation on the draft legislation" for limits on the highest-risk procedures. We found none on GOV.UK by 29 September 2026.

Cookies, forms and accessibility

Cookie banners

The ICO finalised its guidance on cookies and similar "storage and access technologies" on 29 April 2026. Its page What are the PECR rules? says you must, among other things:

"ensure consent involves a clear and positive action from a subscriber or user. For example, continuing to use your website does not constitute valid consent, nor does the use of a pre-ticked box or equivalent;"

"not use any storage or access technologies for non-exempt purposes before the subscriber or user has given consent;"

"enable subscribers or users to refuse the use of storage and access technologies for non-exempt purposes as easily as they can accept"

The test is "as easily". The ICO's own example shows "equally prominent options" to accept or reject.

For embedded content, such as a treatment video, the ICO says you "should" set it up "not to set storage and access technologies the instant someone visits the page".

The statistical-purposes exception

Since 5 February 2026, PECR has had five exceptions to the need for consent. One, in Schedule A1, paragraph 5, covers some analytics. The ICO's page What are the exceptions? calls it "not a broad exception" and sets out its conditions, including:

"the sole purpose of the storage and access technology is collecting information for statistical purposes about the use of your service."

"You can share this information with a third party, provided they are only using it to improve your website or service."

"you must provide the user or subscriber with clear and comprehensive information about the purpose, and a 'simple and free' means to object."

It adds:

"The statistical purposes exception does not allow you to monitor or track individual visitors to your service."

"The statistical purposes exception does not apply to purposes related to online advertising."

"To rely on the exception, your third party provider must be a processor, not a joint controller"

"This means that if someone does object, you must stop storing or accessing information on their device."

We do not say whether any analytics product meets these conditions.

Fines under the cookie rules

Fines changed on 5 February 2026 too. Section 157 of the Data Protection Act 2018, as PECR now applies it, sets the higher maximum for breaking the cookie rule:

"in the case of an undertaking, £17,500,000 or 4% of the undertaking's total annual worldwide turnover in the preceding financial year, whichever is higher"

The ICO says the change brought PECR's enforcement "into line with UK GDPR", so that penalties "are the same in most cases" (summary of the changes). On 23 June 2026 it said it was "currently developing separate guidance to cover these higher fines".

Booking and enquiry forms

A booking form can collect health details. The ICO lists "data concerning health" as special category data. For such data, the ICO says:

"you must identify both a lawful basis under Article 6 and a condition for processing special category data under Article 9."

The ICO also says: "You must provide privacy information to individuals at the time you collect their personal data from them" (right to be informed). Marketing emails and texts to individuals need "specific consent", with "a limited exception for your own previous customers" (email marketing). The ICO says these pages are "under review" after the Data (Use and Access) Act. Whether the clinic must also pay the data protection fee is in our ICO fee guide.

Accessibility and the Equality Act

The Equality Act 2010 puts a duty to make reasonable adjustments on service providers (section 29(7)). Where the duty concerns information, the reasonable steps include steps for ensuring that "in the circumstances concerned the information is provided in an accessible format" (section 20(6)). The EHRC's statutory code, in force since 5 August 2026, explains the Act's duties on services. It says:

"The obligation also applies to the provision of services on a website (section 29)."

The code says "the duty is anticipatory": service providers "must proactively consider the barriers that disabled people could face and take action to address those barriers". The code itself "does not impose legal obligations", but courts and tribunals "must consider any part of the Code that appears relevant". The Act's service duties and the code cover England, Wales and Scotland, not Northern Ireland.

WCAG 2.2 AA is our build standard, a technical one. Neither the code nor the sections of the Act we read mention it, so we do not call it the legal test.

Why this checklist gives no failure rate

This post does not say how many clinic websites fail these checks. We have no audit data and no client sites to count. None of the pages we read measures clinic, dental or beauty websites.

The nearest figure is about other sites. In April 2026 the ICO said:

"992 (99%) of the top 1,000 websites met our compliance checks at the time of their most recent test."

It is about cookie banners on the UK's top 1,000 websites, not clinic sites.

Nor can a checklist call a site compliant. Some sources hedge. CAP's FAQ says "might be acceptable". CAP's advice pages say they do not bind the ASA. Four ICO pages above are under review. A list of checks cannot turn those words into a verdict.

Where to start

1. Start with the rows all three types share. Try refusing cookies on your own site. Then read each form as a patient would.
2. Work down your own column. These posts go deeper:
   • What aesthetic clinics can say about fillers and photos.
   • The GDC's list for dental websites, in full.
3. Get a second look. CAP's Copy Advice team advises on an ad before it runs. Its "standard response time is 3–5 working days", and the standard service is free. It covers the CAP Code only: "We do not provide legal advice." Our pages for aesthetic clinics, dental practices and beauty and wellness clinics have more on each. The free audit includes a rules check that gives no legal verdict. Or get in touch.