Every enquiry form on a clinic website collects personal data, so Singapore's Personal Data Protection Act 2012 (PDPA) applies. Clinics also hold health information, which patients reasonably expect to be handled with extra care.
Collect only what you need
To reply to an enquiry you need a name, a way to contact the person and roughly what they're asking about. You rarely need a date of birth, NRIC number or medical history on a website form. Leave those for the clinic visit.
Explain the purpose next to the form
A short line under the submit button works: “By sending, you agree we may use your details to reply to your enquiry, as set out in our privacy policy.” Link to the policy.
We build clinic websites that follow every point in this guide. Book a free 30-minute consult or see our packages.
Keep medical details off public forms
Ask patients what treatment they're interested in, not what conditions they have. A free-text box invites detail, so add a note asking them not to share medical information there.
WhatsApp buttons are convenient, but messages then sit on staff phones. Agree who answers, use a clinic business account rather than personal numbers, and set retention rules.
Analytics and cookies
Choose analytics that don't need tracking cookies where possible. Every site we build uses Ahrefs Web Analytics, which is cookieless and collects no personal data.
Checklist
- Privacy policy page linked from every form
- Consent line beside the submit button
- Minimal required fields
- HTTPS on every page
- Spam protection that doesn't track visitors
- Enquiries delivered to a clinic email, not a personal one
- Retention period for enquiry emails
This is general guidance, not legal advice. See the PDPC's guidelines for healthcare.