In short and in plain language
A practice may advertise online. But there are special ad rules for health care.
Plain facts are usually fine. Ads that boast or mislead are not.
Before and after photos, patient quotes and promises of success are often a problem.
If a patient names their concern in a booking form, that is health data. Strict rules apply to it.
We read your site and suggest new wording where needed.
Anyone planning a website for a medical or dental practice hears two sentences that seem to contradict each other. The first: a practice may appear online like any other business. The second: the health professions are subject to their own advertising law, which rules out a good deal of what is taken for granted elsewhere. Both sentences are correct, and the work sits between them. This article sorts the content of a practice website into three groups: uncontested, tied to conditions, and regularly challenged. After that it turns to the appointment form, because health data arises there and health data follows its own rules.
Key takeaways
- German advertising law for healthcare (HWG) attaches to the statement, not to the profession: it applies as soon as an advertising statement relates to detecting, removing or alleviating illnesses, ailments or bodily injuries in humans (section 1(1) number 2 HWG).
- The model professional code explicitly permits factual information relating to the profession (section 27(2) MBO-Ä) and prohibits advertising contrary to professional standards, in particular praising, misleading or comparative advertising (subsection 3).
- Four groups of details may be announced: qualifications from specialist training, qualifications acquired under other public-law provisions, areas of focus marked as such, and organisational notes (section 27(4) MBO-Ä).
- Three presentations are regularly contentious: before-and-after images, statements by third parties and promises of success (section 11(1) and section 3 HWG).
- Details about the reason for the visit in an appointment form are health data (Article 4 number 15 GDPR). Processing them is prohibited in principle under Article 9(1) GDPR and becomes lawful only through an exception.
- 59.5 percent of people aged 16 to 74 in Germany obtained health-related information online in the 2025 survey, and 34.7 percent had made an appointment with a doctor via a website in the 2024 survey (Eurostat).
Which rules come together on a practice website
A practice website carries the same duties as any other company site to begin with. That includes the mandatory legal notice under the German Digital Services Act, a privacy policy, the requirements around image rights for your own and third-party photos and the specifications from the German Accessibility Strengthening Act (BFSG). This layer does not differ between a dental practice and a painting business.
Two further layers sit on top of it. The first is the German advertising law for healthcare. It does not apply to an occupational group but to a statement: as soon as an advertising statement relates to detecting, removing or alleviating illnesses, ailments, bodily injuries or pathological complaints in humans, the act applies (section 1(1) number 2 HWG). The sentence about opening hours is outside its scope, the sentence about the effect of a treatment is squarely inside it. That is why a practice website cannot be signed off in one go; it is read section by section.
The second layer is professional law. For doctors, the model professional code of the German Medical Association sets the frame in section 27. That frame only becomes binding once the assembly of the respective state medical association adopts it as a statute, so it is worth looking at the professional code of your own federal state before writing. Dentists, psychotherapists, alternative practitioners and pharmacies each have their own sets of rules with a comparable thrust. For the website this means the text has to hold up not only against competition law but also against how the profession sees itself, as the chamber has written it down.
Who signs off a practice website
The uncontested part: orientation instead of promotion
The professional code does not prohibit information, it prohibits promotion. Section 27(2) MBO-Ä explicitly permits factual information relating to the profession. That is the core a good practice website is built from anyway, because the questions people arrive with are organisational: does this practice treat my concern? When is it open? How do I get there? Can I get in with a walker? Who do I call at the weekend?
Those questions are also the opportunity. 59.5 percent of people aged 16 to 74 in Germany obtained health-related information online in the 2025 survey (Eurostat). Someone looking for a practice reads the site first and calls afterwards — or does not call, because the site left the question open. A complete table of consultation hours is therefore not decoration but, in our experience, one of the most frequent reasons why someone picks up the phone.
- Range of services in the language of patients, without promises of effect: what is treated, not how well.
- Consultation hours, holiday cover and emergency service, plus the date of the last change so that an outdated state stands out.
- Directions, parking, the nearest stop, the floor, the lift: details that actually help on the day.
- Accessibility of the rooms: steps, door widths, a washroom for wheelchair users, an induction loop where one exists.
- Team with role and responsibility; photos only with written consent from the people shown.
- Contact routes with a note on how quickly a reply typically arrives, and a clear pointer to the emergency number 112.
Auf dieser Grundlage sind Ärztinnen und Ärzten sachliche berufsbezogene Informationen gestattet.
The sentence is shorter than it looks and it carries a long way. Factual means verifiable and without a superlative. Relating to the profession means about the work, not about the surroundings. Information means the benefit sits with the reader, not with the sender. A sentence such as “we treat children from the age of four, appointments for this are in the morning” is factual, professional and informative. A sentence such as “your feel-good practice with the all-round carefree feeling” is none of those.
One simple test works well in practice: delete every adjective that carries a judgement and read the sentence again. If a verifiable statement remains, the sentence is as a rule unproblematic. If nothing remains, the sentence was advertising without content — and sentences like that move a practice website towards the praising advertising that section 27(3) MBO-Ä prohibits. The same test helps with reviews that arrive on the site from outside.
Titles and areas of focus: what may be announced
The second block raises the most questions in practice: what may stand next to the name? The model professional code lists four groups that may be announced: qualifications acquired under the specialist training regulations, qualifications acquired under other public-law provisions, areas of focus marked as such, and organisational notes (section 27(4) MBO-Ä). Titles from specialist training may only be used in the form permitted by those training regulations.
Two restrictions come with this. First, other qualifications and areas of focus may only be announced if they cannot be confused with qualifications acquired under regulated specialist training law — a course certificate must not look like a specialist title. Second, the details under numbers 1 to 3 are only permitted if the activities covered are carried out more than occasionally (section 27(5) MBO-Ä). An area of focus that comes up twice a year does not belong in the navigation.
| Detail on the page | Permitted if | Basis |
|---|---|---|
| Specialist training title | acquired under the training regulations and used in the form permitted there | Section 27(4) number 1 MBO-Ä |
| Qualification from a public-law provision | actually acquired and not confusable with a specialist training title | Section 27(4) number 2 MBO-Ä |
| Area of focus | marked as such and carried out more than occasionally | Section 27(4) number 3 and (5) MBO-Ä |
| Organisational note, for instance on appointments | accurate and kept up to date | Section 27(4) number 4 MBO-Ä |
| Statement about the effect of a treatment | the procedure is not credited with a therapeutic efficacy it does not have | Section 3 sentence 2 number 1 HWG |
| Comparison with other practices | not provided for; comparative advertising counts as contrary to professional standards | Section 27(3) sentence 2 MBO-Ä |
On the website this means one line per person, in the order name, title, area of focus, with the organisational notes underneath. Whatever stands in that line has to be evidenced to the chamber on request; section 27(6) MBO-Ä explicitly provides for the submission of the necessary documents and allows supplementary enquiries. Collecting the evidence while the site is being set up means having it to hand later.
One source for every detail
Three presentations that are regularly challenged
When a practice website receives a letter from a competition association or from the chamber, in our experience it concerns one of three presentations. All three are common on commercial websites, and all three are tied to narrow conditions in healthcare.
Before-and-after images
For surgical plastic procedures without medical necessity, advertising the effect through a comparative depiction of the state of the body or the appearance before and after the procedure is prohibited (section 11(1) sentence 3 number 1 HWG). Alongside that, there is the ban on pictorial depictions that use changes to the human body caused by illness or injury in an abusive, repulsive or misleading way (section 11(1) number 5 HWG).
Statements by third parties
Outside professional circles, advertising with statements by third parties is prohibited, in particular with letters of thanks, appreciation or recommendation, where these are used in an abusive, repulsive or misleading way (section 11(1) number 11 HWG). For the website this means a quote block with hand-picked praise is delicate; a neutral pointer to a public review profile that shows all voices unfiltered is the calmer route.
Promises of success
Advertising is misleading in particular where the false impression is created that a success can be expected with certainty (section 3 sentence 2 number 2 letter a HWG). Wording such as “pain-free in one session” or “permanently free of complaints” falls under this, even when it is well meant. The factual version names the procedure, the usual course and the duration — and leaves out the promise.
A fourth point is easily overlooked: publications whose advertising purpose is ambiguous or not clearly recognisable are prohibited outside professional circles (section 11(1) number 9 HWG). What is meant is the guide article that looks like neutral education and ends up leading to your own service without making that visible. Anyone putting specialist articles on a practice website separates education and offer visibly. The same principle applies to imagery as elsewhere: your own photographs of the rooms and the team carry further than bought motifs.
The test for every section
Appointment form and contact: handling health data properly
The second large block has nothing to do with advertising law. As soon as a form asks about the reason for the visit, health data arises. The General Data Protection Regulation defines it as personal data related to the physical or mental health of a natural person from which information about that person's health status can be derived (Article 4 number 15 GDPR). A free-text field saying “toothache since Friday” is health data, and so is a ticked box saying “orthodontics”. Processing such data is prohibited in principle under Article 9(1) GDPR and becomes lawful only through one of the exceptions in paragraph 2.
- Ask only for what the appointment actually requires. A mandatory field labelled „symptoms" creates special category data that you then have to protect; a field labelled „reason: check-up, pain, consultation" is enough in many practices.
- Obtain explicit consent if you rely on Article 9(2) letter a GDPR. Explicit means a separate, unticked box with a clearly named purpose, not coupled to sending the form.
- Alternatively, examine Article 9(2) letter h GDPR. It carries processing for medical diagnosis, care or treatment — but only under the conditions of paragraph 3, that is by professionals subject to the obligation of professional secrecy.
- Transmit the form encrypted and do not leave the entries sitting permanently in the content management system. A mailbox with restricted access is the calmer solution compared with a database table that every editorial login opens.
- Sign a data processing agreement with every service provider that sees the data — this covers hosting, maintenance and the operation of a booking system.
- Set a deletion period and keep to it. Appointment requests from last year have no business sitting in a mailbox.
<form action="/api/appointment/" method="post">
<label for="reason">Reason</label>
<select id="reason" name="reason" required>
<option value="checkup">Check-up</option>
<option value="acute">Acute complaints</option>
<option value="advice">Consultation</option>
</select>
<label for="window">Preferred period</label>
<input id="window" name="window" type="text">
<input id="consent" name="consent" type="checkbox" required>
<label for="consent">
I consent to the practice processing these details in order
to arrange an appointment (Article 9(2) letter a GDPR).
</label>
</form>The example shows the underlying attitude: a selection instead of a free-text field, a preferred period instead of a description, a dedicated consent instead of a collective tick below the send button. Anyone who needs the description collects it during the call back — where it is better placed anyway than in a form entry that travels through three systems.
A booking system moves the question rather than solving it: it processes the same data, only somewhere else. How such a system is sensibly integrated is set out in detail under online appointment booking for local businesses. 34.7 percent of people aged 16 to 74 in Germany had made an appointment with a doctor via a website in the 2024 survey; in the 2022 survey the figure stood at 18.6 percent (Eurostat). The expectation is growing, so the care taken with the data has to grow with it. Anyone also collecting consent for audience measurement should review the implementation of the cookie banner in the same pass.
Misleading claims: the standard is tighter than elsewhere
General competition law already knows the prohibition of misleading statements. The advertising law for healthcare sharpens it for the health sector and names the cases individually. The most important one comes right in sentence 1 and is short enough to be copied into any editorial guideline.
Unzulässig ist eine irreführende Werbung.
The act then lists when a misleading claim exists in particular: where procedures, treatments or other means are credited with a therapeutic efficacy they do not have (section 3 sentence 2 number 1 HWG); where the false impression is created that a success can be expected with certainty, or that no harmful effects occur with prolonged use (number 2); or where untrue statements are made about the person, education, competence or successes (number 3). The third item hits the website in an unexpected place: the biographies on the team page.
A second point concerns recommendations. Statements or depictions referring to a recommendation by scientists or by people working in healthcare are prohibited outside professional circles (section 11(1) number 2 HWG). A quote along the lines of “recommended by Professor Muster” therefore does not belong on the home page. The reproduction of case histories is restricted as well where it is done in an abusive, repulsive or misleading way, or where a detailed description can lead to a false self-diagnosis (section 11(1) number 3 HWG) — the popular “case from our practice” therefore needs a careful version, or it is dropped.
The checks before going live
Before switching over, it pays to make a pass that follows a list rather than a feeling. Most findings do not sit in a single crude sentence but in leftovers: an old consultation hour, an image from the previous site, a form field that has been running unchecked since the relaunch.
Much of that pass can be prepared mechanically. A handful of searches across the text sources will find the wording that typically causes trouble, and the places where a year appears. What the search finds gets read; what it does not find is no substitute for a look at the finished page.
Finally, two looks that no machine takes over: the home page on a phone, with a thumb instead of a mouse, and the appointment page read by someone who does not know the practice. Together they take twenty minutes and, in our experience, find more than any checklist.
What has to stay current after going live
A practice website goes out of date in different places than a company site. Prices change rarely, opening hours several times a year, and the wrong detail does not cost revenue, it sends people to a locked door. That is why maintenance belongs in a fixed rhythm rather than being shouted across the room. Anyone who also looks after a voluntary post knows the problem from another context: a club website with events and member data lives on being current, too.
- Compare consultation hours, holiday cover and emergency service against the duty roster monthly and show the date of the last change on the page.
- Team: after every course of further training, check the announced title and file the evidence (section 27(6) MBO-Ä).
- Forms: send a test enquiry once a quarter and see where it lands and how long it sits there.
- Images: keep consents from the people shown with a date, and remove former staff from the gallery as well.
- Legal texts: read the legal notice and the privacy policy against the services actually in use at least once a year.
- Technology: commission updates, backups and restore tests as ongoing maintenance rather than treating them as one-off cases.
If the site is older than the last fundamental rebuild of the practice, maintenance only helps so far. Then it is about structure, readability on the phone and the path to making an appointment; the criteria for that are set out under website relaunch. And if the site has been compromised, a separate sequence applies — immediate measures, reporting duties, rebuilding — which we described in hacked website. For a practice one point is added there: if form entries were affected, health data was affected.
The silent fault
How a practice website comes about
The process differs from an ordinary website project in three places: the texts are written along the sets of rules rather than along an advertising concept, the forms are settled before the design, and sign-off runs through the practice. Anyone who would like to talk the process through for their own practice can take the route via a conversation about the project.
Taking stock
We read the existing site section by section and mark three categories: uncontested, conditional, to be clarified. The points to be clarified become a list of questions for the practice — most of them are settled with a piece of evidence from your own folder.
Content before design
Range of services, consultation hours, directions, accessibility and emergency service are written and agreed first. Only then does the layout follow. That spares everyone the exercise of relieving a finished design of sentences that cannot stay.
The form as its own step
Which fields exist, where the entries land, who sees them and when they are deleted is settled and documented separately. After that it is clear whether a booking system is needed or a lean form is enough.
For practices already thinking about a new site, we have gathered the requirements on a page of their own: web design for health professions. It also sets out which documents we need for the start and in which order we ask for them.
Berufswidrige Werbung ist Ärztinnen und Ärzten untersagt.
The sentence sounds strict and is predictable in application: it prohibits promotion, not visibility. A practice website may look appealing, load quickly, work on a phone and describe its services in understandable terms. It only must not assert what it cannot evidence. Anyone who keeps that difference in mind will as a rule get along well with the sets of rules — and gets a site along the way that people without specialist knowledge understand on their first visit.
Related Articles
Receive documents securely: upload instead of attachment
Medical reports, ID copies and payslips sent as attachments are a risk. How to build an upload form: fields, storage, notification and a deletion period.
Club websites: events, members and donations done right
Events calendar, member photos, joining form and donation page: what belongs on a club website, which German rules apply and how to hand it over cleanly.
Online Booking: More Bookings
Around 78 percent want to book appointments online (forsa). How local businesses win appointments with a booking system on their own site and relieve the phone.