For care services, a website has long been the first point of contact: relatives ask about an available place via the contact form, prospects describe their care situation, and professionals apply through the careers form. As soon as someone enters their name, a phone number or even hints about an illness there, you are processing personal and often sensitive data. Health data is among the specially protected categories under Art. 9 (GDPR), and this is exactly where supervisory authorities focus during audits. In the health sector, a considerable share of all reported data protection incidents in Europe relates to inadequately secured processing (ENISA Threat Landscape). This article shows how to design contact and application forms on a care website in a legally sound and economical way – without promises of perfection, but with a solid technical and organizational foundation.
Key takeaways
- Inquiries via care forms often contain health data under Art. 9 GDPR and therefore require explicit, freely given consent.
- Data minimization is the most effective lever: only ask for what is needed for initial contact and leave the details to the personal conversation.
- Secure transmission over HTTPS and hosting in a data center in Germany or the EU keep sensitive data consistently within the European legal area.
- Application and contact data should be managed separately, with their own recipients, storage locations and clearly defined retention periods.
- Data protection does not begin in the policy but in the very design of the forms and in documented, traceable processes.
Why Care Websites Are Particularly Sensitive
Care is an area where data protection is not just a formal duty but part of the relationship of trust. People who visit a care website are often in a stressful situation: a relative suddenly needs support, an illness changes everyday life, a decision has to be made quickly. In that moment, people share information that goes far beyond an ordinary inquiry. Even the note "My father has dementia and needs care at night" is health data within the meaning of the GDPR – with all the obligations that come with it.
Unlike a simple marketing form, a care contact form therefore regularly touches the special category of personal data. Stricter requirements apply to its processing: a sound legal basis, clear purpose limitation and particularly careful protective measures. A well-thought-out care website takes this into account not only in the fine print but in the very design of the forms. Data protection does not begin in the privacy policy, but at the point where the data is created.
There is also the matter of expectation. Trust is a central selection criterion in the care market, and a visibly careless handling of data can quickly damage that trust. Studies on online communication show that a large share of users avoid a company when they have concerns about data protection (Cisco Consumer Privacy Survey). For a care service that wants to win both patients and staff through its website, clean data protection is therefore not only a duty but also a competitive argument.
Special data category
Details about illnesses, level of care or therapies fall under Art. 9 GDPR. They may only be processed with explicit consent or another clear legal basis.
Vulnerable people
People in need of care, the elderly and relatives in exceptional situations deserve special consideration. Forms should be clear, short and free of pressure.
Applicant data
Careers forms also process sensitive information such as CVs and references. Purpose limitation and deletion after the process is complete are mandatory here.
Confidentiality
Care depends on discretion. Signaling early that data is transmitted securely and processed sparingly strengthens trust even before the first conversation.
Place of processing
Where the data ends up is decisive. Hosting and mail delivery should demonstrably take place in the EU, ideally in a data center in Germany.
Accountability
The GDPR requires accountability. Anyone who documents which data is processed for which purpose and for how long can respond to requests and audits.
Health Data and the Legal Basis Under the GDPR
The core of any compliant processing is the legal basis. For ordinary contact data, legitimate interest or the initiation of a contractual relationship is often sufficient. As soon as health data comes into play, however, the special rule of Art. 9 GDPR applies: such data may generally not be processed unless one of the explicitly named exceptions applies. In practice, for a care website this is usually the explicit consent of the person concerned.
Explicit means: consent must be given freely, in an informed manner, unambiguously and for the specific purpose. A pre-ticked checkbox is not enough, nor is a hidden note buried in running text. The form should therefore contain a separate, not pre-selected consent statement that explains in plain language what the details will be used for. For example: "I agree that my details, including health information, may be stored and processed to handle my inquiry." Alongside this belongs a link to the privacy policy, which describes the procedure in detail.
Equally important is the principle of data minimization. A care service should not actively ask for diagnoses in the form if a rough description of the request is sufficient for initial contact. Detailed health information belongs in the personal conversation or a protected intake process, not in an open web form. Keeping the form deliberately lean reduces both the risk and the documentation effort. This logic should run consistently through the entire privacy concept of the website.
Common pitfall: forced health details
Designing the Contact Form in a Privacy-Friendly Way
A good contact form for care is economical, transparent and low-barrier at the same time. Economical means: it only asks for what is necessary to handle the specific request – usually a name, one way to make contact and a free-text field for the request. Every additional mandatory field must be justifiable. Transparent means: right at the form, it is clearly explained who receives the data, what it is used for and how long it is stored. Low-barrier means: clear labels, visible error messages and keyboard operability, so that older users and people with impairments can fill in the form easily.
Caution is advised with spam protection. Many standard solutions embed external services that transfer visitor data to third parties and sometimes to third countries. For a privacy-friendly care website, we instead rely on server-side methods without tracking: a hidden honeypot field, a time measurement against automated input and a check on our own server. This keeps the data flow in your own hands without the visitor unknowingly coming into contact with third-party providers. This separation also helps with clean accessibility of the care website, because no foreign scripts interfere with operation. How accessibility can be implemented in practice is described in our article on the accessible care website.
- Mark only necessary fields as mandatory, keep everything else optional
- Separate, not pre-selected consent with understandable wording
- A clearly recognizable link to the privacy policy right at the form
- No external captcha with third-party data transfer
- Transmission exclusively over HTTPS with a valid certificate
- Confirmation of receipt without repeating sensitive content in plain text
The response to an inquiry is also part of data protection. An automatic confirmation of receipt should not mirror the complete content of the request – possibly with health details – back in plain text via unencrypted email. A neutral confirmation that the message has been received and that the care service will be in touch is better. This avoids spreading sensitive content unnecessarily across multiple inboxes and devices. Anyone who plans forms this way from the ground up anchors data protection where the services of the website are created.
Application Forms: Sensitive Data from Professionals
Careers and application forms are enormously important for care services given the shortage of skilled workers, but they raise their own data protection questions. An application regularly contains a CV, qualifications, references and sometimes a photo – all personal data, some of it with special protection needs. The legal basis here is usually the initiation of an employment relationship. Even so, purpose limitation and data minimization apply: only what is actually relevant to the application should be requested.
A central point is the secure transfer of attachments. Application documents are ideally uploaded encrypted via the form and stored on a server in the EU, rather than circulating openly by email. File size and file types should be limited, and the upload should be checked on the server side. A well-designed careers page with a recruiting function combines this security with a low-threshold application process, so that professionals are not deterred by obstacles.
Especially relevant is the deletion of data after the process is complete. Applicant data may not be stored indefinitely. It is common to keep data for a limited period after a rejection to cover any follow-up questions or legal claims; after that, the data must be deleted. If a care service wants to keep suitable applicants in a talent pool, this requires separate consent. A clear deletion concept prevents both warnings and the accumulation of unnecessary data. Which mandatory information applies around this is set out in our article on the legally compliant care website.
Separating contact and application
Technical Foundations: SSL, Hosting in Germany and Security Measures
On the technical side, protection begins with transport encryption. Every form must be delivered over HTTPS with a valid TLS certificate so that the entries cannot be read in plain text on their way to the server. An unsecured form on a care website is no longer acceptable today – modern browsers visibly warn users about unencrypted input pages anyway. Setting up free certificates is standard and should run with automatic renewal.
The second building block is the place of processing. For sensitive care data, we recommend hosting and mail delivery in a data center in Germany or at least within the EU. This way, the data is consistently subject to European data protection law, and the question of third-country transfers does not even arise. With every service provider involved – such as the host or a mail provider – a data processing agreement (DPA) under Art. 28 GDPR must be concluded. Reliable operation with current security updates is ensured through ongoing website maintenance.
The framework is formed by the technical and organizational measures under Art. 32 GDPR. These include access restrictions to the mailbox, regular updates of the content management system, backups, a limit on the number of people with access and a documented handling of incoming inquiries. These measures must be appropriate to the risk – for health data, the bar is correspondingly higher. The honest classification is important: there is no absolute protection, but an appropriate, traceable level of protection that corresponds to the state of the art.
| Aspect | Risky practice | Privacy-friendly implementation |
|---|---|---|
| Transmission | Form without HTTPS, plain text | TLS encryption with a valid certificate |
| Hosting | Server in an unclear third country | Data center in Germany or the EU |
| Spam protection | External captcha with data transfer | Server-side protection without tracking |
| Consent | Pre-ticked checkbox | Separate, active consent |
| Data scope | Diagnoses as a mandatory field | Data minimization, optional free-text field |
| Retention | Unlimited storage | Defined retention periods, deletion concept |
Documentation, Data Subject Rights and Data Breaches
Data protection is not only technology but also organization and proof. The GDPR requires controllers to keep records of processing activities that document which data is processed for which purpose, on which legal basis and for how long. For the website, this means capturing every form processing operation – from the contact form to the application form to mail delivery and storage. This documentation is not an end in itself but makes the care service able to provide information when faced with requests and audits.
Then there are the data subject rights. Anyone who has filled in a form can request information about their stored data, demand its correction or deletion and withdraw consent at any time. A care service should be prepared to answer such requests within the legal deadline. This only works if it is clear where which data is located – another reason to manage contact and application data separately and clearly. Competent data protection advice for care helps to set up these processes in a practical way.
Finally, there is the emergency: the data breach. If a mailbox is compromised or a database accidentally becomes openly accessible, there may be an obligation to notify the supervisory authority within 72 hours (GDPR Art. 33), and in case of high risk also the affected individuals. Violations can be penalized under Art. 83 (GDPR) with fines of up to 20 million euros (GDPR Art. 83) or a share of annual turnover. A documented emergency plan that defines who does what in the event of a breach is therefore not a luxury but part of responsible operation.
Data protection as a trust factor, not a brake
Data protection does not begin in the privacy policy, but at the point where the data is created – in the form itself.
Step by Step to a Privacy-Compliant Care Website
The path to a privacy-compliant care website can be divided neatly into stages. It begins with taking stock: which forms exist, which data is collected, where does it flow, who has access? This inventory alone often reveals superfluous fields, missing encryption or unclear recipient paths. On this basis, you can decide which details are really necessary and which can be omitted – data minimization is the most effective and at the same time most cost-efficient lever.
The second step is the technical implementation: ensure HTTPS, move hosting and mail delivery to an EU or German location, conclude DPAs with service providers and integrate spam protection without third parties. In parallel, the consent texts and the privacy policy are adapted to the actual processing operations. It is important that the texts match reality – a privacy policy describing services that are not used at all is just as problematic as one that conceals actual processing.
The third step is about operation and maintenance. Updates, backups, a deletion concept with concrete deadlines and an emergency plan for data breaches ensure that the level once reached is maintained. From working on more than 50 care and healthcare projects (project experience), we know that the greatest effort rarely lies in the technology but in clarifying the processes: who handles inquiries, where are they stored, when are they deleted? We clarify these questions together before a single line of code is written. For a non-binding assessment, feel free to reach out directly – via the contact form.
The three stages at a glance
- 1
Taking stock
Capture which forms exist, which data is collected, where it flows and who has access. This inventory alone often reveals superfluous fields, missing encryption and unclear recipient paths.
- 2
Technical implementation
Ensure HTTPS, move hosting and mail delivery to a German or EU location, conclude DPAs with service providers, integrate spam protection without third parties and adapt consent texts to the actual processing.
- 3
Operation and maintenance
Updates, backups, a deletion concept with concrete deadlines and an emergency plan for data breaches keep the protection level once reached permanently stable.