Who Visits a Clinic Website, and What They Need First
Before choosing colours or a booking plugin, sort your visitors into three groups.
- The urgent visitor. A parent with a feverish child at 11 p.m., or someone trying to get a nurse to an elderly relative's house today. They need a phone number they can tap, your hours, and a plain statement of what you can and can't handle.
- The planner. Someone booking a follow-up, a dental cleaning or a routine check. They'll happily use a form or a booking page, as long as it's short and they know what happens next.
- The checker. Someone who has been referred to your doctor, or found you on Google Maps, and wants to know whether you're legitimate. They read doctor profiles, registration numbers, fees and reviews.
When we built the website for Patient Healthcare Services, a home healthcare and equipment rental provider in Pakistan, the first group shaped almost every decision. Call and WhatsApp repeat on key screens, contact isn't hidden behind a form-only page, and emergency callers never have to get past a CAPTCHA. Forms still exist, but for non-urgent equipment questions.
The Pages Good Clinic Website Design Includes
A small clinic doesn't need forty pages. It needs a handful of pages that each answer a specific question well.
| Page | The question it answers | Details people look for |
|---|---|---|
| Home | Can you help me, and how do I reach you now? | Specialties in plain words, today's hours, tap-to-call, WhatsApp, booking button, branch addresses |
| One page per service or specialty | Do you treat this, and what happens at the visit? | Who it's for, how long a visit takes, what to bring, preparation (such as fasting before blood tests), fee or fee range |
| Doctor profiles | Who will I see, and are they qualified? | Real photo, qualifications, registration or licence number, languages spoken, which days they're in |
| Branch or location page | Where exactly, and can I get there? | Map, landmarks, parking, wheelchair access, branch-specific hours and phone |
| Booking page | How do I get an appointment? | The booking options you offer, what happens after a request, how cancellations work |
| Privacy notice | What happens to my details? | What the forms collect, who sees it, where it's stored, how to ask for deletion |
Service pages do the heavy lifting in search. Someone typing "dermatologist in Clifton" or "physiotherapy at home Karachi" wants a page about that service in that area, not a homepage that lists twelve specialties in tiles. If people keep phoning to ask whether they need a referral or whether you see children, that answer belongs on the page.
Choosing an Online Appointment Booking Setup
"Add online booking" can mean three very different things, and they don't cost the same in money or staff time.
| Option | How it works | Suits | Watch out for |
|---|---|---|---|
| Call and WhatsApp only | Buttons open the dialler or a chat with a neutral pre-filled message | Single-doctor practices, home-care services, urgent services | Someone has to answer promptly, including evenings |
| Appointment request form | Patient picks a branch and a preferred day; reception confirms by phone or WhatsApp | Most small and mid-sized clinics | Say clearly that it's a request and when you'll reply |
| Live booking calendar | Patients choose a real slot from your scheduling or practice management software | Multi-doctor clinics with disciplined schedules | Calendars that aren't kept current create double bookings and angry patients |
Our usual advice is to start with the middle option unless your schedule is already managed in software that staff keep up to date. A request form that reception confirms within an hour feels better to patients than a live calendar that's wrong half the time. If you also list your doctors on a booking platform such as Oladoc or Marham in Pakistan, keep the fees and timings there consistent with your own site.
A Booking Request Form That Keeps Health Details Out of Analytics
Here's where clinic sites most often go wrong, rarely on purpose. A developer adds GA4 and a Meta or Google Ads tag to every page, then builds a booking form whose confirmation URL contains the patient's name, or sends "reason for visit: diabetes" as an event parameter. Google's own rules forbid it. Google Analytics policies prohibit sending anything Google could recognise as personally identifiable information, such as names, email addresses and phone numbers. Google's note on health data adds that data collected with Analytics must not reveal sensitive information about a user.
The form below asks only what reception needs to call back, warns people not to type medical details, uses a hidden trap field instead of a CAPTCHA, and sends GA4 nothing but the form name and branch:
<a class="wa-book" data-wa-number="923000000000" data-branch="Clifton" href="https://wa.me/923000000000">Book on WhatsApp</a>
<form class="appt-form" action="/appointment-request.php" method="post">
<p class="appt-urgent">This form is not for emergencies. If it's urgent, call <a href="tel:+922100000000">021 0000 0000</a>.</p>
<label>Patient name <input name="name" required autocomplete="name"></label>
<label>Phone or WhatsApp <input name="phone" type="tel" required autocomplete="tel"></label>
<label>Branch
<select name="branch" required>
<option value="">Choose a branch</option>
<option value="clifton">Clifton</option>
<option value="gulshan">Gulshan-e-Iqbal</option>
</select>
</label>
<label>Preferred day <input name="preferred_day" type="date"></label>
<p class="appt-hint">Please don't add symptoms or medical history here. The doctor will ask in person.</p>
<div class="appt-trap" hidden><label>Leave empty <input name="website" tabindex="-1" autocomplete="off"></label></div>
<label><input type="checkbox" name="consent" required> The clinic may contact me about this request, as described in the <a href="/privacy-policy.html">privacy notice</a>.</label>
<button type="submit">Request appointment</button>
</form>
<script>
(function () {
// 1. WhatsApp link with a neutral, pre-filled message (branch only, no symptoms).
var wa = document.querySelector('.wa-book');
if (wa) {
var text = 'Hi, I would like to book an appointment at the ' + wa.dataset.branch + ' branch.';
wa.href = 'https://wa.me/' + wa.dataset.waNumber + '?text=' + encodeURIComponent(text);
}
var form = document.querySelector('.appt-form');
if (!form) return;
form.addEventListener('submit', function (e) {
// 2. Bots fill hidden fields; people don't. No CAPTCHA in a patient's way.
if (form.elements.website.value) { e.preventDefault(); return; }
// 3. Count the request in GA4 with the form name and branch only.
// Name, phone and date never leave the clinic's own server.
if (typeof gtag === 'function') {
gtag('event', 'generate_lead', {
form_name: 'appointment_request',
clinic_branch: form.elements.branch.value
});
}
});
})();
</script>We tested it in jsdom, a headless browser environment. With a sample name, phone number and date filled in, submitting the form sent one generate_lead event containing only appointment_request and the branch, and none of the typed values appeared in it. When the hidden trap field was filled, as spam bots tend to do, the form stopped and no event was sent. The WhatsApp link opened with a neutral message naming only the branch. Three more things are up to your form handler, appointment-request.php in this example. It should accept POST only, redirect to a thank-you page whose URL holds no patient details, because GA4 records the full page address, and store or forward the request somewhere access is limited to the people who need it.
Patient Privacy Rules for Clinic Websites in Pakistan and the UAE
We're web developers, not lawyers, so treat this section as a map of what to ask your legal adviser rather than legal advice. Here's what applies as of October 2026.
Pakistan. There's still no enacted general data protection law. The Personal Data Protection Bill has been drafted and discussed for years, and the Senate's private member's version lapsed in committee. Drafts have treated health data as sensitive personal data, so building as if that rule already applied is the safer bet. What does apply to doctors now is the Pakistan Medical and Dental Council's revised Code of Ethics, which PM&DC enforced in March 2026. As reported, it bars exaggerated claims about service quality, guaranteed cures and comparisons with other doctors in advertising, and it bars sharing identifiable patient photos or videos without written consent. Before-and-after galleries and "patient stories" on your website fall squarely within that.
UAE. Article 13 of Federal Law No. 2 of 2019, on the use of ICT in health fields, restricts storing or processing health data relating to services provided in the UAE outside the country, except in cases the authorities allow. That matters for a website more than people expect. If your booking form drops requests with health details into an overseas email service or a plugin's foreign cloud, ask whether the exceptions cover you. Advertising is regulated too. The Ministry of Health and Prevention runs a licence service for healthcare advertisements on a website or digital link, and DHA's standard for medical advertising on social media asks facility accounts to show their MOHAP advertising licence number. Check with your licensing authority which of your pages count as advertising.
Ads, everywhere. Google Ads treats health as a sensitive interest category. If you advertise treatments for health conditions, you can't use your own remarketing lists, Customer Match uploads or lookalike audiences, only Google's predefined audiences, keywords and location targeting. Plan campaigns around search intent instead.
Trust Signals Patients and Google Both Look For
Health pages are what Google calls "Your Money or Your Life" topics, where weak or misleading information can harm people. Google's guide to creating helpful, reliable content suggests asking who created the content, how, and why, and making those answers obvious. For a clinic, that turns into specific, checkable details:
- Registration and licence numbers on doctor profiles. A PM&DC registration number in Pakistan, or a licence number from DHA, DOH or MOHAP in the UAE, lets anyone verify a doctor on the regulator's own site.
- Named authors and review dates on health articles. If you publish an article on managing blood pressure, say which doctor reviewed it and when.
- Fees, or at least fee ranges. People phone to ask anyway. Publishing consultation fees removes one reason to choose a competitor who does.
- Real photos of real rooms and staff. Stock photos of models in white coats are easy to spot and say nothing about your clinic.
- Reviews you didn't write. Link to your Google reviews. Never put invented testimonials or star ratings on the site. On the PHCS project we deliberately left out review widgets because there weren't real patient quotes to show.
Speed and readability count too. A slow page loses the urgent visitor first, and larger text with strong contrast helps older patients and anyone reading in bright sunlight. Our accessibility guide covers labels, contrast and keyboard use in more depth.
Connect the Booking Page to Google Business Profile
Most new patients will see your Google Business Profile before your website. Verified profiles can add a booking link, and Google's business links guidelines are stricter than many clinics realise. The link has to lead to a dedicated page where people can actually complete the booking, and for clinics with several branches it should point to the right branch. Messaging links, social media pages, app store links and link shorteners aren't allowed, so a wa.me link won't work as your booking link. Google's crawlers also need to load the page, which means no CAPTCHA, login wall or bot blocking on it.
Common Clinic Website Mistakes
- A slider instead of a phone number. Put hours, tap-to-call and booking in the first screen on mobile.
- A free-text "describe your problem" box. It collects health details you then have to protect, and it slows the form down. Ask for symptoms at the visit.
- Analytics and ad tags that see everything. Check what your confirmation URL and events contain before launch, not after.
- Before-and-after photos without written consent. In Pakistan the revised PM&DC code makes this an ethics issue, not only a privacy one.
- Doctor pages with no way to verify anything. A name and a photo isn't enough. Add qualifications, registration numbers and the days each doctor is in.
- Hours that are out of date. Make hours, fees and doctor schedules editable by staff, so changes don't wait for a developer.
If you're at the planning stage, our website brief template helps you collect this before asking for quotes, and our guide to tracking WhatsApp and call clicks in GA4 shows how to count taps without collecting patient details.
Frequently Asked Questions
What pages does a clinic website need?
A home page with hours, tap-to-call and booking, one page per service or specialty, doctor profiles with qualifications and registration numbers, a page per branch, a booking page and a privacy notice. Each page should answer the questions your reception desk hears most.
Should a small clinic use a live booking calendar or a request form?
Most small clinics do better with an appointment request form that reception confirms by phone or WhatsApp. A live calendar only works if your schedule is kept current in the software behind it; otherwise it causes double bookings.
Can I use Google Analytics on a clinic website?
Yes, with care. Google's policies forbid sending names, phone numbers, email addresses or other identifying details, and data you collect must not reveal sensitive information about a user. Send only neutral events such as a form name and branch, and keep patient details out of URLs.
Can a WhatsApp link be the booking link on Google Business Profile?
No. Google's business links guidelines require a link to a page where the booking can be completed, and they exclude messaging links, social media pages, app store links and link shorteners. Use your own booking page and keep WhatsApp as a button on the site.
Can we show before-and-after photos or patient stories on our website?
Only with the patient's written consent, and with no exaggerated or guaranteed results. Pakistan's revised PM&DC Code of Ethics bars identifiable patient photos or videos without written consent, and UAE health advertising rules also apply, so check with your regulator before publishing.