By business type

Acceptable Use Policy Generator for healthcare

Written for health data: Article 9 conditions, HIPAA where it applies, and the wellness gap where it does not.

Generate your acceptable use policy Read the acceptable use policy guide

A health platform’s acceptable use policy carries an obligation others do not: what happens when a user discloses risk of harm. That escalation route belongs in the rules, agreed in advance, rather than being improvised.

Health data is special category data under GDPR and UK GDPR, which means an Article 6 basis is not enough on its own - you also need an Article 9 condition, and the ones available to a private business are narrower than most people expect. Explicit consent, health or social care provision, and public health are the usual candidates, and each carries its own conditions.

In the US the position is more confusing, because most consumer health products are not covered by HIPAA at all. HIPAA reaches covered entities and their business associates; a fitness app, a symptom tracker or a wellness marketplace usually falls outside it - and straight into Washington’s My Health My Data Act, which has a private right of action, and into FTC health breach notification rules.

The recurring failure across both regimes is advertising technology. Pixels on appointment booking pages, symptom checkers and patient portals transmit health-adjacent data to ad platforms, and this has produced some of the largest health privacy enforcement actions and class settlements of recent years.

What a acceptable use policy for a healthcare or health-tech business has to cover

Prohibited content, including medical misinformation and unsolicited clinical advice between users
The escalation route when a disclosure suggests risk to life, and its limits on confidentiality
Impersonation of clinicians or misrepresentation of credentials
Reporting routes and the response times you commit to
Enforcement, and how a suspended user retains access to their own records

How a healthcare or health-tech business actually moves personal data

Intake forms and symptom questionnaires

Health data collected before any clinical relationship exists, often through a web form with the same tracking as the marketing site.

Appointment booking

The fact of booking with a particular specialist is itself health data, which is why booking pages are the highest-risk place to run advertising pixels.

Clinical records and notes

Retained under statutory schedules, accessible only to those with a clinical need, and subject to access requests with clinical exemptions.

Wearables and connected devices

Continuous measurement data, frequently transmitted through a device manufacturer’s cloud before it reaches you.

Insurance and billing

Claims data links diagnosis to identity and moves between multiple organisations, each with its own role.

Research and secondary use

Using clinical data for research or product improvement is a new purpose needing its own basis and usually its own governance.

Third parties the draft will ask you about

practice management systems · Stripe · Twilio for reminders · AWS or Azure with a BAA where required · lab and imaging partners · insurance clearing houses

The rules that apply

GDPR Article 9

Health data needs a condition in addition to a lawful basis, plus in the UK a Schedule 1 condition and often an appropriate policy document.

HIPAA where it applies

Covered entities and business associates: privacy rule, security rule, breach notification, and business associate agreements down the chain.

The consumer health gap

Washington My Health My Data, Nevada’s equivalent, and FTC health breach notification reach products HIPAA does not.

Clinical records retention

Statutory retention schedules for health records are long and specific, and they override ordinary minimisation instincts.

Professional confidentiality

A duty of confidence separate from data protection, enforced through regulators and the courts.

What the generated acceptable use policy contains

Prohibited content and conduct
The categories you will not host, written specifically enough to enforce and narrowly enough to defend.
Technical restrictions
Rate limits, scraping, load testing, resource abuse and circumvention of quotas.
Security research boundaries
What testing is permitted, how to report a finding, and what will not be treated as an attack.
Reporting and moderation
How abuse is reported, what happens next, and the timescales you work to.
Enforcement ladder
Warning, throttle, suspension, termination - with the emergency route for genuinely urgent harm.
Appeals
How someone contests a decision, which several online-safety regimes now require rather than merely encourage.

Health data compliance essentials

Identify your Article 9 condition and record it
Plus the UK Schedule 1 condition and appropriate policy document where required.
Remove advertising tags from clinical journeys
Booking, intake, symptom and portal pages. Verify with a scan rather than a policy statement.
Determine your HIPAA status honestly
And if you fall outside it, work out which consumer health statutes apply instead.
Put BAAs or DPAs in place down the chain
Including hosting, messaging and analytics vendors that touch health data.
Apply statutory retention schedules
Clinical records have their own periods that override general minimisation.
Separate care processing from marketing
Different systems where possible, different bases always.

Where this usually goes wrong

Advertising pixels on booking or symptom pages

The specific pattern behind the largest health privacy enforcement and class actions of recent years.

Assuming HIPAA covers you, or that not being covered means no rules

Both are wrong for most consumer health products. The state consumer health laws are the ones that bite.

Relying on consent alone under GDPR

Consent in a care context is often not freely given. Health or social care provision is usually the better condition.

No appropriate policy document in the UK

Several Schedule 1 conditions require one, and its absence invalidates reliance on the condition.

Marketing to patients from clinical records

A different purpose from care, requiring its own basis and usually explicit consent.

Sharing data with a device manufacturer without disclosure

Wearable data usually passes through the manufacturer’s infrastructure before it reaches you.

Frequently asked questions

Is health data different from other personal data?

Yes. Under GDPR and UK GDPR it is special category data requiring an Article 9 condition in addition to a lawful basis, and in the UK often a Schedule 1 condition with an appropriate policy document.

Does HIPAA apply to my health app?

Usually not. HIPAA applies to covered entities and their business associates. Most direct-to-consumer health and wellness products fall outside it - and inside state consumer health laws and FTC breach notification rules instead.

Can I run analytics on a patient booking page?

Not without extreme care. The fact of booking with a particular provider is health data, and transmitting it to an ad platform is the pattern behind the largest enforcement actions in this area.

How long must clinical records be kept?

Statutory schedules apply and vary by record type and jurisdiction, often running to decades. They override the instinct to minimise.

Do I need an acceptable use policy separate from my terms?

A separate AUP is easier to enforce and easier to update. It also gives moderation staff and automated systems a single reference to cite, which matters when a suspension is challenged.

Does an AUP help with platform liability?

It is part of the picture. Intermediary liability protections generally depend on acting on notice, and both the EU Digital Services Act and the UK Online Safety Act expect published rules, a reporting route and an appeals process.

How specific should prohibited-use lists be?

Specific enough that a moderator can apply it consistently, with a residual catch-all. Lists that are only catch-alls get challenged; lists that are only specific leave gaps.