By business type

Cookie Policy Generator for healthcare

Written for health data: Article 9 conditions, HIPAA where it applies, and the wellness gap where it does not.

Generate your cookie policy Read the cookie policy guide

A health site’s cookie policy carries a risk no other sector shares: the pages a visitor loads reveal health information about them. Advertising tags on booking, symptom or condition pages are the specific pattern behind the largest health privacy settlements of recent years.

Health data is special category data under GDPR and UK GDPR, which means an Article 6 basis is not enough on its own - you also need an Article 9 condition, and the ones available to a private business are narrower than most people expect. Explicit consent, health or social care provision, and public health are the usual candidates, and each carries its own conditions.

In the US the position is more confusing, because most consumer health products are not covered by HIPAA at all. HIPAA reaches covered entities and their business associates; a fitness app, a symptom tracker or a wellness marketplace usually falls outside it - and straight into Washington’s My Health My Data Act, which has a private right of action, and into FTC health breach notification rules.

The recurring failure across both regimes is advertising technology. Pixels on appointment booking pages, symptom checkers and patient portals transmit health-adjacent data to ad platforms, and this has produced some of the largest health privacy enforcement actions and class settlements of recent years.

What a cookie policy for a healthcare or health-tech business has to cover

Which pages are treated as clinical journeys and carry no advertising or analytics tags at all
Any tracker that could transmit condition, treatment or appointment information
Session replay and chat tools, and why they are excluded from clinical pages
The Article 9 or HIPAA position for anything that does touch health-adjacent data
How consent is captured, and what still runs when it is refused

How a healthcare or health-tech business actually moves personal data

Intake forms and symptom questionnaires

Health data collected before any clinical relationship exists, often through a web form with the same tracking as the marketing site.

Appointment booking

The fact of booking with a particular specialist is itself health data, which is why booking pages are the highest-risk place to run advertising pixels.

Clinical records and notes

Retained under statutory schedules, accessible only to those with a clinical need, and subject to access requests with clinical exemptions.

Wearables and connected devices

Continuous measurement data, frequently transmitted through a device manufacturer’s cloud before it reaches you.

Insurance and billing

Claims data links diagnosis to identity and moves between multiple organisations, each with its own role.

Research and secondary use

Using clinical data for research or product improvement is a new purpose needing its own basis and usually its own governance.

Third parties the draft will ask you about

practice management systems · Stripe · Twilio for reminders · AWS or Azure with a BAA where required · lab and imaging partners · insurance clearing houses

The rules that apply

GDPR Article 9

Health data needs a condition in addition to a lawful basis, plus in the UK a Schedule 1 condition and often an appropriate policy document.

HIPAA where it applies

Covered entities and business associates: privacy rule, security rule, breach notification, and business associate agreements down the chain.

The consumer health gap

Washington My Health My Data, Nevada’s equivalent, and FTC health breach notification reach products HIPAA does not.

Clinical records retention

Statutory retention schedules for health records are long and specific, and they override ordinary minimisation instincts.

Professional confidentiality

A duty of confidence separate from data protection, enforced through regulators and the courts.

What the generated cookie policy contains

What the technologies actually are
Cookies, local storage, session storage, pixels, SDKs and server-side tags - the law covers storage and access on a device, not the word "cookie".
A per-cookie table
Name, provider, purpose, category and duration for each cookie, which is the format UK and EU regulators expect to see.
Category definitions
Strictly necessary, functional, analytics and advertising, with an honest explanation of why only the first runs without consent.
How consent was obtained and how to change it
The banner, the granular choices, and a permanent link to reopen preferences - the withdrawal route has to be as easy as the acceptance route.
Third-party cookies and onward use
Which providers set cookies through your site and what they do with the data once it is theirs.
Browser and device controls
Practical instructions, plus a note that blocking strictly necessary cookies will break parts of the service.

Health data compliance essentials

Identify your Article 9 condition and record it
Plus the UK Schedule 1 condition and appropriate policy document where required.
Remove advertising tags from clinical journeys
Booking, intake, symptom and portal pages. Verify with a scan rather than a policy statement.
Determine your HIPAA status honestly
And if you fall outside it, work out which consumer health statutes apply instead.
Put BAAs or DPAs in place down the chain
Including hosting, messaging and analytics vendors that touch health data.
Apply statutory retention schedules
Clinical records have their own periods that override general minimisation.
Separate care processing from marketing
Different systems where possible, different bases always.

Where this usually goes wrong

Advertising pixels on booking or symptom pages

The specific pattern behind the largest health privacy enforcement and class actions of recent years.

Assuming HIPAA covers you, or that not being covered means no rules

Both are wrong for most consumer health products. The state consumer health laws are the ones that bite.

Relying on consent alone under GDPR

Consent in a care context is often not freely given. Health or social care provision is usually the better condition.

No appropriate policy document in the UK

Several Schedule 1 conditions require one, and its absence invalidates reliance on the condition.

Marketing to patients from clinical records

A different purpose from care, requiring its own basis and usually explicit consent.

Sharing data with a device manufacturer without disclosure

Wearable data usually passes through the manufacturer’s infrastructure before it reaches you.

Frequently asked questions

Is health data different from other personal data?

Yes. Under GDPR and UK GDPR it is special category data requiring an Article 9 condition in addition to a lawful basis, and in the UK often a Schedule 1 condition with an appropriate policy document.

Does HIPAA apply to my health app?

Usually not. HIPAA applies to covered entities and their business associates. Most direct-to-consumer health and wellness products fall outside it - and inside state consumer health laws and FTC breach notification rules instead.

Can I run analytics on a patient booking page?

Not without extreme care. The fact of booking with a particular provider is health data, and transmitting it to an ad platform is the pattern behind the largest enforcement actions in this area.

How long must clinical records be kept?

Statutory schedules apply and vary by record type and jurisdiction, often running to decades. They override the instinct to minimise.

Do I need a cookie policy as well as a privacy policy?

In the UK and EU, yes in practice. PECR and the ePrivacy Directive regulate storing and reading information on a device separately from GDPR’s rules on processing, and the per-cookie disclosure is too detailed to bury in a privacy policy.

Do analytics cookies need consent?

In the UK and EU, yes - the ICO has said repeatedly that analytics is not "strictly necessary". Some EU regulators allow a narrow exemption for first-party, non-shared audience measurement, but the default answer is consent first.

Does a cookie policy need updating when I add a tool?

Yes, and this is the clause that goes stale fastest. Every new tag, pixel or embedded widget adds cookies your table does not list. Scanning your own site on a schedule is the only reliable way to keep it honest.

What about cookies set by embedded video and maps?

They count. An embedded YouTube player or Google Map sets third-party cookies as soon as it loads, so either it loads only after consent, or you use a privacy-preserving embed mode and say so.