By business type

Terms & Conditions Generator for healthcare

Written for health data: Article 9 conditions, HIPAA where it applies, and the wellness gap where it does not.

Generate your terms and conditions Read the terms and conditions guide

Health service terms have to be clear about what the service is not. Where a product provides information rather than diagnosis, or connects users to practitioners rather than treating them, saying so precisely is both a liability control and a regulatory one.

Health data is special category data under GDPR and UK GDPR, which means an Article 6 basis is not enough on its own - you also need an Article 9 condition, and the ones available to a private business are narrower than most people expect. Explicit consent, health or social care provision, and public health are the usual candidates, and each carries its own conditions.

In the US the position is more confusing, because most consumer health products are not covered by HIPAA at all. HIPAA reaches covered entities and their business associates; a fitness app, a symptom tracker or a wellness marketplace usually falls outside it - and straight into Washington’s My Health My Data Act, which has a private right of action, and into FTC health breach notification rules.

The recurring failure across both regimes is advertising technology. Pixels on appointment booking pages, symptom checkers and patient portals transmit health-adjacent data to ad platforms, and this has produced some of the largest health privacy enforcement actions and class settlements of recent years.

What a terms and conditions for a healthcare or health-tech business has to cover

What the service is and explicitly is not - information, triage, connection or treatment
Emergency situations and the instruction to seek immediate care
Practitioner relationships: whether the practitioner or the platform is responsible
Cancellation, no-show and rescheduling terms for appointments
Regulatory status and any professional registration relied on

How a healthcare or health-tech business actually moves personal data

Intake forms and symptom questionnaires

Health data collected before any clinical relationship exists, often through a web form with the same tracking as the marketing site.

Appointment booking

The fact of booking with a particular specialist is itself health data, which is why booking pages are the highest-risk place to run advertising pixels.

Clinical records and notes

Retained under statutory schedules, accessible only to those with a clinical need, and subject to access requests with clinical exemptions.

Wearables and connected devices

Continuous measurement data, frequently transmitted through a device manufacturer’s cloud before it reaches you.

Insurance and billing

Claims data links diagnosis to identity and moves between multiple organisations, each with its own role.

Research and secondary use

Using clinical data for research or product improvement is a new purpose needing its own basis and usually its own governance.

Third parties the draft will ask you about

practice management systems · Stripe · Twilio for reminders · AWS or Azure with a BAA where required · lab and imaging partners · insurance clearing houses

The rules that apply

GDPR Article 9

Health data needs a condition in addition to a lawful basis, plus in the UK a Schedule 1 condition and often an appropriate policy document.

HIPAA where it applies

Covered entities and business associates: privacy rule, security rule, breach notification, and business associate agreements down the chain.

The consumer health gap

Washington My Health My Data, Nevada’s equivalent, and FTC health breach notification reach products HIPAA does not.

Clinical records retention

Statutory retention schedules for health records are long and specific, and they override ordinary minimisation instincts.

Professional confidentiality

A duty of confidence separate from data protection, enforced through regulators and the courts.

What the generated terms and conditions contains

Who the contract is with and how it is formed
Your legal entity, and the exact moment acceptance happens - account creation, checkout, or continued use.
The service, the licence and its limits
What you are actually providing, what the user may do with it, and what they may not.
Price, payment, renewal and cancellation
Billing cycle, auto-renewal, price-change notice, and how either side ends the arrangement.
Acceptable use and enforcement
The behaviour that gets an account suspended, and the process you follow before you suspend it.
User content and intellectual property
Who owns what, the licence you need to run the service, and the takedown route for infringing material.
Warranties, liability and indemnity
Disclaimers that survive local consumer law, and caps that are actually enforceable rather than theatrically broad.
Governing law, jurisdiction and disputes
The law that applies, the courts that hear it, and any pre-litigation steps you require.

Health data compliance essentials

Identify your Article 9 condition and record it
Plus the UK Schedule 1 condition and appropriate policy document where required.
Remove advertising tags from clinical journeys
Booking, intake, symptom and portal pages. Verify with a scan rather than a policy statement.
Determine your HIPAA status honestly
And if you fall outside it, work out which consumer health statutes apply instead.
Put BAAs or DPAs in place down the chain
Including hosting, messaging and analytics vendors that touch health data.
Apply statutory retention schedules
Clinical records have their own periods that override general minimisation.
Separate care processing from marketing
Different systems where possible, different bases always.

Where this usually goes wrong

Advertising pixels on booking or symptom pages

The specific pattern behind the largest health privacy enforcement and class actions of recent years.

Assuming HIPAA covers you, or that not being covered means no rules

Both are wrong for most consumer health products. The state consumer health laws are the ones that bite.

Relying on consent alone under GDPR

Consent in a care context is often not freely given. Health or social care provision is usually the better condition.

No appropriate policy document in the UK

Several Schedule 1 conditions require one, and its absence invalidates reliance on the condition.

Marketing to patients from clinical records

A different purpose from care, requiring its own basis and usually explicit consent.

Sharing data with a device manufacturer without disclosure

Wearable data usually passes through the manufacturer’s infrastructure before it reaches you.

Frequently asked questions

Is health data different from other personal data?

Yes. Under GDPR and UK GDPR it is special category data requiring an Article 9 condition in addition to a lawful basis, and in the UK often a Schedule 1 condition with an appropriate policy document.

Does HIPAA apply to my health app?

Usually not. HIPAA applies to covered entities and their business associates. Most direct-to-consumer health and wellness products fall outside it - and inside state consumer health laws and FTC breach notification rules instead.

Can I run analytics on a patient booking page?

Not without extreme care. The fact of booking with a particular provider is health data, and transmitting it to an ad platform is the pattern behind the largest enforcement actions in this area.

How long must clinical records be kept?

Statutory schedules apply and vary by record type and jurisdiction, often running to decades. They override the instinct to minimise.

Are terms and conditions legally binding?

They are when the user had a genuine opportunity to read them and took a positive step to accept. Clickwrap - a ticked box next to a visible link - holds up far more reliably than a "by using this site you agree" line in the footer.

What is the difference between terms of service and terms and conditions?

Nothing substantive. "Terms and conditions" is the more common phrasing in the UK and Commonwealth markets, "terms of service" in the US and in SaaS. The clauses do the same job.

Can I limit my liability to zero?

No. Most consumer regimes void attempts to exclude liability for death, personal injury or fraud, and unfair-terms rules strike out caps a court considers unreasonable. A cap that is drafted to survive review is worth more than one that is struck out entirely.

Do I need terms if I sell nothing?

If users can register, post, comment or upload, yes - the terms are what let you moderate, suspend and remove content without being in breach of contract yourself.