Cookie Consent and Patient Data on Pharmacy Websites: What Owners Should Check

Pharmacies handle some of the most sensitive information there is. A website can quietly collect more than owners realise, through analytics, advertising pixels, booking forms and embedded tools.

This article explains the key issues in plain English. It is not legal advice. Speak to your data protection lead, a qualified adviser and the Information Commissioner’s Office (ICO) guidance for your own situation.

The basics

Two sets of rules matter most for websites:

• PECR (Privacy and Electronic Communications Regulations): generally requires consent before storing or accessing non-essential information on a user’s device, such as marketing and many analytics cookies.
• UK GDPR and the Data Protection Act 2018: apply when you process personal data. Health information is special category data, which needs extra care.

Why pharmacy sites need extra care

A visit to a page about a specific condition, test or medicine can reveal something about a person’s health. If an advertising or analytics tool receives that page address together with an identifier, you could be sharing sensitive information without meaning to.

For that reason, be cautious about what is tracked on service pages and forms.

What needs consent, and what does not

• Strictly necessary cookies, such as those needed to keep a booking session working, generally do not need consent.
• Analytics, advertising and social media tracking generally need consent in advance, subject to current ICO guidance.

Check the ICO’s current position on analytics cookies, as it is under review and may change.

What a good cookie banner does

• Appears before non-essential cookies are set
• Offers “Accept” and “Reject” with equal prominence
• Explains purposes in plain language
• Lets people change their choice later
• Does not pre-tick boxes
• Genuinely blocks tags until consent is given

A banner that looks compliant but lets tracking run anyway is a common failing.

Booking forms and patient data

Your booking system may collect names, contact details and the reason for the appointment, which can reveal health information. Check:

• What data is collected, and is each item needed?
• Who is the supplier, and where is data stored?
• Is there a written data processing agreement?
• Is data protected in transit and at rest?
• Is the form accessible and clear about how data will be used?

Avoid collecting clinical detail in free-text boxes unless you need it and have a lawful basis and appropriate safeguards.

Tracking tools to review

Ask your web provider for a list of every tool on the site:

• Analytics
• Advertising pixels
• Social media pixels
• Heatmaps and session recording tools
• Live chat widgets
• Embedded videos and maps

For each one, ask: why do we use it, what data does it receive, does it need consent and have we got a data processing agreement? Session recording and advertising pixels on pages that reveal health information deserve particular scrutiny.

Measuring performance responsibly

You can still understand what drives bookings. Our guide to pharmacy website analytics explains which measures matter. Combine it with consent-aware set-up and avoid sending sensitive details to third-party tools.

Privacy notice

Your website should link to a clear privacy notice explaining:

• Who you are
• What data you collect and why
• The lawful basis and conditions for health data
• Who you share it with
• How long you keep it
• How people can exercise their rights
• How to complain

Keep it in plain English and keep it up to date.

Email and marketing messages

If you send marketing emails or texts, separate rules on consent apply. Be careful about marketing to patients using data collected for their care, and take advice on how you gained permission.

Practical checklist

• Cookie audit completed
• Consent banner blocks non-essential tags until consent is given
• “Reject” is as easy as “Accept”
• No advertising pixels on sensitive pages without proper review
• Booking system supplier checked, with a data processing agreement in place
• Privacy notice current
• Contact route for data requests
• Responsible person named
• Review scheduled at least annually and after any website change

Who to involve

Involve your data protection lead or whoever fulfils that role, your web provider, your booking system supplier and, where appropriate, your professional indemnity or legal adviser. Check whether your pharmacy needs to follow additional NHS information governance requirements, such as the Data Security and Protection Toolkit, depending on your NHS contracts.

Conclusion

You can market and measure a pharmacy website while respecting patient privacy, but it requires deliberate choices. Know what tools are on your site, get consent where needed and keep sensitive data out of tracking tools.

Working with a provider who builds privacy into the design helps. See our pharmacy website design service, and read our article on online booking systems for modern pharmacies when reviewing how appointments are handled.