The verdict in three sentences
A London dental practice website handles health data as soon as a patient fills in a booking form or describes a toothache, and that data is special category data under UK GDPR. Your provider should deliver a site that collects the minimum, sets no non-essential cookies before consent and meets WCAG 2.2 level AA, with an accessibility statement. Put these requirements in writing in the contract, with an audit before launch: it costs far less than a patient complaint or an emergency rebuild.
This is not legal advice: have your privacy notice checked by your adviser or data protection officer.
What is the legal frame for a London dental practice?
A few factual reference points to brief a provider:
- UK GDPR and the Data Protection Act 2018 govern personal data. Health data needs a lawful basis plus an additional condition for processing.
- ICO: the Information Commissioner's Office is the regulator. Most practices processing personal data must pay the annual data protection fee, which is tiered by organisation size.
- PECR governs cookies and electronic marketing. Non-essential cookies (analytics, advertising, pixels) generally require prior consent.
- GDC: the General Dental Council publishes guidance on ethical advertising. Treatment pages, reviews and before/after photos must be accurate and not misleading.
- CQC: in England, dental care providers register with the Care Quality Commission, and many practices display their rating on the site.
- Equality Act 2010 requires reasonable adjustments for disabled people, which is a strong case for an accessible site.
The NHS versus private nuance matters: a mixed practice must clearly separate NHS band charges from private fees, without implying that private treatment is NHS funded.
What should you require from the provider, item by item?
| Requirement | What to get | Who is responsible |
|---|---|---|
| Privacy notice | Written for the practice, purposes, retention periods, patient rights | Practice (content), provider (implementation) |
| Cookie banner | No non-essential cookies before consent, rejecting as easy as accepting | Provider |
| Contact forms | Minimal fields, no clinical details via plain email, encrypted delivery | Provider |
| Online booking tool | Established vendor, data processing agreement (DPA), data location stated | Practice (choice), provider (integration) |
| Hosting and access | HTTPS, named accounts, two-factor authentication, daily backups | Provider, then practice |
| Accessibility | WCAG 2.2 AA, keyboard and screen reader testing | Provider |
| Accessibility statement | Public page with level achieved and a contact | Practice and provider |
| Pre-launch audit | Written report on cookies, forms and accessibility | Provider |
On forms, one simple rule: ask for name, a contact method and the general reason (check-up, emergency, implant, clear aligners), and leave clinical detail to the practice software or the phone call. If you publish before/after photos, keep the patient's written consent and state that they are illustrative.
What does a compliant site cost in London?
Compliance is not a bolt-on: it belongs in the design budget. Here is a 2026 ballpark based on public rate pages of London healthcare agencies and typical quotes.
| Item | London agency (ballpark) | Kolonell |
|---|---|---|
| 10 to 15 page site with treatment pages | £8,000 to £30,000 | £2,300 to £6,900 depending on plan |
| Booking tool integration | £500 to £2,500 | Included in Growth and Premium |
| Cookie banner and privacy notice set-up | £300 to £1,500 | Included |
| WCAG 2.2 AA accessibility audit | £1,500 to £5,000 | Check included before delivery |
| Treatment page copywriting | £1,000 to £4,000 | Native English copywriting included |
| Timeline | 8 to 14 weeks | 3 to 4 weeks |
Kolonell plans are fixed: Starter £2,300, Growth £3,900, Premium £6,900, with a project manager reachable during your hours, native copywriting, delivery in 3 to 4 weeks and 3 months of support. A patient portal or a direct link to your practice software is a custom application, on quote. Details are on the international websites page.
Questions to ask before signing
- Which cookies does the site set before consent? Ask for the list.
- Where is form data stored, and for how long?
- Who signs the data processing agreement with the booking vendor?
- Which WCAG level is guaranteed, and with which testing tools?
- Who updates the accessibility statement after each page redesign?
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Mini case study
*Illustrative example.* Priya runs a four-chair private practice in Clapham focused on implants and clear aligners. Her old site sends form submissions, including symptom descriptions, unencrypted to a shared mailbox, and loads an advertising pixel before any consent.
A local agency quotes £18,000 for a rebuild plus £3,000 for an accessibility audit. She picks the Growth plan at £3,900, keeps her existing booking tool and orders an independent audit at £1,500. Total: £5,400 against £21,000, a £15,600 difference. With an average implant case worth £2,500, just 2 extra patients a year from a clearer booking journey cover the audit and part of the site.
FAQ
Does a dental practice have to pay the ICO fee?
In most cases yes, because it processes patients' personal data. The amount depends on size and turnover, from a few tens of pounds for small organisations to more for larger ones.
Can a practice use Google Analytics?
Yes, with prior consent for analytics cookies unless an exemption applies that your adviser has confirmed. Configure it so form data is never sent, and allow 1 to 2 hours for set-up.
Are before/after photos allowed?
They are common but must be genuine, not misleadingly edited and backed by patient consent. GDC advertising guidance applies; keep to 6 to 10 representative cases.
Is WCAG 2.2 AA mandatory for a private practice?
The public sector accessibility rules do not directly cover a private practice, but the Equality Act 2010 requires reasonable adjustments. Level AA is the reference target and adds little to the budget when planned from the start.
How long does it take to bring an existing site into line?
An audit and targeted fixes take 2 to 4 weeks. If the site runs on an old theme, a 3 to 4 week rebuild often costs less than repeated patches.
Let's scope your project. A compliant dental practice site with treatment pages, integrated booking and AA accessibility, from £2,300, delivered in 3 to 4 weeks. See the international offer or request a free quote: detailed reply within 48 hours.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
