The verdict in three sentences
A physiotherapy practice website that loads Google Analytics before consent and receives GP referrals through a standard form combines two breaches: cookies and health data. A full fix usually costs 1,000 to 4,000 EUR for a 6-clinician practice in Dublin, audit included, then 0 to 30 EUR per month for a consent platform. That is a small budget next to GDPR fines capped at 4% of annual turnover and the reputational damage of a regulator inquiry in healthcare.
The most common breaches on a practice website
Ireland's Data Protection Commission (DPC) published cookie guidance in 2020 and has since run sweeps on websites, including healthcare. A typical physio site, often built by a generalist provider, shows at least three of the gaps below.
| Gap found | Applicable rule | Risk | Fix and indicative cost |
|---|---|---|---|
| Google Analytics loaded without consent | ePrivacy Regulations 2011 (S.I. 336) | DPC enforcement, fine | CMP + prior blocking, 300 to 600 EUR |
| Banner without an equally visible "Reject all" | DPC cookie guidance 2020 | enforcement notice | banner redesign, 150 to 300 EUR |
| Referral form sending letters by email | GDPR Article 9, health data | data breach | encrypted form + secure EU hosting, 1,500 to 3,000 EUR |
| Generic privacy policy | GDPR Articles 13 and 14 | non-compliance | tailored drafting, 300 to 600 EUR |
| Google Fonts and Maps loaded from the US | transfer outside the EU | complaint | self-hosted fonts, OpenStreetMap, 200 to 400 EUR |
| No defined retention period | GDPR Article 5 | non-compliance | record of processing + auto purge, 200 to 500 EUR |
The most sensitive point is the referral or intake form. As soon as a patient attaches a GP letter or describes a condition, it becomes health data under Article 9. In Ireland there is no French-style HDS certification, but the controller must apply appropriate security under Article 32: encryption in transit and at rest, EU hosting, access logs and a data processing agreement. A shared Gmail inbox or an unencrypted WordPress form on cheap shared hosting does not meet that bar.
The compliance budget in 2026
| Item | Budget option | Recommended option | Frequency |
|---|---|---|---|
| GDPR and cookie audit of the site | 500 EUR | 1,000 EUR with report and action plan | once |
| Consent management platform (CMP) | 0 EUR (open source, e.g. Klaro) | 10 to 30 EUR per month (Cookiebot, Didomi, Usercentrics) | monthly |
| Encrypted form and secure EU hosting | 1,500 EUR | 3,000 EUR with secure patient area | once |
| Secure hosting for site or module | 30 to 60 EUR per month | 80 to 150 EUR per month | monthly |
| Privacy-friendly analytics | 0 EUR (self-hosted Matomo) | 9 to 19 EUR per month (EU hosted tool) | monthly |
| Privacy policy and record updates | 300 EUR | 600 EUR | yearly |
A common way to cut the bill is to stop collecting health data on the website: the form only takes the appointment request (name, phone, slot) and the referral goes through the practice management software already in use (Cliniko, Jane, Physitrack), which provides secure upload. Total cost then drops to around 1,000 to 1,500 EUR.
On analytics, cookieless or self-hosted tools such as Matomo configured without cross-site tracking reduce the consent burden. Note that Irish guidance is stricter than France's: the DPC does not formally exempt analytics cookies, so a consent banner remains advisable even with Matomo, but a lighter one.
Compliance timeline
| Week | Action | Deliverable |
|---|---|---|
| 1 | Technical audit: cookie scan, forms, transfers outside the EU | gap report |
| 2 | CMP install, prior blocking of trackers | compliant banner |
| 2 to 3 | Replace Google Analytics with Matomo | privacy-friendly analytics |
| 3 to 5 | Rebuild the form, secure hosting or redirect to booking software | compliant form |
| 5 | Privacy policy, legal notice, record of processing | published documents |
| 6 | Final check and evidence capture | compliance file |
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Aoife, owner of a 6-clinician physiotherapy practice in Dublin, turns over 620,000 EUR a year. Her site loads Google Analytics and an embedded Google Map without consent, and about 40 patients a month send GP letters through the contact form, landing in a shared inbox. The 900 EUR audit prices two scenarios. Scenario A: encrypted form and secure EU hosting, 2,800 EUR plus 70 EUR per month. Scenario B: remove letter upload, redirect to the booking software already in use, Matomo and an open source CMP, 1,100 EUR to implement and 0 EUR per month. Aoife picks scenario B: 2,000 EUR in total in year one, against a theoretical maximum fine of 24,800 EUR (4% of turnover) and the risk of a public DPC decision.
FAQ
Does the DPC really check small healthcare websites?
Yes, the DPC has run cookie sweeps across sectors and handles complaints from patients. Most cases end with a request to fix the site within 1 to 3 months, but fines are possible for health data breaches.
Is Google Analytics banned on a practice website?
No, but it must stay blocked until explicit consent. A self-hosted tool like Matomo reduces data transfers and simplifies the banner.
Is special health data hosting mandatory in Ireland?
There is no HDS-style certification, but Article 32 requires security matched to the risk. For referral letters, that means encryption, EU hosting and a signed processing agreement.
How much does a consent platform cost?
From 0 EUR for an open source tool to 10 to 30 EUR per month for a commercial CMP with consent logs and a dashboard.
How long does compliance take?
Count on 4 to 6 weeks for a 6-clinician practice, including 1 week of audit. The cookie part alone can be fixed in 5 business days.
Let's scope your project. We audit your practice website and fix cookies, forms and health data hosting, for 1,000 to 4,000 EUR depending on the scenario, in 4 to 6 weeks. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
