Under Article 9 GDPR, health data is a special category of personal data. Processing it is prohibited unless it falls under one of the explicitly listed exceptions. For a clinic, this is the most sensitive part of all its marketing.
Why treatment and marketing are separate
A clinic may process health data to provide healthcare, relying on Article 9(2)(h) GDPR. The Czech Office for Personal Data Protection (ÚOOÚ), however, explicitly states that this exception doesn’t cover marketing. For advertising, a clinic therefore needs a different legal basis than for its patient records.
The exception that allows health data to be processed for treatment doesn’t extend to marketing.
Patient databases don’t belong in ad platforms
Uploading a patient list to Meta or Google to build a custom or lookalike audience means processing health data for marketing. Without explicit consent from every patient, the clinic has no legal basis for it. The mere fact that someone is a patient of a specific practice says something about their health.
Tracking code on a procedure page
An ad pixel on the page of a specific procedure tells a third party that this person viewed it. For some procedures, a health condition can be inferred from that. That’s why we don’t put tracking codes into booking and patient-record systems, and we record conversions without linking them to a specific procedure.
The booking form
Once a patient selects a procedure in a form, the form may be collecting health data. It needs separate information about the processing, and the data should stay in the EU or with a processor that guarantees adequate protection.
The contract with an agency
An agency that works with data for a clinic is a processor. Under Article 28 GDPR, the clinic must have a data processing agreement with it. Fines for breaching GDPR can reach EUR 20 million or 4% of worldwide annual turnover.
This article is based on GDPR and ÚOOÚ guidance on healthcare. It does not replace a legal assessment of a specific processing operation.