What Patient Data Should a Clinic Website Actually Collect?

Most Philippine clinic websites collect too much. Long intake forms sitting on a public page, gathering medical history from someone who has not yet confirmed an appointment, create obligations the clinic did not intend and cost bookings they would otherwise have had.

The principle in the Data Privacy Act is called purpose limitation: collect only what you need for the purpose you stated. This is one of the rare cases where the compliant choice and the commercially better choice are the same choice.

What is the minimum an appointment request needs?

For most clinics, four fields.

Name. So you know who is coming.

One contact method. Mobile number or email, whichever you will actually use to confirm.

Preferred date or time. So scheduling has something to work with.

Service or department. General enough to route the booking, specific enough to allocate the right slot.

That is a bookable request. Everything beyond it is collected because a form template had the field, not because the clinic needed it before confirming a slot.

What should you not collect on a public form?

The last row is worth dwelling on. Many clinic web forms are digitised paper intake sheets, and paper forms accumulated fields over decades for reasons nobody remembers. Digitising them moves that accumulation onto a public website, where the exposure is far higher than a folder in a locked cabinet.

Why does collecting less convert better?

Every field is a chance to abandon. That is true of all forms, and it is amplified when the fields are personal.

A patient deciding whether to book is weighing effort and risk. A four-field form asking for a name, a number, a date, and a service reads as a request. A twenty-field form asking for medical history, ID numbers, and insurance details reads as a commitment, and it arrives before the clinic has earned any trust.

There is a second effect specific to healthcare. Patients are cautious about typing health details into an unfamiliar website. A short form signals proportion. A long one signals a practice that has not thought about what it is asking for, which is precisely the impression a clinic handling sensitive data should avoid.

When should you collect the detailed information?

After the appointment is confirmed, and ideally through a channel more controlled than a public web form.

Three workable patterns:

At the clinic. The traditional approach, and still appropriate for many practices. The information is collected in a controlled environment with staff available to clarify.

Through a secure link after confirmation. The patient receives a link to complete intake before arriving. This keeps the public form short while still saving time on the day, and the link can be time-limited and tied to a specific booking.

Through a patient portal. Appropriate for practices with ongoing relationships and repeat visits, though it carries authentication and access-control obligations that a simple form does not.

The sequencing principle is consistent: confirm the appointment on minimal data, then collect what care requires once there is an actual booking to attach it to.

How do you decide whether a new field is justified?

Forms grow. Someone asks for one more piece of information, it seems harmless, and two years later the form is back to eighteen fields. A simple test prevents most of that drift.

Ask three questions before adding any field.

What decision does this change? If knowing the answer would not alter how you schedule, route, or prepare for the appointment, it is not needed at request stage. "It is useful to have" is not a decision.

Who will actually read it? Fields nobody looks at before the visit are pure liability. It is worth asking staff directly which parts of the current form they use, and the answers are often uncomfortable.

Could it wait until after confirmation? This is the question that resolves most cases, because the honest answer is usually yes.

A fourth question applies to anything health-related: does collecting this move the submission into sensitive personal information? If the form was previously handling only contact details, one new field asking about symptoms changes the obligations attached to every submission.

Give one person the authority to approve form changes and the drift largely stops. Without that, forms accumulate fields the way paper intake sheets did, one reasonable request at a time.

What about forms that route to email?

This is the most common technical failure in Philippine clinic websites, and it is worse than most clinics realise.

A form that emails submissions to a shared clinic inbox means sensitive patient information sitting indefinitely in an email account, often accessible to several staff members, with no access log, no retention rule, and frequently no password discipline. Email is also not designed for the confidentiality this data deserves.

Better arrangements, in rough order of effort:

Restrict who can access the inbox and use individual accounts rather than a shared login.

Route submissions into a system with access controls, so who viewed what is recorded.

Apply a retention rule. Enquiries that did not become appointments should not live forever.

Do not email the sensitive fields at all. If the form collects anything beyond the minimum, the notification can say a submission exists without repeating its contents.

How long should you keep enquiry data?

Distinguish two categories, because they follow different rules.

Clinical records are subject to professional and regulatory retention requirements that operate independently of the website. Those are not yours to shorten on convenience grounds.

Website enquiries that never became appointments are a different matter. Someone who submitted a form and never attended has no clinical record with you, and keeping their health-related enquiry indefinitely is hard to justify against purpose limitation.

Set an explicit period for that second category, write it in your privacy notice, and make sure someone can actually enforce it. A retention policy nobody executes is documentation rather than compliance.

What do you do about the data you have already collected?

Most clinics fixing their form discover a second problem behind it: years of submissions already sitting somewhere. Cleaning that up matters more than the form change, because the exposure is already real.

Find where it lives. Usually more places than expected: the clinic inbox, individual staff inboxes who were copied, a spreadsheet someone exported, a messaging app thread, and possibly the website database itself.

Separate enquiries from patients. Submissions that became appointments have a clinical record and follow professional retention rules. Submissions that never became appointments generally do not, and are the clearest candidates for deletion.

Delete what has no justification. Enquiries from several years ago that never became patients are hard to defend keeping under purpose limitation.

Reduce access. If five staff can open an inbox full of health information because it was easier than managing accounts, that is worth fixing regardless of anything else.

Write down what you decided. A short note recording what you keep, for how long, and why, turns an ad hoc cleanup into a policy you can actually apply next year.

This is unglamorous work and it is usually the highest-value hour a clinic spends on data protection, because it addresses information you are already holding rather than information you might collect later.

Does collecting less weaken your records?

This is the objection clinics raise, and it deserves a straight answer: no, provided the sequencing is right.

Nothing here suggests treating patients on thin information. It suggests that the moment of collection should be after a booking exists, not before. The clinical record ends up the same or better, because information gathered at or near the visit, with staff able to clarify, is generally more accurate than details typed hurriedly into a public form by someone who has not decided whether to attend.

There is also a data-quality argument. Long public forms produce guesses. A patient unsure of a medication name will approximate it. Collected properly in a clinical context, the same field is reliable. Shorter public forms tend to improve record quality rather than degrade it.

Does this change for teleconsultation?

It raises the stakes, because the consultation itself happens through the channel.

You may be collecting more before the appointment, since a remote clinician cannot examine the patient. That is a legitimate reason to ask for more, but it should still happen after the booking is confirmed rather than on a public form, and the platform used becomes part of your data-processing chain.

Recordings deserve a specific decision. If consultations are recorded, that is sensitive personal information with a retention question attached, and the patient should know before the session rather than discovering it afterwards.

What should the form actually say about the data?

One or two plain sentences at the point of collection, not a link to a policy nobody opens.

Something to the effect of: these details are used to process your appointment request and contact you about this booking; they are kept for a stated period; they are not shared outside the clinic except where required to provide care.

That single sentence does most of the work of informed consent, and it takes a patient five seconds. The full privacy notice remains available for anyone who wants the detail. How to structure the consent itself is covered in Data Privacy Act consent for clinic websites.

What should you audit on your own form today?

Open it and go field by field with one question: what would break if this field did not exist until after the appointment was confirmed?

For most fields on most clinic forms, the honest answer is nothing. Those are the fields to move or remove. Then check where submissions land, who can read them, and how long they stay there.

Do this with a staff member who handles bookings rather than alone. They will tell you within minutes which fields they actually use and which have been ignored for years, and that conversation is usually more revealing than any policy review.

A clinic that cuts its public form from eighteen fields to five typically sees fewer abandoned bookings and simultaneously reduces its exposure. There are not many changes that improve both sides at once.

Run the same audit on every other form on the site, not just the appointment one. Contact forms, callback requests, newsletter signups, and embedded chat widgets each collect something, and clinics routinely fix the main form while leaving three others untouched.

What should you do next?

Count the fields on your appointment form. If there are more than six, you are almost certainly collecting ahead of purpose. Cut to the minimum needed to hold a slot, move the rest to a post-confirmation step, and fix where the submissions are stored.

For the wider obligations see Data Privacy Act compliance for healthcare websites, and for the patient-experience side see building patient trust before the first visit. If you want your forms reviewed, book a call.

A shorter form is also easier to maintain. Fewer fields mean fewer places for the privacy notice to fall out of step with what the clinic actually does.

This is general information rather than legal advice. For obligations specific to your practice, consult a Philippine data privacy practitioner or the National Privacy Commission.