UK GDPR Article 9 Health Data for Healthcare Websites

Health data means personal data related to a person's physical or mental health that reveals information about their health status.

The ICO also makes clear that health information can include information collected when someone registers for healthcare or receives treatment. Health data can also arise through information that creates an inference about someone's health.

For a healthcare website, that means the assessment should focus on what the information reveals, why you collect it, and how you use it.

Common examples include:

A free-text field can require particular attention because the user may enter considerably more information than the form designer expected.

Not every piece of information collected by a healthcare website automatically becomes health data.

A person's name alone is not automatically special category data. A generic enquiry may also remain ordinary personal data if its content does not reveal information about the person's health.

Context matters. The ICO explains that inferred information can become special category data where processing intentionally makes an inference about health or treats someone differently because of that inference.

During healthcare implementations, we therefore recommend mapping individual fields rather than classifying an entire website as either sensitive or non-sensitive.

Article 6 addresses the general lawful basis for processing personal data.

Depending on the circumstances, an organisation may consider bases such as consent, contract, legal obligation, vital interests, public task, or legitimate interests.

The appropriate basis depends on the actual purpose and circumstances of the processing.

Article 9 introduces an additional requirement when you process special category data.

The ICO states that organisations must identify both an Article 6 lawful basis and an Article 9 condition before processing special category data. The Article 9 condition does not replace the Article 6 basis.

A practical website assessment should follow this sequence:

For NHS teams, this distinction matters because website requirements should connect with the organisation's wider information governance framework.

For a broader overview, see our UK GDPR compliance for healthcare websites.

Article 9 contains 10 conditions for processing special category data. Healthcare websites should not select a condition simply because it sounds relevant to healthcare.

The condition must match the actual purpose and circumstances of the processing.

Explicit consent is one possible Article 9 condition.

However, ordinary consent to submit a website form does not automatically establish explicit consent for special category processing.

The ICO distinguishes explicit consent from a general affirmative action. Where you rely on explicit consent, the consent must meet the applicable requirements and clearly address the processing concerned.

Healthcare organisations should therefore avoid adding a generic checkbox simply because health information appears on a form.

The better approach is to identify the processing purpose first, then determine whether explicit consent is genuinely the appropriate condition.

Article 9(2)(h) is particularly important for healthcare organisations.

It covers specified purposes including preventive or occupational medicine, medical diagnosis, provision of health or social care or treatment, and management of health or social care systems and services. Relevant UK-law safeguards also apply.

However, Article 9(2)(h) is not itself an Article 6 lawful basis.

You still need an appropriate Article 6 basis, and the Article 9 condition must satisfy its own requirements.

NHS England examples demonstrate this two-layer approach, with Article 6 and Article 9(2)(h) identified separately for relevant health-data processing.

Article 9(2)(i) concerns specified public health purposes.

It should not be treated as a general alternative for routine healthcare website processing. The purpose must genuinely fall within the relevant public health condition and associated legal requirements.

For an NHS website, this distinction becomes particularly important where information moves beyond direct patient service delivery into public health functions.

Other conditions can apply in specific circumstances, including substantial public interest, legal claims, vital interests, and research, archiving, or statistical purposes.

The ICO identifies 10 Article 9 conditions overall. Five require additional conditions and safeguards under UK law, including relevant provisions in Schedule 1 of the Data Protection Act 2018.

The practical lesson is simple: document why the selected condition applies rather than treating Article 9 as a single healthcare exemption.

Appointment information can reveal something about an individual's health depending on the service and context.

A booking request for a general administrative appointment may require a different assessment from a request that identifies a specific condition or treatment.

Limit the fields to information genuinely needed for the stated purpose. Avoid collecting detailed clinical information simply because the form technically allows it.

Contact forms become more sensitive when they invite users to submit:

A generic message box can therefore create a significant difference between the intended data flow and the actual data collected.

Patient registration can involve identity information alongside information concerning health, treatment, or healthcare needs.

The website architecture should distinguish registration data from unnecessary clinical information and establish where each category goes after submission.

A patient portal is materially different from a public information website because authenticated functionality can expose records, appointments, messages, prescriptions, or other sensitive information.

Access controls, authentication, session management, audit requirements, and integration boundaries should therefore form part of the compliance assessment.

Telehealth journeys can move a website from simple lead generation into direct healthcare service delivery.

Once information supports clinical assessment, diagnosis, treatment, or healthcare management, the organisation should assess the relevant Article 9 condition and wider governance requirements as part of the service design.

Analytics requires careful assessment rather than blanket assumptions.

Consider what URLs, events, form interactions, referrers, page paths, and other signals may reveal about a visitor's health. The assessment should cover the actual configuration, purpose, data flow, recipient, and processing relationship.

Based on our healthcare IT experience, website analytics should be reviewed as part of the wider information flow rather than treated as an isolated marketing decision.

Ask what the processing actually enables.

For example:

The ICO explains that necessity requires more than usefulness or established business practice. Processing should be targeted and proportionate to the purpose.

Article 9(2)(h) has additional safeguards concerning professional secrecy and confidentiality.

A healthcare organisation should therefore consider who processes the information, under whose responsibility the processing occurs, and what legal or professional confidentiality obligations apply.

Article 9(2)(h) should never be treated as a universal healthcare exception.

Some Article 9 conditions require an associated condition in Schedule 1 of the Data Protection Act 2018.

The ICO specifically identifies additional UK-law requirements for conditions including Article 9(2)(h), (i), and (j).

That means the compliance record should show more than "Article 9(2)(h) applies". It should identify the relevant UK-law condition and applicable safeguards.

A website compliance record should connect legal decisions to actual technical implementation.

At minimum, document:

The ICO recommends documenting the Article 9 condition before processing begins and considering DPIA requirements where processing is likely to create high risk.

For NHS-facing projects, website architecture should also align with the organisation's wider information governance requirements. The website should not become a separate compliance process maintained only by the marketing or digital team.

At Qrolic Health, we approach this as a website architecture issue as well as a governance issue. Forms, authentication, integrations, analytics, and third-party services all need to be considered within the same data-flow assessment.

For organisations planning a wider NHS-facing build, our NHS compliant website design and development service provides the implementation context for these requirements.

Consent does not automatically establish the correct Article 6 lawful basis or Article 9 condition.

The processing purpose must determine which legal route is appropriate.

Being a healthcare organisation does not automatically make every processing activity fall under Article 9(2)(h).

Purpose, necessity, applicable UK-law requirements, and safeguards still matter.

A person visiting a healthcare website is not automatically submitting health data.

Assess what the organisation actually collects and what the information reveals.

Free-text fields can collect detailed health information even when the surrounding form appears administrative.

Where clinical information is not required, consider whether the field should be restricted, removed, or redesigned.

Privacy information should reflect the actual processing architecture.

If developers add fields, integrations, tracking, or data transfers late in a project, the privacy documentation may no longer accurately describe the website.

Use this checklist before launching or materially changing a healthcare website:

A useful implementation test is to trace one piece of submitted information from the website form through storage, integrations, staff access, retention, and deletion.

If the team cannot clearly explain that journey, the governance documentation may not reflect the actual system.

A review is particularly useful when your organisation:

A redesign is often the right point to reassess these decisions because the data flow is already being reconsidered.

UK GDPR Article 9 health data requirements become much easier to manage when you treat them as part of website architecture rather than as wording added to a privacy policy.

The central distinction is critical. Article 6 provides the general lawful basis, while Article 9 adds a separate condition when your website processes special category health data. Some Article 9 conditions also require additional safeguards under the Data Protection Act 2018.

For NHS and private healthcare teams, the practical task is to connect each form, patient journey, integration, analytics service, and data flow to the correct governance decision.

That approach helps your digital team build requirements into the website before launch, rather than discovering gaps after implementation.