A healthcare website planning checklist

What Australian healthcare marketing teams should settle before a website build: audiences, claims, approvals, testimonials, forms, privacy and ownership.

Written by: Matthew Bishop
Published: 9 October 2026
Reading time: 6 minutes

Plan a healthcare website by settling the hard questions before anyone designs a page: who it’s for, which journey each audience takes, which advertising rules apply to that journey, who approves the wording, and where enquiry data goes. They shape the design, so they can’t wait until launch week.

This isn’t legal or regulatory advice. Claims, testimonials and privacy settings go through your own compliance and privacy advisers, and no website can promise compliance. A good plan just makes their review quicker.

1. Name every audience

A healthcare site usually speaks to patients, families, clinicians and referrers. Write down each one’s question and the action you want them to take.

Smileyscope, which makes a medical-grade VR headset, has a demanding mix: clinicians weighing the evidence, hospital administrators who hold the budget, and the patients and parents in the room (Smileyscope case study).

2. Separate clinic journeys from device journeys

Clinics and telehealth services work under different rules from medical device companies, and their journeys differ. Plan them separately, even when one business has both.

	Clinic or telehealth service	Medical device
Main rules	AHPRA’s guidelines for advertising a regulated health service	The TGA’s Therapeutic Goods Advertising Code
Typical journey	Questions, enquiry, screening or appointment, ongoing care	Evidence, pricing, enquiry, a purchasing decision
What the site describes	The service, not outcomes	The device and the evidence behind it

AHPRA’s guidelines cover practitioners and businesses advertising a regulated health service (AHPRA). The TGA’s Code covers therapeutic goods advertised to the public, and some, such as prescription-only medicines, can’t be advertised to the public at all. The TGA doesn’t regulate health services, but a service’s advertising that promotes therapeutic goods must follow its rules (TGA).

Econohealth, an Australian telehealth clinic, has a four-step journey: an enquiry form, a free screening call with an AHPRA-registered nurse, a phone consultation with an AHPRA-registered doctor, then ongoing care (Econohealth case study).

3. Reference every clinical claim

List every claim, with its evidence, before design starts: AHPRA expects advertisers to substantiate their claims, and the TGA expects a citation wherever a claim rests on research (AHPRA, TGA).

Design each claim and its reference as one unit. On Smileyscope’s site, every statistic carries a footnoted citation to the study behind it, kept in even where space is tight.

Why customers trust Smileyscope: three statistics, each footnoted to its study

Smileyscope’s statistics, designed with their citations in place.

4. Agree the review and approval workflow

AHPRA says advertisers are responsible for their advertising, including content others produce for them (AHPRA). So decide before the build:

Who drafts the copy, and who checks claims, testimonials and disclaimers.
Which pages your compliance advisers sign off, and in what order.
Where they review: we use a staging site, so advisers read the real pages before they go live.
Who re-reviews a page when its wording changes after launch.

Fresh Clinics’ compliance wording is written to work across every state (Fresh Clinics case study).

5. Decide where testimonials can go

Testimonials about clinical outcomes are off the table for regulated health services, and a review shown on or linked from your page counts as your advertising (AHPRA, TGA).

So plan pages that work without patient stories, and decide early about review widgets and social feeds. Clinical case studies need your advisers’ view too. Smileyscope’s follow one format, from the challenge to the impact, and are anonymised by organisation type because hospitals often can’t get approval to be named.

6. Write patient information in plain language

Patients aren’t experts, and for therapeutic goods the TGA asks for scientific terms consumers easily understand. Econohealth’s home page calls the clinic brand agnostic, and because not every patient knows the term, one line underneath explains it. Its benefits describe the service, such as personalised care and clear pricing, rather than outcomes, and 19 FAQs answer the rest.

Fresh Clinics names no medicines and makes no claims about treatments. Its brief also ruled out stock photography, so the images are of Fresh’s own nurses, doctors and events.

Group pages by what each audience is looking for. Smileyscope’s 20+ paediatric specialities sit in seven departments a clinician can open to find their own area. Decide, too, where any content for health professionals only will live.

Serving more than one country? Smileyscope and Fresh Clinics each run Australian and US versions from one Webflow site, with search engines told which version to show (one site or regional sites). Plan structure and SEO together.

8. Design forms around the minimum

Health information is sensitive information under the Privacy Act, whatever the provider’s size: collect only what you need, with consent and a notice at the point of collection (OAIC).

For a website, that usually means:

enquiry forms that ask for contact details and the reason for getting in touch, not symptoms or history
clinical intake in the clinic’s own systems
no assumption that sensitive information can go into your CRM: ask your privacy advisers first
a privacy notice beside every form

Econohealth’s contact form goes straight to the clinic’s inbox, every Get Started button leads into its own intake form, and consultations book through its existing booking system. Smileyscope’s forms connect to HubSpot, with spam protection.

“Thanks again for all your amazing work on the website: we’ve had some excellent feedback already, plus 4x ‘Contact Us’ enquiries that have led directly to sales. That’s pretty rare in the healthcare space…”

Dr Evelyn Chan, President and Founder, Smileyscope

9. Review privacy, cookies and pixels

Pixels can collect health information without a form. The OAIC notes that a visit alone can reveal sensitive information, suggests it may be better to avoid third-party pixels there, and holds the organisation that deploys a pixel responsible (OAIC).

List every script and pixel with what it collects, and have your privacy advisers review the privacy policy and cookie consent against it. Fresh Clinics’ cookie consent was set up with its privacy advisers. Econohealth published a privacy policy for its LegitScript certification, and the seal went into the footer once it came through. Smileyscope has a privacy policy for each country, under its own law.

10. Decide who owns the content after launch

Give every page an owner and a review date, so claims are re-checked when evidence or rules change, and make sure that owner can edit it: Smileyscope’s team adds new clinical case studies from the CMS, and Fresh Clinics’ designer builds pages herself after training (publishing pages without a developer).

Questions we get asked

Can a healthcare website use patient testimonials?

Usually not for clinical aspects. AHPRA’s guidelines prohibit testimonials about symptoms, diagnosis, treatment or outcomes in advertising a regulated health service, though comments only about customer service aren’t testimonials. The TGA has separate rules for therapeutic goods.

Do the TGA’s advertising rules apply to a clinic website?

They can. The TGA doesn’t regulate the promotion of health services, but if a clinic’s advertising also promotes therapeutic goods, those goods’ rules apply, and some, such as prescription-only medicines, can’t be advertised to the public.

Can enquiry form data go into our CRM?

Contact details often can, but don’t assume sensitive health information can. The OAIC treats health information as sensitive, needing consent and collection limited to what’s reasonably necessary. Keep forms minimal and have your privacy advisers approve the setup.

Who is responsible for compliance on our website?

You are, as the advertiser. AHPRA says advertisers are responsible for their advertising, including content others produce for them. We build around the rules, but we’re not your regulatory advisers: claims go through your compliance team.

If you’re planning a healthcare site, our healthcare page shows how we work, and our website design service covers the build. When you’re ready, tell us where you are.