Websites for New Zealand clinics: bookings, privacy, and earning trust before the first visit

What is a clinic website actually for?

It is for the person sitting on the couch at 9pm with a sore back, deciding whether to do something about it. They are not comparing your philosophy of care with the clinic down the road. They want to know if you can see them this week, roughly what it will cost, and whether they will feel like an idiot walking in.

That person will not ring you. The phone is closed, and ringing a stranger about your body is worse than waiting. If the site cannot take the booking, you lose them to whoever can.

Should you let people book online, or keep it to the phone?

Online, if you can — but only if it shows real availability. A form that says "we will be in touch to confirm a time" is a phone call with extra steps, and patients read it as one.

The honest exception is triage. If you genuinely need to assess urgency or complexity before allocating a slot — some GP practices, some specialist work — then say so on the page and give a fast, specific alternative. "Ring us and we will find you a time today" is fine. Silence is not.

• Show actual free slots. Pulled from the same calendar your front desk uses. Two systems means double-booking, and double-booking costs you more goodwill than online booking ever earns.
• Let new patients book, not only returning ones. Plenty of clinics hide online booking behind an existing patient login, which locks out the exact person who was hardest to reach.
• Ask for the minimum. Name, contact, appointment type. Every extra field loses people, and health details do not belong in a booking form anyway.
• Confirm immediately, then remind. An instant confirmation and a reminder the day before. Reminders are the cheapest way to cut no-shows, and no-shows are the real cost of a busy book.

What do you have to get right about privacy?

Health information is the most tightly held category of personal information in New Zealand. The Privacy Act 2020 sets the baseline and the Health Information Privacy Code sits on top of it for anyone providing health services. It applies to your website the same as it applies to your filing cabinet.

The practical version for a clinic site is short, and most breaches here are ordinary carelessness rather than anything exotic.

• Do not collect symptoms in a web form. A general contact form usually emails plain text to a shared inbox and sits there for years. That is not a reasonable place for someone’s health information. Take the booking, discuss the problem in the room.
• Know where your booking data lives. Most platforms store it offshore. That is allowed, but you are accountable for it, so read the terms and be able to answer the question when a patient asks.
• Have a privacy statement a patient could actually read. What you collect, why, who sees it, how long you keep it, and how they get a copy. They have a right to ask, and it is your job to make that possible.
• Be careful what your analytics sees. A page URL like /conditions/pregnancy sent to an ad platform, tied to someone’s device, is a disclosure you did not mean to make. Check what your tracking is picking up.

How do you earn trust before someone walks in?

By being specific about the things a first-time patient is quietly worried about. Most clinic sites are warm and say nothing. The reassurance is in the detail.

Put your practitioners on the page as people — a real photo, where they trained, their registration, what they are actually interested in treating. "Our friendly team" reassures nobody.

• Publish your prices. The standard consult, the follow-up, the surcharge. Patients assume the worst when there is no number, and the clinics that publish get the calls from people who have already accepted the cost.
• Say where you stand on ACC and subsidies. Whether you are an ACC provider, what the surcharge is, what a patient pays on the day. This is the single most common question for physio, dental and GP practices, and it is usually answered nowhere on the site.
• Show registration, plainly. Board registration, professional body membership, APC. It costs a line of text and it settles the question of whether you are legitimate.
• Describe the first appointment. How long, what to wear, what to bring, what will happen. This is the fear you can actually remove, and almost nobody does it.

The quickest way to find your clinic’s real problem is to watch one person try to book on their phone without helping them. You will learn more in five minutes than from any audit, and it is usually the booking step that breaks rather than the design. If that step is the bottleneck, the system will not show real availability, or it cannot talk to your practice management software: that is a build problem rather than a design one, and it is the kind of web application work we do.