Health advertising and GDPR on your dental clinic's website (Catalonia)
Your website is health advertising whether you feel it or not. There's a 1996 rule almost no clinic follows — and not following it costs up to €601,012.
Your website is health advertising whether you feel it or not: you're advertising health services to the public, and that has its own legal framework that almost nobody in the sector follows — not out of bad faith, but because nobody has explained it. This post is that explanation, with numbers, written for a dental clinic's website in Catalonia.
the framework in four numbers
1996
RD 1907/1996 is still in force
€601,012
maximum fine (very serious)
3,675
authorised clinics in Catalonia
1
data required in your advertising
The rule almost nobody follows
Royal Decree 1907/1996, on advertising with a claimed health purpose, says in its article 6 that authorised health centres may advertise, but their advertising must stay within the content of their authorisation AND state the registration number granted by the health authority. In Catalonia, that authority is the Generalitat and that number comes from the Registre de centres sanitaris — the same register behind the 3,675 authorised clinics in the territory today.
In plain words: if your clinic's website doesn't show its registration number, it's breaking a 1996 rule still in force. It's not a bureaucratic detail: it's the first thing an inspector checks when someone complains about your advertising.
And the two rules that follow
First: advertising that goes beyond your authorisation requires prior approval (art. 6.2). Second: article 4 bans advertising treatments for transmissible diseases, cancer, diabetes, insomnia and others — watch out for promises like «guaranteed results in one session»: medical guarantees can't be promised in health advertising, and certainly not without authorisation.
The fines, with numbers
The General Health Act 14/1986 classifies offences in three tiers: minor, up to €3,005; serious, up to €15,025; and very serious, up to €601,012. This isn't a theoretical risk: regional authorities actively inspect health advertising, and a complaint from a competitor — in a sector with 3,675 clinics in Catalonia — is more common than it seems.
GDPR: the other half
Health data is a special category (Article 9 GDPR): consent must be explicit, not presumed. In practice, for a clinic's website this means: if your contact form asks for the reason for the visit, you're already processing health data — you need ticked consent and a privacy policy that says so. Cookies are governed by the AEPD guide (no trackers, no consent to manage). And WhatsApp with patients: sending health data through channels without guarantees is a decision that must be thought through, documented and explained to the patient.
The checklist for your clinic's website:
Registration number visible — on the website and all advertising (footer, at minimum).
Advertising within your authorisation — only services and treatments you're authorised for.
No medical guarantees — «guaranteed results» aren't promised; they're proven with cases.
Forms that ask the minimum — and explicit consent if they ask for the reason of the visit.
Privacy policy covering health data — naming the special category and the consent.
Cookies per the AEPD — the cleanest option: zero trackers, zero banners.
The rules aren't paperwork: they're the difference between a complaint being archived and costing you €15,000. And it's fixed in an afternoon — once someone explains it.
What I do
Every clinic website that leaves the studio carries this by default: legal notice identifying the centre, registration number where it belongs, forms that ask the minimum, a privacy policy that names health data, and zero trackers — the website doesn't spy on anyone, and that's also marketing: «your website doesn't spy on your patients» can be said out loud.
Still have a question?
Write to me and I answer you myself. Gerard — Barcelona, reply within 24 hours.