Online Booking on Your Website: Tools, GDPR and the Special Rules for Medical Practices

An online booking feature looks like something you drop in, like a contact form. In reality it's data processing by a third party — with every obligation that comes with it.

For a hair salon or a trade business, that's quite manageable. For a medical practice a different legal regime applies, and overlooking it risks more than a warning letter.

This article covers the rules in Germany and the wider EU under the GDPR. I'm a developer, not a lawyer or data protection officer; it describes what matters when integrating a booking tool. For practices and other health professions, the actual setup should be agreed with a data protection officer.

Do you need online booking at all?

It sounds obvious, but the question often saves a lot of effort.

It pays off if you hand out many short, uniform appointments. Hairdressing, beauty, physiotherapy, consultations with a fixed format. Bookings take real pressure off the phone — especially outside opening hours, when nobody picks up.

It pays off less if every job is individual. A tiler who needs to see the work before naming a date gains little from a calendar. A good enquiry form is often the better choice there. What belongs on a trade business's site is covered separately.

It doesn't pay off if you rarely give out appointments or constantly make exceptions. Then you maintain two calendars, and the online one is never right.

A salon isn't a medical practice

This is the decisive difference, and it's often missed.

A hair appointment involves a name, contact details and a time. That's personal data, and the GDPR applies — but within normal limits.

A medical practice is different. The mere fact that someone books with a cardiologist or a psychotherapist is health data. Under Article 9 GDPR, health data belongs to the special categories with the highest protection. Processing it is prohibited in principle and allowed only under strict conditions.

For online appointments in the health professions, Germany's Data Protection Conference — the joint body of the German supervisory authorities — published a position paper on 16 June 2025. Its key points:

• Using an external booking service is permissible as data processing on behalf of the practice under Article 28 GDPR — provided the practice stays in control.
• A separate consent from patients merely for bringing in the service provider is then not required.
• Only data needed for the specific appointment may be processed.

The supervisory authorities have also announced closer scrutiny of practices. Anyone running a practice website with bookings should take that seriously.

Three obligations that always apply

Salon or practice — these three belong to every booking feature.

1. A data processing agreement. Under Article 28 GDPR it's mandatory, not optional. Reputable providers supply one as standard, often to accept in your account. If it isn't provided automatically, you have to request it. In practice this step is skipped surprisingly often.

2. An entry in your privacy policy. The booking service must be named, along with the data processed, how long it's kept and the rights of the people concerned. What else belongs there is covered in the article on Impressum and GDPR.

3. Loading only after consent. Many booking widgets set cookies or pull content from the provider's server as soon as the page opens. In that case the widget may only load after consent in the cookie banner. Some providers solve this with a "book an appointment" button that loads the widget only on click.

On top of that: optional services need their own consent. Appointment reminders by SMS or email aren't necessary for the appointment itself. If you offer them, you must obtain and document consent separately.

Which tool for whom

The choice depends less on features than on your sector.

The list is neither complete nor an endorsement of individual providers. Terms and features change — check each provider's current position, especially server location and data processing agreement.

For medical practices, choosing a specialised provider is effectively the only sensible route. These services are built for the demands of health data; general schedulers aren't.

Why Calendly is out for medical practices

Calendly is widespread, well made and sensible for many purposes. For a medical practice it's still the wrong choice.

Calendly is certified under the EU-US Data Privacy Framework but stores data on servers in the United States. GDPR compliance doesn't follow automatically from that. According to available information, Calendly offers EU hosting only on Enterprise plans.

For a consultant handing out introductory calls, that can be defensible with a proper data processing agreement and a correct privacy policy. For health data, a provider with EU servers built for the health professions is the far safer choice.

Embed or link

Two technical routes with different consequences.

Embed: the booking form appears directly on your page. It looks seamless, but loads the provider's content on your page — meaning consent must come first if cookies are set in the process.

Link: a button takes the visitor to the provider's booking page. They leave your site briefly, but nothing third-party loads on your page. That's simpler from a data protection standpoint.

For most small businesses the link is the more pragmatic route. Embedding pays off when booking is central to the site and consent is implemented properly.

What it costs

Booking services almost always run as a monthly subscription, tiered by scope, number of staff or features. Specialised practice solutions usually cost more than general schedulers.

Then there's the one-off integration into the website. A link takes little effort. A clean embed with properly implemented consent takes more time.

How a website's overall costs break down is in the price breakdown.

If you're building your site with a builder, check beforehand whether the booking tool you want can be integrated there at all. The limits of builders are set out in the comparison with a developed site.

Frequently asked questions

Do I need a data processing agreement for a booking tool? Yes. Under Article 28 GDPR it's mandatory for any service that processes personal data on your behalf. Reputable providers supply one — if it isn't provided automatically, request it.

Can I use Calendly for my medical practice? It's not advisable. A booking with a practice can itself be health data under Article 9 GDPR. Calendly stores data on US servers and isn't built for the health professions. Specialised providers with EU servers are the safer choice.

Do patients have to consent to the booking service? According to the German Data Protection Conference's position paper of 16 June 2025, a separate consent merely for bringing in the service provider isn't needed if the practice stays in control and meets its information duties. That doesn't apply to optional services like reminders.

Do SMS reminders need consent? Yes. Reminders aren't necessary for the appointment itself. If you offer them, you must obtain and document consent separately.

Does the booking widget have to appear in the cookie banner? If it sets cookies or loads content from the provider when the page opens, yes. It may then only load after consent. Linking to the provider's booking page sidesteps the issue.

Is online booking worth it for a trade business? Rarely. If every job needs an inspection first, a calendar adds little. A good enquiry form is usually the better solution here.

In short

Online booking is data processing by a third party. Three things always apply: a data processing agreement, an entry in your privacy policy, and loading only after consent.

For salons, consulting and service businesses that's quite manageable with a suitable tool. For medical practices the stricter rules for health data apply — here there's little way around a specialised provider and agreement with a data protection officer.