Setting up a privacy policy for your care home website is simpler than it sounds. Say what data you collect, why, where it lives, who sees it and what rights people have.
A free generator gives you a starting point, and the trust comes from making it true to your home.
Here is what it must cover and the mistakes to avoid. This is practical guidance, not legal advice.
The rules come from the UK GDPR and the Data Protection Act 2018, and the regulator is the ICO.
Why your care home website needs a clear privacy policy
A clear privacy policy tells people what the law says they should be told, and it builds trust. Residents deserve to know their private lives won’t be shared where they shouldn’t be.
Your privacy policy is one part of the picture, so read
what a care home website needs for the rest.
Why do so many homes get this wrong?
GDPR isn’t new, but many homes still treat privacy policies as an afterthought, tangled in jargon or hidden at the bottom of the page.
Think of what your website collects: web forms for enquiries, newsletters, “Book a Visit” buttons, photographs from Christmas fayres or Macmillan coffee mornings. That means names, emails, perhaps medical needs and little family stories.
What GDPR means for marketing (in plain English)
In practice, it means writing down how, why and where you collect and use personal information, and being open about that with anyone who asks or who lands on your website.
If a family is weighing up whether to trust you with mum or dad, they want to know their private details will be handled with dignity.
For example, a resident might lend her wedding photograph for a “Meet the Community” wall and then worry it will appear online.
Why your privacy policy matters to families
A clear privacy policy gives families one less thing to worry about, when they are already asking themselves “Am I doing right by mum?”
Word also travels fast. One worried post in a local Facebook group and everyone’s talking: “They sent me stuff I never signed up for.” You want them saying “They’re upfront, I know where I stand.”
What a care home privacy policy must cover
- Who you are: Simple intro. “We are Greenfield Care Home, based at 123 Meadows Lane, West Yorkshire…”
- What data you collect: Names, emails, phone numbers, medical info if needed. Newsletter signups. Website cookies.
- Why you collect it: To follow up on web enquiries, send newsletters to people who have said yes and tell people about events, spelled out in plain English.
- How you keep it safe: Passwords, locked office computers and secure email systems.
- Who you share it with: Trusted partners only, such as your web company or newsletter provider, and say who they are. Never mailing lists.
- How long you keep it: Be honest. “We’ll keep your information for as long as necessary to process your enquiry or as required by law.”
- How families/residents can ask about their data: A contact name, a phone number, a real email. Not a black hole.
What else does GDPR ask of your website?
Your privacy policy is the main thing, and four other checks go with it. All of them are in your hands, and most take an afternoon.
Consent for photographs and quotes
A photograph of a resident at the school visit is personal data, and so is a family’s thank-you email. Get written permission saying where it will be used, and keep it where you can find it.
If a resident can’t decide for themselves, follow your mental capacity policy. A relative’s yes doesn’t settle it on its own.
Cookies and tracking
Advertising tools from Google or Meta need a visitor’s consent before they run. So say no on your own cookie banner, and ask your web company to confirm they stay off.
The ICO’s current guidance lets you count visitors without consent, if it is purely to improve your site, you explain it and you offer a simple way to object.
Secure forms
Check your site shows the padlock in the address bar, and ask only for what you need. Know where each enquiry ends up, who can open it and when it gets deleted.
Requests and complaints
Someone may ask what you hold about them, or ask for a photograph to come down. The ICO’s time limit is generally one calendar month, so make sure your team knows who deals with it.
Since June 2026, you also need a clear way for people to raise a data protection complaint, and you must acknowledge it within 30 days. Say how in your privacy policy.
Sound familiar? The top mistakes homes make with privacy policies
- Burying it in tiny print that a resident couldn’t read even with her best glasses.
- Using American spellings or copied templates from a generic source (“facility”, “patients”, “seniors”).
- Forgetting to update the policy after changing web forms or adding new ways of collecting info (like a new Facebook booking widget).
- Making it far too long, full of legal language no resident or family can follow.
- Not checking what their web company is doing behind the scenes. Cookie banners, analytics and newsletter sign-ups all need to be covered.
GDPR, privacy and the stories your website tells
Say you post photographs from the local vicar’s Easter visit, or of children from the nearby school sharing birthday cards with residents. Lovely for your social feed, but did everyone shown know and agree?
Ask permission, use the right forms and make sure your privacy policy covers this.
How a privacy policy builds confidence in your home
Many owners worry GDPR is just more red tape. Get your privacy policy right, though, and it also reassures families, local professionals and the hospital discharge team checking up before a referral.
Be upfront about cookies. If your policy is confusing, families may wonder what else is. If people can ask a question, get an honest answer and see staff trained on privacy, you’re halfway there.
Do you need a lawyer for your privacy policy?
Not always, but it depends on what you hold. If you handle medical details through your website, or you are unsure, get advice.
For most small homes, there is good
guidance from the ICO. Make sure your policy covers what you actually do.
If a web company looks after your site, make sure they keep cookie notices and forms up to date. Don’t be afraid to ask questions.
Staff, residents, and keeping privacy real
Don’t keep the privacy policy hidden away for when someone complains. Share it at staff meetings, using examples everyone gets, such as a family emailing photos for the newsletter.
Final word: keep it simple, visible, and honest
Keep it plain. A well-written privacy policy is as much about caring for families as it is about following the rules.
Still not sure your site’s covered? Browse the rest of our
Learn library.
3 Simple Things You Can Do Today
- Check your website to make sure your privacy policy is easy to find, at the top or bottom of every page.
- Look at your web enquiry forms. Add a clear “how we use your data” note right underneath.
- Ask one team member, “Do you know what to do if a resident or family asks about their data?” Then fill any gaps.
