Medical practice websites: what they need

Clinics live on booked hours. A visit that wasn't scheduled today doesn't come back tomorrow. Even so, many clinic websites work like a business card: a photo of the building, a list of specialties and a phone number in the footer.

Meanwhile, the money goes elsewhere. Doctoralia's Panorama das Clínicas e Hospitais 2026 surveyed more than 600 managers: 75% of clinics invest in paid ads, 85% use Instagram as their main communication channel, and 67% have never mapped the patient journey. In other words, many clinics pay to attract people without knowing what happens after the click. This guide shows what the website needs to close that path, within CFM rules.

Patients decide before they call

The latest research on this is American, so read it as a sign of direction, not a picture of Brazil. The 2026 Patient Choice Report from rater8, a medical reputation company, surveyed nearly 1,000 adults in the United States. The numbers:

• 75% won't book a doctor rated below 4 stars.
• 55% have dropped a doctor because of something they read online.
• 66% say a doctor's response to reviews affects their trust.
• 36% of people who looked for a doctor in the past year cite AI tools as an influence, versus 34% for Google and 32% for a referral from another doctor.

Patients research, compare and rule you out without ever talking to the front desk. You never hear about that loss. The website is where the clinic answers that comparison with its own facts.

Show who provides the care

This builds trust, and it's also mandatory. According to the summary by the Salusse Marangoni law firm of CFM Resolution 2.336/2023, advertising must include:

• Doctor: name, CRM number, the word “Médico” and the RQE, if any.
• Clinic: name of the facility, its CRM registration number, name of the medical technical director with their CRM and, at specialty facilities, the director's RQE.

In practice, the clinic's details go in the footer of every page. Each doctor gets their own page, with a real photo, training, registered specialty and office hours.

Google looks at this too. Health is among the topics it calls YMYL (“Your Money or Your Life”), where, according to its official documentation, its systems give even more weight to content with proven experience and authority. The same page recommends bylines with real information about the author. An article about a treatment needs the name of an actual doctor, not “Clinic team.”

The path to a booked visit

People arriving on a phone want three answers: does the clinic treat my problem, does it take my insurance, and how do I book. If the third one takes a full scroll, you've lost the patient.

• A booking button that's always visible. On mobile, fixed to the bottom of the screen. One tap opens online scheduling or WhatsApp with a ready-made message.
• One page per specialty and procedure. “Dermatology in Fortaleza” and “endoscopy in Fortaleza” are different searches. Each page answers one and ends on the same button.
• Insurance plans written as text. A row of logo images doesn't help Google or AI. Text helps both.
• Prep and arrival. Fasting, documents, parking, accessibility. Every question answered on the site is one less call to the front desk.
• Locations with their own address. A clinic with more than one location needs one page per address, with a map and hours.

That was the logic behind amandanutri.com.br, a website we built for a nutritionist with 100% online appointments and booking through WhatsApp. If you work on your own, with no team, also read what a solo practitioner's website needs. It covers the rules for psychologists, nutritionists and dentists.

What the CFM lets you post

CFM Resolution 2.336/2023 opened up a lot of room, and many clinics still write as if the old rules applied. Published in September 2023, it took effect 180 days later. Here's a summary of what applies, based on the CFM's official note and the legal summary cited above. This isn't legal advice: when in doubt, check with your CRM.

Allowed:

• Publishing the price of visits and procedures, plus payment methods and terms.
• Advertising discounts and promotional campaigns, with no tied sales or prizes.
• Reposting patient praise and testimonials, as long as they're restrained. The CFM requires text “without adjectives that denote superiority.”
• Showing before and after images for educational purposes, tied to the doctor's registered specialty and paired with educational text.

Before-and-after conditions: the image can't be edited or enhanced, the patient can't be identifiable, and the demonstration must include indications, good and poor outcomes, and possible complications. Images from the doctor's or clinic's files require the patient's authorization.

Not allowed: implying a promised result or guaranteed success, anywhere on the site. Phrases like “the best in town” or “guaranteed results” come off the page.

Dental clinics answer to a different council, the CFO, with different rules, including on prices. Check your profession's rules before copying anything from this list.

Show up in local search and AI

People looking for a doctor usually type the specialty and the city. Google says local ranking considers relevance, distance and prominence, and that businesses with complete, accurate information are more likely to appear. More positive reviews help too.

• A complete Google Business Profile, with the same name, address and phone number as the website. The step-by-step is in how to show up on Google Maps in your city.
• Answer your reviews, good and bad, without exposing patient data. In the rater8 survey, responding was the trust factor that rose most in a year: 24 points.
• Structured data, sitemap and llms.txt, so search bots and AIs understand doctors, specialties and addresses.
• Real FAQs. “Do you take Unimed?”, “Do I need a referral?”. A direct answer is what AI can cite.

Fix what AI gets wrong, too. In the rater8 survey, 66% of patients said they had found incorrect information about a doctor in AI tools, and 60% trusted the summary without checking. Clear, consistent details across all channels reduce that risk.

Forms and LGPD: ask only what you need

The LGPD treats health data as sensitive data, with “even greater protection,” in the words of the ANPD. For the website, that becomes four rules:

• The form asks for name, phone and preferred time. Symptoms, tests and medications wait for the visit.
• A short, real privacy policy that says what each piece of data is for and how long it's kept.
• Separate consent for receiving updates, never checked by default.
• Be careful with ad pixels. A page about depression or HIV treatment says a lot about who visited it. Think it through before installing the tool there.

What this means for you

Use this list to assess your current site or a proposal you've received:

1. Can visitors book in one tap, on mobile, from any page?
2. Are name, CRM, RQE and technical director visible?
3. Does each specialty have its own page, with the city in the text?
4. Are insurance plans and test prep written as text?
5. Is the site free of promised results?
6. Does the form ask only for what's needed, and is there a privacy policy?

If you answer “no” to two or more, your website is leaving slots empty. To plan the investment, see how much a professional business website costs.

At the Studio, you get a fixed price after discovery, the deadline is written into the contract, and code, files and accounts stay in the clinic's name. If you want a website that fills the calendar within CFM rules, see how we build business websites.