A therapist website contact form should make the first step clear without asking a visitor to disclose more than the practice needs. It should explain what happens next, link to the relevant privacy information, work properly on a phone and send enquiries into a controlled process.
No website checklist can certify that a practice is compliant with UK data-protection law. The organisation, its suppliers, the data collected and the way information is used all matter. Use the checks below to find questions to resolve, then take specialist advice where the risk or processing is complex.
1. Is the form asking for the minimum useful information?
Start with the purpose of the form. If the goal is to arrange an introductory conversation, fields such as name, email, preferred contact method and a short reason for getting in touch may be enough.
Be cautious about a large free-text box that invites detailed clinical information. A general website form is rarely the right place to gather sensitive case notes. Tell visitors what not to include if that is relevant to the practice’s process.
2. Does the page explain what happens next?
People are more likely to complete a form when the next step is concrete. State who will respond, the usual response window if you can keep that promise, and whether the first contact is a call, an email or an assessment conversation.
A confirmation message should repeat the practical next step. Avoid vague language such as “we will be in touch soon” if the practice has a more useful explanation.
3. Is the privacy information easy to find?
Put a clear link to the privacy notice close to the form, not only in a footer that a mobile visitor may never reach. The notice should describe the relevant purpose, categories of information, retention and rights in language the intended audience can follow.
The ICO’s UK GDPR guidance can help a practice identify the questions it needs to answer. It is not a substitute for a tailored legal review.
4. Is any consent wording accurate?
Do not add a generic “I agree to everything” checkbox simply because it looks reassuring. Explain what the checkbox does, whether it is necessary for the enquiry and how it relates to any separate marketing communication.
Keep marketing permission separate from the basic act of sending an enquiry if the practice wants to send newsletters or promotional messages. The wording should describe the actual processing rather than using a copied template that does not fit the practice.
5. Is the form protected in transit and at rest?
Check that the website uses HTTPS and that the form provider, email service and storage location are understood. Ask who can access submissions and whether the website stores them in the WordPress database, a third-party service, an inbox or more than one place.
Make sure the practice knows how to remove or retrieve information when its retention process requires it. Security is a chain: a secure page does not automatically make every connected inbox or CRM configuration secure.
6. Does the form resist spam without creating unnecessary barriers?
Spam protection is useful, but an intrusive challenge can prevent genuine enquiries, especially on mobile or for people using assistive technology. Test the chosen control with keyboard navigation and on a small screen.
Monitor spam levels and adjust the protection if needed. A form should not force every visitor to solve a puzzle when a quieter server-side control would do the job.
7. Does it work on a phone?
Test the form with one hand and a small screen. Check field labels, keyboard types, error messages, focus movement, tap targets and the success state. Make sure the privacy link and submit button remain visible and understandable.
Do not rely on a desktop test. Many potential enquiries will first discover a therapist through a phone search or a shared link.
8. Are errors clear without exposing private information?
Error messages should tell the visitor how to fix a missing or invalid field. They should not echo sensitive text into a public page, send it to an analytics system or reveal internal implementation details.
Check what happens if the browser loses connection, a submission times out or the visitor presses the button twice. The person should know whether to retry or use another contact route.
9. Is measurement free from personal data?
It is useful to know that a form was viewed, started and successfully submitted. Measurement should describe the action, not capture the visitor’s name, email address or free-text message in analytics parameters.
For a lead-generation site, agree one conversion event and one thank-you route. Xeon’s own measurement contract uses a completed form, a thank-you page and a generate_lead event; the implementation should be tested without sending enquiry content into analytics.
10. Has someone tested the complete journey?
Submit a test from a phone and a desktop device. Confirm the visitor sees the success state, the practice receives the notification, the reply address works and the event appears in the intended reporting system.
Record the date, device and result. Repeat the test after major form, hosting, theme or tag-manager changes.
A safer enquiry-page structure
- Explain who the practice helps and what the first contact is for.
- Give visitors an alternative route if the form is not suitable for urgent or sensitive information.
- Show only the fields needed for the next step.
- Link to privacy information beside the form.
- Confirm what happens after submission.
For broader guidance on creating useful, accessible pages, see Google’s SEO Starter Guide and Xeon’s therapist website service.
Frequently asked questions
Should a therapist website contact form ask for a diagnosis?
Usually, a general enquiry form should not invite detailed clinical information unless the practice has deliberately designed and assessed that process. Ask only for what is needed to decide the next safe step.
Do I need a checkbox saying “I agree to the privacy policy”?
There is no universal checkbox that makes a form compliant. The wording and legal basis depend on what the practice is doing with the information. Make the privacy notice available and obtain any separate permission that is genuinely required.
Can form submissions be sent to email?
Email may be part of a practice’s workflow, but the risks, access controls, retention and supplier arrangements need to be understood. Do not assume that HTTPS on the website answers every question about the receiving mailbox.
If your current form feels unclear or asks for too much, start by mapping the minimum information needed for the first conversation. Xeon Creative can review the existing website or help plan a new route through the contact page.