Control the information shared with acquisition partners
Map the data that moves from a campaign into the booking system and any information sent back. Distinguish an ordinary referral identifier from clinical details, questionnaire answers, and treatment decisions. A partner's interest in measuring sales does not establish a need to know the patient's care history.
The ICO special-category rules require an appropriate lawful basis and condition for health-data processing. Apply the assessment to the actual collection, tracking, and sharing arrangements. Do not assume that consent to use a website authorises every later disclosure to an advertising or referral business. ICO: special category data rules
Inspect page addresses, analytics properties, and conversion events using safe examples. Sensitive information can be exposed through technical fields even when the visible form looks private. Keep partner reporting limited to what is justified for the agreed purpose.
Explain relevant data use clearly to the patient. If a partner collects information before the provider relationship begins, establish responsibilities for that stage as well. A handoff between brands should not leave the person unable to determine who holds their information or how to exercise applicable rights.