Website for nutritionists: consultations, intake forms and where GDPR changes the price

en 2026-09-19 7 min read

A nutritionist site that explains your practice and takes enquiries is step 02 or step 03: EUR 900 to 1.500 for 2 to 3 pages with a contact flow and a basic CMS, or EUR 1.500 to 3.500 for 4 to 7 pages with a CMS, separate service pages and booking or contact. The number changes the moment the site itself starts collecting what someone eats, what they weigh, what they take and what they have been diagnosed with. That is health data, and keeping it inside your own site moves the build to step 04, EUR 3.500 to 7.500.

Where the line actually sits

Under the GDPR, data concerning health is a special category with stricter rules than ordinary contact details. The difference is not the form, it is the question. A field asking for a name, an email and "what would you like help with" is an enquiry. A field asking about medication, blood results, digestive symptoms, a pregnancy or a weight history is health information about an identified person, and the rules for storing it, restricting who reads it, deleting it on request and reporting a breach all tighten.

That matters for a build because those rules are not a setting to switch on. In practice they are a login, a database with real access control, a record of who opened what, an export, a delete, a retention rule and a written agreement with whoever stores the data. That is the work in step 04. Your own legal adviser confirms what your practice has to do; our job is making sure the site can do it.

The cheaper route, and it is a legitimate one

You can keep the site at step 03 and let a specialist tool do the regulated part. Booking and practice platforms that already handle intake, consent and client records come with a processing agreement and a security posture you buy rather than build. Your site links out to it and never sees the answers.

The trade is control. The intake lives on someone else's domain with someone else's design, you pay monthly for as long as you practise, and you inherit their decisions about export and retention. That is worth taking when the practice is one person and a calendar. It stops being worth taking when staff need different levels of access, or when the plan, the follow-up and the messaging all belong in one place.

What step 04 actually includes

• Authentication. Real accounts with password rules and session handling, not a shared link that anyone who ever received it can still open.
• Access control. A practitioner sees their own clients. An assistant sees the schedule and not the notes. Roles are decided during scoping, not patched in after launch.
• Storage. A database with encryption at rest, backups you can actually restore, and a region chosen on purpose.
• Consent and purpose. Every field on the intake needs a reason to exist. The ones without one get cut, which is the cheapest privacy measure available.
• Deletion, export and retention. A client can ask for their data or ask you to erase it, and that has to be something your practice can do without raising a developer ticket. Old records go on a rule you set instead of accumulating because nobody decided.
• A processing agreement. With whoever hosts the database, so your paperwork matches your architecture.

Payments sit on this step too. A consultation paid for on your site brings checkout, invoices, refunds and failed-payment handling, and it needs the same account system a client portal needs.

You own the code, the repository and the database, which with health records is the difference between an asset and a rental: you can audit it, move it, or hand the whole repository to another developer. Hosting is agreed per project, because where a database of client health information lives is decided deliberately during scoping.

Process and timeline

1. Scoping. We write down every question you want to ask a new client and mark which answers count as health data. That list decides the step, and a fixed quote always follows scoping.
2. Structure and copy. Pages, service descriptions and the route from reading to booking. This is the part that waits on you, because your words describe your method.
3. Build. Step 02 runs 2 to 3 weeks, step 03 runs 3 to 6 weeks, step 04 runs 6 to 12 weeks. A custom platform at step 05 starts from EUR 7.500 and is quoted after discovery.
4. Launch. Forms tested against real delivery, analytics connected, and your approved privacy statement matching what the site genuinely does.

The full list of steps is on our packages page.

When to spend less

• If your diary is not full yet, a step 02 site plus a contracted external booking tool is enough. Step 04 is for a practice with a process worth encoding, not for one still looking for its first clients.
• Ask for fewer fields. Every question you remove from the intake removes storage, consent, deletion and review work behind it.
• SEO foundation is a one-off at EUR 450 to 750: Search Console, analytics, indexation, technical hygiene, titles, internal links and a 3 to 6 month plan. For a local practice, that one-off plus one clear service page is a reasonable place to stop and measure before committing to SEO growth at EUR 500 to 800 per month.
• Care at EUR 100 to 300 per month covers updates, monitoring, backups and small fixes, and not redesigns or new features. If your site holds client data, treat care as necessary rather than optional, because an unpatched site with health records behind it is the wrong place to economise.

Questions nutritionists ask

Can I ask health questions in a normal contact form?

Technically yes, and it is still a bad idea. The message lands in your email, syncs to your phone and your laptop, and sits in a mailbox with no retention rule and no access control. A free-text box does not change what the data is. If you want health details before a first session, use a contracted intake tool or build the intake properly at step 04.

Does an external booking tool make me compliant?

It moves the storage to a provider who has thought about it, which genuinely helps, but it does not transfer your responsibility. You are still the controller. You still need a processing agreement with them, a privacy statement that names them, a reason for every field they collect on your behalf and an answer ready when a client asks to be erased.

How much of step 04 is the privacy part?

It is not a separate line on the quote. Authentication, roles and a real database are the components that make a client portal work at all, and the privacy requirements shape how they are built rather than bolting a module on top. What moves the price inside EUR 3.500 to 7.500 is how many roles exist, whether clients upload files, and whether payments are included.

Can I start at step 03 and add the portal later?

Yes. Added later, the portal is the client login add-on at EUR 1.500 to 4.000, and the quote confirms the scope. It goes in as a section of the same site, same stack, same repository, same design system. That is the approach on our design and engineering page and in our Next.js work, and the reason a step 03 build is not wasted money later.

Send us the list of questions you ask a new client and we will tell you which step that puts you on, with a price. Get in touch.