Impressum & data protection for a medical practice in Austria: what doctors must disclose

The Impressum under § 5 ECG

The E-Commerce-Gesetz (ECG, E-Commerce Act) applies to every website that offers an information society service – including the website of your Ordination (medical practice), because it promotes your medical work. § 5 ECG requires certain details to be permanently, easily and directly accessible. In practice, this means: an “Impressum” link in the footer of every page that leads straight to the information.

The supervisory authority is not a standard item for a typical single-doctor practice, because the ECG only requires it “where applicable”. If you are unsure whether your activity is subject to official supervision – for example in a group practice that needs an approval –, check with your medical chamber. Whether you are a Wahlärzt:in (private doctor without a health insurance contract) or have contracts with the health insurance funds does not belong in the Impressum, but it should be clearly visible on the home page. More on this in the post Becoming a Wahlarzt.

You don’t run a medical practice but a physiotherapy, psychology or psychotherapy practice? Then different professional laws and registers apply. Read the posts on the Impressum for physiotherapists, the Impressum for psychologists and the Impressum for psychotherapists.

Group practice, OG and GmbH

If you work with colleagues in a Gruppenpraxis (group practice), the provider of the website is no longer an individual doctor but the company. Under § 52a Ärztegesetz, a group practice is either an offene Gesellschaft (OG, general partnership) or a GmbH (limited company). Its company name must include the name of at least one partner and the specialties represented.

• Company name and legal form, e.g. “Dr. Muster & Dr. Beispiel Fachärzte für Orthopädie OG”
• Registered office, company register number and register court – required by § 5 ECG and, for the website, also by § 14 UGB (Commercial Code)
• The medical chamber and professional titles of all partners, most simply as a short list
• Medieninhaber (media owner) in the Offenlegung is the company, not the individual doctor

The Offenlegung under § 25 Mediengesetz

Every website is also a medium within the meaning of the Mediengesetz (Media Act). For a typical practice website that only presents the practice, the small Offenlegung under § 25 Abs 5 MedienG is enough: name, purpose of the business (e.g. “Ordination für Allgemeinmedizin”, general practice) and place of residence or registered office. It can be on the same page as the Impressum – ideally under the heading “Offenlegung gemäß § 25 Mediengesetz”.

The privacy policy

As soon as your website processes personal data – and it already does through server logs with IP addresses –, you must inform visitors under Art. 13 GDPR. Link the privacy policy in the footer of every page, like the Impressum. It must match your website exactly: a copied template that lists services you don’t use (or vice versa) is a common mistake.

• Who is responsible (you or the group practice) and how to reach you
• Which data the website processes: server logs, contact form, appointment booking, embedded content
• The purpose and legal basis of each processing activity and how long data is kept
• Recipients, such as the hosting provider, booking platform or newsletter service, and whether data leaves the EU
• Visitors’ rights and the right to complain to the Datenschutzbehörde (Austrian Data Protection Authority)

The website’s privacy policy does not replace the patient information in your practice. For test results, medical records and billing, medical confidentiality under § 54 Ärztegesetz and your documentation duties also apply.

Cookies, maps, fonts and widgets

Cookies and similar technologies are governed by § 165 Abs 3 TKG 2021 (Telecommunications Act): you may only store or read information on visitors’ devices with active consent – unless it is strictly necessary for the service they explicitly requested. In practice, this mainly concerns embedded third-party content:

• Maps: An embedded Google Maps map loads data from Google. Better: load the map only after a click, use an OpenStreetMap-based map or show an image with a link to directions.
• Fonts: Embed fonts such as Google Fonts locally from your own server. The Datenschutzbehörde recommends this too, after mass warning letters about Google Fonts were sent out in 2022.
• Booking widgets and reviews: Embedded widgets from booking or review platforms often transfer data as soon as they load. A button with a link is the simpler solution.
• Analytics: There are cookieless, data-minimising analytics tools that can work without a banner.

A lean website without tracking or embedded third-party content needs no cookie banner. That is not only simpler legally, it also loads faster – a plus for Google. What else a good practice website needs is covered in the post What belongs on a practice website.

Contact forms and health data

Under Art. 9 GDPR, health data is a special category of personal data. If a patient writes in your contact form “I’ve had chest pain for weeks and need an appointment”, you are processing exactly this kind of data. So design forms in a way that collects as little of it as possible:

Accessibility Act: does it apply to your practice?

The Barrierefreiheitsgesetz (BaFG, Accessibility Act) has applied since 28 June 2025. Among other things, it covers “e-commerce services” for consumers (§ 2 Abs 2 Z 6 BaFG): services provided electronically through websites or apps at the individual request of a consumer with a view to concluding a consumer contract. A purely informational website without a booking or purchase option is not covered, according to the Austrian Economic Chamber (WKO) – not even because of an email address in the Impressum.

• Online booking: The WKO counts online appointment booking tools as covered services if they are used to initiate or conclude a contract – even without immediate payment. For medical practices there is no case law on this yet.
• Microenterprises are exempt (§ 6 Abs 1 BaFG): fewer than ten employees and an annual turnover or balance sheet total of no more than €2 million. This applies to most single-doctor practices.
• External booking platform: According to the WKO, outsourcing the booking does not release you from the requirements. Ask your provider whether its booking tool is accessible.
• Enforcement: The Sozialministeriumservice (federal social affairs office) is responsible. Breaches can lead to administrative fines.

Even if your practice is exempt: an accessible website with sufficient contrast, legible text, alt texts and keyboard navigation helps older patients and people with visual impairments – exactly the people you want to reach. What a professionally built website costs is shown in the post What does a practice website cost?.

Checklist for your practice website

Just starting out? Then take a look at the guide Opening a practice in Austria: the website is one of the steps before opening.