Why most independent dental practice websites are quietly non-compliant, and what a modern one actually looks like
If you are the principal at an independent dental practice, you almost certainly already know two things. The website is older than it should be. And the corporates, Bupa Dental, MyDentist, Portman, Rodericks, are spending more on digital than you are by a meaningful multiple. This piece is about a third thing, which is what you do about both of those facts at once, given that the regulatory floor under your website is higher than most principal dentists realise and rising every year.
I am not going to write you a sales pitch on Invisalign landing page conversion rates. There is plenty of that out there already. I am going to write the piece I would write if a friend in the practice next door asked me what they should actually do with their website over the next twelve months, and what the cost of doing nothing is.
The honest description of what most independent practice websites actually are
Strip the brand off and most independent practice websites are roughly the same artefact. A WordPress installation, often built between 2017 and 2020 by a dental-specialist agency for somewhere between £4,000 and £12,000 at the time. A core stack of pages: home, about, our team, treatments, fees, new patient, contact. A long tail of treatment pages written either by the agency or by an associate dentist who was asked to write 600 words and did, in the standard style of the period (lots of hero images of perfect teeth, lots of "experienced and friendly team", lots of stock photos of an Invisalign tray on a marble counter). Some practices have a blog that was abandoned in 2022. Most have a chatbot widget that asks "can I help you book an appointment" and then does not actually book the appointment.
The compliance furniture sits on top: GDC contact details, a complaints procedure link, the practice's CQC registration number somewhere, a privacy notice and cookie banner. Some of it is current. Some of it is not. None of it is being checked by anyone with a calendar reminder.
The visible quality is fine. The website loads. It is mobile-responsive. It has a Google Maps embed and a contact form. The new-patient inflow is steady, mostly from word of mouth and Google. The principal looks at it once a quarter and thinks "we should do something about that one day". This is the standing inventory across the independent sector. It is also, on closer inspection, mostly out of compliance with at least one of the regulators that has a piece of it.
The four regulators with a piece of your website
This is the bit most principal dentists have not properly internalised. The website is not a marketing asset that happens to mention the GDC. It is a regulated surface area governed by four separate frameworks, each with their own requirements and their own enforcement mechanisms.
The General Dental Council sets out specific mandatory information that must appear on a dental practice website. The list is short and unambiguous. The practice name and geographic address. Contact details including email and telephone number. The GDC's address and contact details, or a link to the GDC website. The complaints procedure, including who patients can contact if they are not satisfied (the relevant NHS body for NHS treatment, the Dental Complaints Service for private treatment). A date showing when the website was last updated. For every clinician, their professional qualification, the country from which the qualification is derived, and their GDC registration number. A clear statement of whether the practice is NHS, private or mixed. The GDC's enforcement mechanism is the fitness to practise process, and the most common trigger is the misuse of "specialist" as a title by clinicians who are not on a GDC specialist list.
A 2025 study of orthodontic practice websites in the UK found that only 50 per cent included a link to the complaints policy, only 27 per cent included a link to the GDC, only 85 per cent stated their GDC number, and only 88 per cent displayed the country of qualification. Orthodontic practices are typically the more digitally mature end of the sector. The figures for general practice are likely worse. None of these are difficult to fix. All of them are easy to spot from outside.
The Care Quality Commission registers dental practices in England and inspects them on a thematic and risk-based cycle. Your CQC registration certificate, your provider ID and location ID, and the most recent inspection rating are all things patients reasonably expect to find on the website, and that the CQC expects to be available in the practice premises and accessible to patients. Most independent practice sites either do not display the CQC information at all or display a 2018-vintage rating that has since been superseded.
The Advertising Standards Authority and the Committee of Advertising Practice govern the content of marketing communications on the website, including treatment claims, before and after photography, testimonials, and the absolute prohibition under CAP Code rule 12.12 on advertising prescription-only medicines to the general public. This is the single most-breached rule in the dental sector right now, because almost every practice that offers facial aesthetics (botulinum toxin, dermal fillers) treats their website as a marketing channel for those treatments. The 2021 BDJ study of dental practice marketing concluded that "compliance with the most up-to-date advertising guidelines from the GDC and ASA-CAP is generally poor". The risk is twofold: the ASA can rule against the practice and require the content to be taken down, and the GDC can pick up an ASA ruling and use it as the basis for a fitness to practise investigation. The practice ends up paying for both.
The Information Commissioner's Office governs the handling of patient data, the cookie banner under the Privacy and Electronic Communications Regulations, and the privacy notice itself. The cookie banner that came with the WordPress plugin in 2019 is almost certainly not compliant with current ICO guidance, particularly on the requirement to make rejecting cookies as easy as accepting them. The privacy notice that the agency wrote in 2018 is almost certainly missing the 2024 ICO updates on third-party tracking and consent.
Pull these four together and the picture becomes uncomfortable. A dental practice website is a multi-regulator surface area, with at least one and often several non-trivial breaches sitting on it right now, on a rolling basis, that nobody owns.
What a modern build actually does about this
Drop the marketing framing for a moment. Here is what a contemporary independent dental practice website should look like, as a piece of working software, and how each layer addresses the regulatory stack.
The team page does what the GDC asks. Every clinician has a structured profile: name, role, GDC registration number, professional qualification, country of qualification, year of registration, languages spoken, areas of clinical interest. The system enforces the structure, so a new associate cannot be added to the website without filling in the GDC number field. The "specialist" word is locked behind a check that the clinician is on a GDC specialist list. None of this is visible to a patient as compliance theatre. It just reads as a thorough, professional team page.
The treatments pages handle the ASA and the GDC properly. Each treatment has the same structure: what it is, who it suits, what it does not suit, what the alternatives are, what the risks are, what it costs, how long it takes. Facial aesthetics pages are written explicitly to comply with CAP 12.12: no prescription-only medicine names, no before-and-after photographs, factual descriptions of the consultation process rather than the treatment outcomes. The site CMS flags content that breaches the rules during the writing process, before it goes live, rather than waiting for an ASA complaint to find it.
The compliance furniture is rendered, not pasted. GDC contact details, the complaints procedure, the Dental Complaints Service link, the CQC registration number and most recent rating, the ICO registration, the privacy notice, the cookie banner: all rendered from a single source of truth. When the CQC updates the practice's rating, the website updates automatically. When the GDC updates a clinician's status, the team page updates. When the ICO updates its cookie guidance, the banner is patched once, not on every page.
The new-patient journey actually works. A patient arrives on a treatment page, decides they want to know more, and is offered the appropriate next step. For NHS routine care, that is a check on whether the practice is taking new NHS patients (which most are not) and routing to the NHS choices service if not. For private care, that is a structured booking flow that captures the right information for the practice management system. For higher-value treatments (implants, orthodontics, full-mouth rehabilitation), that is a consultation booking with the relevant clinician, with appropriate pre-consultation paperwork. The form does not just dump into an inbox. It writes to the practice management system or sends a structured handover to the front desk, depending on the practice's stack.
The AI layer is constrained, useful, and honest about what it does. This is the part most practices are getting wrong, and it is worth being clear. An open chatbot on a dental practice website that purports to give clinical advice is genuinely dangerous, both for patients and for the practice's professional indemnity exposure. What is right is a constrained AI assistant that helps a visitor understand what the practice does, who handles what, what treatments are offered, what they typically cost, and how to get to the right next step. It does not give clinical advice. It does not diagnose conditions from photographs (this is happening on some sites and is, in my view, a fitness to practise referral waiting to happen). It surfaces the practice's own published content with proper attribution, and it routes the visitor to the right person.
Reviews and reputation are managed properly. Google Business Profile reviews, Doctify and WhatClinic reviews, and the practice's own testimonials are aggregated, displayed in a way that complies with ASA guidance on testimonials, and managed through a workflow that lets the practice respond to negative reviews professionally rather than reactively. Most independent practices either do not display reviews at all (missing a major trust signal) or display them in a way that breaches ASA rules (cherry-picked, undated, no response process). A modern build handles this by default.
The measurement layer tells the principal what is actually happening. Where do new patient enquiries come from? Which treatment pages convert? What is the cost per acquired patient by treatment type, by source, by month? Most independent practices have no idea, because Google Analytics in 2026 is harder to read than it used to be, and most practices have it configured wrong anyway. A modern site uses Plausible or Fathom for privacy-respecting analytics, with specific tracked goals (consultation booked, fee guide downloaded, finance enquiry started), and source attribution that distinguishes between Google, social, direct, AI search referrals, and offline.
Each of these layers on its own is not a revolution. The combination is qualitatively different from a 2018 WordPress build, and the gap is widening every quarter as the corporate chains pour money into theirs and the AI search landscape continues to reshape patient acquisition.
The shift in patient acquisition that is happening right now
A separate shift, worth flagging because it changes the economics of website investment in 2026.
A growing proportion of high-intent patient research, particularly for higher-value private treatments (implants, orthodontics, smile makeovers, sedation dentistry), now happens inside ChatGPT, Claude, Perplexity, Gemini and Bing Copilot rather than on Google. The patient types "I am looking for an implant dentist in [town], who should I consider", and the LLM returns a synthesised answer plus a small set of recommended sources. Whether your practice appears in that recommended source set depends on whether your website is legible to a language model, which is a different question to whether it ranks on Google for "[town] dental implants".
Most independent practice websites are not particularly legible to language models. They are page-routed, image-heavy in ways that obscure rather than reveal the practice's expertise, weak on structured data, and written in a register optimised for a 2014 SEO consultancy rather than a 2026 retrieval pipeline. Treatment pages are 600 words of hero copy with no structured information about who provides the treatment, what it costs, what the alternatives are, or what evidence supports the claims being made.
The corporates have already started fixing this. The independents who do not, will see their share of high-intent search-led enquiries quietly shrink over the next two years. This is not a future risk. This is a current trend that is two to three years into a five-to-seven-year arc.
The honest economics
The replacement-build economics for an independent practice with one to four sites and somewhere between two and twelve clinicians look roughly as follows.
A surface refresh on the existing WordPress, retaining the structure and the underlying limitations, is the £6,000 to £15,000 conversation most practices have with their existing supplier. It refreshes the look. It does not change the underlying capability or the compliance posture. The practice is in the same position in 2028 as it is in 2026.
A proper rebuild on a modern stack (Next.js or similar, a real headless CMS with regulatory-aware content discipline, structured team and treatment data, constrained AI assistant, ASA-compliant rendering layer, integrated practice management handover, modern analytics) is an £18,000 to £35,000 project, plus a meaningful monthly figure for hosting, monitoring, content updates and AI maintenance, somewhere in the £400 to £900 per month range depending on scale.
The numbers are not vastly different. The capability gap is large. And the quiet point is that the modern build is also self-protecting: it makes it materially harder for the practice to drift back into non-compliance, because the structure of the system enforces the right discipline on the way in.
What I would actually do if I were the principal
Three concrete moves, in order.
The first is the cheapest. Print out the GDC's mandatory website information list and walk through your own site against it, page by page. The list is short. Practice name, geographic address, email and phone, GDC link, complaints procedure with the right onward contacts, date last updated, every clinician's qualification, country of qualification and GDC number, and a clear NHS/private/mixed statement. Tick or cross each item. If anything is missing or stale, fix it this week. Half an hour of work. Removes the most easily-spotted compliance gap on your site.
The second is the most useful. Run an LLM-readability test on your practice. Open ChatGPT, Claude or Perplexity and ask "I am looking for an implant dentist (or invisalign provider, or sedation dentist, depending on what you offer) in [your town], who should I consider?". See what comes back. Notice whether your practice appears in the recommended source set, and notice which practices do. If a competitor with a smaller marketing budget is appearing and you are not, the answer is almost always that they have invested in structured content and you have not. This is now genuinely diagnostic, in the way that running a Google search on yourself was diagnostic in 2010.
The third is the longest horizon. Have an honest conversation about what the website is for. If the practice manager thinks it is a brochure, and you think it is a credibility signal, and the marketing person you brought in last year thinks it is a lead generation tool, and the new associate dentist thinks it should have an AI symptom-checker, you are not going to agree on what to spend or what to build. The conversation that needs to happen is "what proportion of our high-value private treatment enquiries in 2028 will start in an LLM, and is our website ready for that". My honest read is that the answer is more than half, and no.
A short note on what this is and is not
I run a small consultancy in Birmingham called Actually AI. We build modern websites for SMEs and full compliance-grade IR websites for AIM and Main Market issuers. The independent dental sector sits firmly inside the SME practice. It is the same craft applied to a sector with sharper regulatory requirements and a more sophisticated buyer than the average SME engagement.
This piece is not a sales pitch. It is the briefing I would write for myself if I were the principal at a three-clinician independent practice in the West Midlands and someone had asked me what to do about the website over the next twelve months. If the briefing resonates, the contact page is one click away. If it does not, you now have a checklist and the GDC link, which is most of what is actually useful.
David Ville is the founder of Actually AI, a Birmingham-based consultancy. The SME practice covers AI strategy, modern web design, and operational AI for UK small and medium-sized businesses, including a particular focus on regulated professional services across healthcare, legal, property and finance.