Somebody is unwell at 9pm. They want to know whether your clinic is open tomorrow, whether you take their insurance, how much a consultation costs, and whether anyone sensible works there. They are deciding from a phone, often anxious, often on behalf of a parent or a child.

Medical websites in Kenya are usually built as institutional brochures and answer none of that. The fix is not a redesign in the decorative sense. It is building the site around the handful of things a worried person needs within a minute.

The First Minute

Five things belong above everything else, visible on a phone without scrolling far:

If you do not run a 24-hour emergency service, say so clearly and say where to go instead. A patient who arrives at a closed clinic in an emergency is a harm your website caused. This is the one place where being unmistakably clear matters more than looking welcoming.

Services, Written for Patients

Clinical language loses patients. "Paediatric outpatient services" is accurate; "children's clinic" is what a parent searches for and understands. Write the page in the patient's words, then use the clinical term alongside it.

Each service deserves its own page covering what the service is, who it is for, what happens during the visit, how long it takes, what to bring, and how to book. The "what happens during the visit" part matters more than clinics expect: a large share of avoidance is fear of the unknown.

List your specialities and the visiting consultants, with their days, because many patients choose by practitioner rather than by facility.

Insurance and Costs

This is the single most asked question that most Kenyan medical websites ignore, and it is the question that decides whether a patient comes to you.

Keep this page accurate above all else. An insurer listed that you no longer accept creates an argument at reception and a bad review. Put a review date on it and have one person own it.

Appointment Booking

Three levels, and most Kenyan clinics should start at the first:

LevelHow it worksSuits
Request a bookingA short form or WhatsApp message, confirmed by your staffSingle clinics, small teams, no scheduling system
Choose a slotReal availability by doctor and day, booked directlyClinics with predictable schedules and someone to maintain them
Connected to your systemBooking writes into the practice or hospital management systemHospitals and multi-site groups already running such a system

Keep the form short: name, phone, service, preferred day. Do not ask for symptoms, medical history or an ID number on a public form. You do not need them to book, and collecting them creates a data protection obligation you did not need.

If enquiries arrive faster than reception can answer them, especially after hours, a WhatsApp agent can answer hours, location, insurers accepted and consultation prices, and take booking requests, while handing anything clinical straight to your staff. An agent must never give medical advice, and ours is configured not to.

Trust Without Overclaiming

Patients are assessing competence and safety from very little information. Give them the verifiable things:

Resist patient testimonials describing outcomes. They raise consent and privacy problems, they are difficult to verify, and professional rules in healthcare are stricter than in other sectors.

Patient Portals and Results

A portal where patients see results, invoices or appointment history is genuinely useful and is the most sensitive thing you can put online. It deserves a separate decision and a separate budget, not an add-on to a website build.

If you are considering one, the minimum is: individual accounts with strong authentication rather than a shared password, two-factor for staff accounts, encryption in transit and at rest, access logs showing who viewed what, a defined retention period, and a tested restore. If a supplier cannot describe all seven, they are not ready to hold patient data and neither are you.

Most clinics should start with the public site done well and add a portal only when there is a system to connect it to.

Patient Data, Handled Properly

Health information is among the most sensitive personal data there is. Kenya's Data Protection Act, 2019 created the Office of the Data Protection Commissioner and sets obligations for organisations handling personal data.

Practical rules we apply on medical builds. Collect the minimum on any public form. Never let patient documents land in a shared email inbox. Keep HTTPS and security headers in place on every page. Limit who can see submissions. Set a retention rule and follow it. And write a privacy notice patients can actually read.

Confirm your specific obligations with your compliance adviser and the Office of the Data Protection Commissioner. This article is about building websites, not legal advice.

Advertising Rules and Medical Claims

Medical practice in Kenya is regulated, including how practitioners and facilities may advertise. Those rules are set by your regulator and your professional body, not by your web developer.

What we will not build, and recommend nobody publishes: claims to cure conditions, before-and-after imagery used as proof of outcome, comparative claims about being the best facility, prices framed as promotions on clinical procedures, and anything that pressures a patient into a decision. Beyond the regulatory risk, these materially reduce trust with the patients you want.

Have a clinician review every clinical word on the site before it goes live, and record who approved it.

What It Costs

ScopeBuildPrice
Hours, location, services, insurers, booking request formBasic informational siteKES 20,000 to 30,000
Full service pages, practitioner profiles, department structure, booking flowProfessional business siteKES 50,000 to 120,000
Paying consultation fees or deposits onlineM-Pesa integrationKES 5,000 one-time
Patient portal, or connection to a hospital management systemCustom workQuoted after we see your systems
Keeping hours, insurers and staff current, plus securityMaintenanceFrom KES 5,000 per month

Maintenance is not optional here. An expired certificate, a broken booking form or an outdated insurer list does more damage to a medical practice than to most businesses. See website maintenance and our notes on building for regulated sectors.

Frequently Asked Questions

What should a clinic website show first?

Five things, visible on a phone without scrolling far: today's opening hours, whether you handle emergencies and where to go if you do not, your location with the landmark people navigate by, a phone number that dials in one tap, and one obvious way to book.

Should we list the insurers we accept?

Yes, by name, with the date the list was last updated, along with whether you handle public cover, what a cash consultation costs, and what to bring. It is the most asked question that most Kenyan medical websites ignore, and an out-of-date list creates arguments at reception.

What kind of appointment booking should we offer?

Start with a booking request form or WhatsApp message confirmed by your staff. Move to real slot selection when your schedules are predictable and somebody maintains them, and connect to your practice management system only if you already run one. Keep the form short and never ask for symptoms or medical history on a public form.

Can we use patient testimonials?

We advise against testimonials describing outcomes. They raise consent and privacy problems, they are hard to verify, and professional rules in healthcare are stricter than in other sectors. Build trust with named practitioners, real facility photographs, accurate accreditations and clear complaint routes instead.

What are the rules about patient data on a website?

Kenya's Data Protection Act, 2019 and the Office of the Data Protection Commissioner set the framework. In practice: collect the minimum on public forms, never let patient documents land in a shared inbox, keep HTTPS and security headers on every page, limit who can see submissions, and set a retention rule. Confirm your specific obligations with your compliance adviser.

Should we build a patient portal?

Only when there is a system to connect it to and a budget for doing it safely. The minimum is individual accounts with strong authentication, two-factor for staff, encryption in transit and at rest, access logs, a defined retention period and a tested restore. Most clinics should start with the public site done well.

Make the first minute work for worried patients

Send us your current site. We will check it the way a patient would at 9pm on a phone, and tell you what is missing, what is out of date, and what the booking flow should look like. Talk to us on WhatsApp at +254 722 334 188, email hello@wpfoss.ke, or call +254 709 384 200.

Discuss Your Clinic's Site

Related: Security Audit · M-Pesa Payments · Secure Email · Maintenance