Patient WiFi for clinics, care homes and hospital waiting areas

A waiting room is full of people with a phone and time to fill. A practice that offers them WiFi has to keep that network apart from clinical systems, and decide what the sign-in page collects and what happens to it afterwards. This guide covers GP surgeries, dental and physiotherapy clinics, vets, care homes and hospital waiting areas, and where a captive portal fits in each.

The legal points are UK-specific, checked on 3 October 2026 against the ICO, NHS England, the Department of Health and Social Care and the professional regulators. This is general information, not legal advice; for other countries, see guest WiFi marketing laws by country.

Why practices offer patient WiFi

In England, NHS settings have a national service. NHS England Digital describes NHS Wi-Fi as being "for staff and patients in NHS care settings across England" and says over 8,000 centres of patient care have been WiFi enabled through the programme. Its setup guidance sends every public user through a consistent NHS.UK landing page: a registration screen with an NHS blue banner, then a post-authentication page hosted by NHS Digital, where supplier branding and commercial advertising "must not appear". The same page says the programme ended in 2019; the guidance is still published.

An NHS surgery or hospital trust on NHS Wi-Fi follows that template, so the choices below fall mainly to private GPs and clinics, dental practices, physiotherapy and osteopathy clinics, vets and care homes. For them the reasons are practical: people waiting get online without using their mobile data, and reception stops being asked for a password.

What changes from one setting to another

Keep guest WiFi away from clinical systems

NHS England's guidance asks every NHS Wi-Fi site to run at least three networks: a corporate network "for staff who have access to patient record systems", a guest network for staff devices that do not meet the corporate specification and for business visitors, and a public network for patients and visitors that "isn't suitable for confidential information". Guidance for public WiFi carried over the Health and Social Care Network adds that public traffic "must remain logically separated from all other classes of traffic, end-to-end, from wireless access point to Internet egress".

A private practice can follow the same pattern with business-grade equipment:

• Put patient and visitor WiFi on its own VLAN with internet access only, so nothing on it can reach the practice management system, imaging equipment or card terminals.
• Turn on client isolation, so one patient's phone cannot reach another's.
• Give staff and clinical devices a separate network with its own password.
• Pre-authorise waiting-room TVs and other devices that cannot complete a sign-in page, or move them to the staff network, as the guide to smart TVs on guest WiFi explains.

Care homes have residents to plan for as well. The Department of Health and Social Care's guidance on setting up internet for adult social care, published on 29 September 2026, asks larger homes (more than 30 beds) to consider separate WiFi for staff, residents and visitors, each with its own broadband "so that the staff connection will not be affected by heavy resident or visitor use". A resident's network is their home internet, so the portal belongs on the visitor network. The comparison of a captive portal and a WiFi password covers encryption and isolation.

What the sign-in page should ask for

NHS England requires the provider's registration screen to let people "sign up to the terms and conditions and Acceptable Use Policy" before they get access, which is a sensible minimum anywhere. Beyond that, ask only for what you will use:

• Terms of use or an acceptable use policy, accepted before connecting.
• An email address or a mobile number, if the practice will send something to it, with a separate marketing box that is not ticked in advance.
• A first name, if messages will be personalised.
• A short privacy notice on the page itself saying what is collected, why, and how to opt out.

Leave off date of birth, home address, NHS number, the clinician's name, the reason for the visit and any question about symptoms, treatment or medication. A free-text box such as "How did you hear about us?" can draw health details out of people too.

Marketing consent cannot be folded into the WiFi terms. The ICO's guidance on when consent is appropriate describes a cafe whose WiFi terms say that giving contact details is consent to marketing, and concludes: "This is not therefore valid consent." The guest WiFi GDPR compliance checklist covers the other UK rules.

Why health data stays off the WiFi form

Health is one of the nine special categories of personal data in the UK GDPR. The ICO's guidance on special category data quotes the definition in Article 4(15): "personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status". To use it, an organisation needs a lawful basis under Article 6 and also one of the Article 9 conditions, such as explicit consent or the health or social care condition. A WiFi sign-in needs none of it, so the simplest design collects none.

The definition reaches past medical records. The ICO lists "appointment details, reminders and invoices which tell you something about the health of the individual". A GP or hospital appointment on its own reveals nothing, it says, because it may be a check-up, but "you could reasonably infer health data from an individual's list of appointments at an osteopath clinic or from an invoice for a series of physiotherapy sessions".

A WiFi sign-in log is a list of visits. The same email address joining a physiotherapy clinic's WiFi every Tuesday for two months says much what an appointment list would, and at a fertility, sexual health or mental health clinic, being on the list at all may reveal something. If you intend to infer health status, or to treat people differently because of it, the ICO says you are processing special category data "regardless of how confident you are that the inference is correct". Where there is "an obvious risk that other people could (rightly or wrongly) infer something" sensitive, the ICO asks you to think carefully about whether there is anything more you can do to minimise those privacy risks. For a clinic, that means:

• Never segment or target WiFi guests by the clinic, department or service they visited.
• Limit who can see visit logs, and delete or anonymise records you no longer need.
• At a specialist clinic, ask whether you need contact details at all; accepted terms may be enough.

Vets are a different case. The definition covers the health of "a natural person", so a pet's vaccination record is not special category data. The owner's name, email address and phone number are still personal data.

Filtering web content in waiting areas

NHS England requires the public NHS Wi-Fi network to "block access to illegal or inappropriate content, such as content listed by the Internet Watch Foundation", and the HSCN guidance requires, at a minimum and where the provider does not use NHS Secure Boundary, that "access is denied to sites on the Internet Watch Foundation blocklist". Private practices are not bound by those documents, but a waiting room with children in it raises the same question.

The UK's Friendly WiFi scheme calls itself "the UK Government initiated Public WiFi Safety Assurance Standard", and venues showing its symbol "have committed to blocking access to pornography, child sexual abuse material, and other illegal content identified by the Internet Watch Foundation and trusted security lists". Approval carries an annual licence fee, and its FAQ says the filtering "will not block certain content such as pornographic pictures that appear within social media sites, encrypted sites".

Filtering is set on the network: the firewall, a filtered service from the broadband provider, or a filtering DNS service. The sign-in page only controls who gets online, and CaptiFi does not filter web content.

Marketing that suits a private practice

Beyond consent, regulators draw two lines for a private clinic, dentist or vet. The first separates service messages from marketing. The ICO's guidance on identifying direct marketing treats messages that "confirm or remind them about appointments" as service messages, but adds: "If your service message has elements that are direct marketing, even if that is not the main purpose of your message, then it will count as direct marketing." Appointment reminders belong in the booking system, which knows the appointment. For vets, the RCVS draws the line in its guidance on advertising: email marketing "would include vaccination reminders and information regarding any promotions, but not appointment reminders or information about 24-hour emergency first aid and pain relief". It also warns that emailing clients to ask for marketing consent "may amount to direct marketing without consent".

The second is each profession's advertising rules. The GDC's guidance on advertising asks dental practices to keep information current and accurate, include the GDC registration number wherever a registrant is named, avoid claims "likely to create an unjustified expectation about the results you can achieve", and make clear "whether the practice is NHS (or equivalent health service), mixed or wholly private". A marketing email is practice publicity, so the rules apply to it.

On CaptiFi's Growth plan, review requests go by email, and by text if you switch it on, to guests who gave consent, 24 hours after they connect by default. Ratings at or above your minimum go to Google, Tripadvisor or Yelp; lower ratings open a private feedback form that still shows the public links, and each guest is asked at most once every 90 days per venue. For negative reviews, the RCVS social media guidance advises vets to avoid public disputes, suggests inviting the client to contact the practice directly, and warns against disclosing confidential information.

What does not belong in a practice's WiFi marketing:

• WiFi access that depends on agreeing to marketing.
• Messages chosen by condition, treatment or the service someone used.
• Promotions added to a reminder that patients expect to be neutral.
• An email after the visit asking for marketing consent, which is itself marketing.

Setting it up on CaptiFi

CaptiFi is an external captive portal for ten WiFi vendor ecosystems, and its setup guides recommend isolating guests on a separate VLAN or guest network. Guests sign in with an email address or a phone number on your branded form. In the splash page builder, first name, last name and email can each be shown or hidden and set as required or optional, so a clinic can ask for an email address alone. The Terms and Privacy section holds your terms, links to your policies and a privacy notice shown on the form itself. Marketing consent is a separate question, and guests who say no still get online. A required checkbox with your own wording can record agreement to an acceptable use policy.

Session length and per-guest bandwidth limits are set for each venue under My Locations, Edit site. Bandwidth limits are enforced on UniFi, CaptiFi devices and RADIUS-based systems, and not yet on TP-Link Omada, Cisco Meraki or cloud-only UniFi. On CaptiFi access points and UniFi controllers, a waiting-room TV can be added as a pre-authorised device: it skips the sign-in page, is not counted as a guest and receives no marketing. To answer an erasure request, use Delete (GDPR) or Anonymise (GDPR) on the Guest Visits page.

Branded sign-in, contact capture and email export are on Essentials, from $69/mo on the pricing page. Review requests, email marketing and SMS are on Growth, and the multi-site dashboard for a group of practices is on Pro. The review automation page shows the request flow, and you can try it on your own network with a 30-day free trial.

Sources, linked above and checked on 3 October 2026: the ICO, NHS England Digital, the Department of Health and Social Care, Friendly WiFi, the RCVS, the GDC and CaptiFi's customer documentation. General information, not legal advice. Friendly WiFi, Google, Tripadvisor, Yelp, UniFi, Omada and Meraki are trade marks of their owners; CaptiFi is not affiliated with or endorsed by them.