Indian hospital website benchmark 2026: privacy, speed, access and booking on 100 sites
Data collected on by Gaurav Phogat. Method, scoring rubric and dataset are published below.
60 of 100 Indian hospital websites load Meta, Google or Microsoft advertising trackers the moment a page opens, before the visitor clicks anything, and only 11 show a cookie consent banner. Fewer than one in four pass Google’s Core Web Vitals on real-user data, 86% fail at least one basic accessibility check, and only 14% offer a genuine Indian-language version. On a 100-point benchmark of the things patients and search engines need, the median site scores 64.
This article is part of the healthcare digital growth series, best read in order from the pillar.
Last updated: 15 October 2026.
This is a measured baseline, not an opinion piece: 100 sites, one crawl date (14 October 2026), one published rubric and a dataset anyone can check. Hospitals are not named. The aim is to show where the sector stands and what to fix.
Disclosure. I work in hospital digital marketing. All checks were automated and applied identically to every site; no site was scored by hand.
Download: the dataset (CSV, 100 rows, 64 columns) · the press kit, charts and summary PDF. Free to reuse with credit under CC BY 4.0.
The numbers at a glance
| Finding | Result across 100 sites |
|---|---|
| Load ad trackers before any click | 60% |
| Show a cookie consent banner | 11% |
| Ad-tracking code on doctor profile pages | 44% of 73 profiles checked |
| Privacy policy mentions the DPDP Act | 22% of 72 readable policies |
| Pass all three Core Web Vitals (real users) | 22% |
| Lighthouse mobile performance of 90+ | 0 sites |
| Fail at least one basic accessibility check | 86% |
| Offer a real Indian-language version | 14% |
| Show an emergency number on the homepage | 81% of 90 general hospitals |
| Publish any prices | 36% |
| Doctor profile shows a registration number | 7% of 73 profiles |
| Booking call to action on the homepage | 95% |
| Median benchmark score | 64 / 100 |
Finding 1: most hospital websites track visitors for advertising before asking
63 of the 100 sites carry advertising tracking code: the Meta Pixel on 58, a Google Ads tag on 55, and Microsoft, LinkedIn or Taboola tags on a handful more. On 60 sites those trackers loaded on first visit, with no click, scroll or consent choice made. Only 11 sites showed a cookie consent banner, and on 6 of those 11 the trackers had already loaded before the visitor answered it.
The pattern is strongest where marketing budgets are largest. Ad trackers load on arrival on 78% of multi-city chain sites, 70% of specialty hospital sites, 50% of metro standalone hospitals and 35% of tier 2 hospitals.
Where the tracking sits matters as much as whether it exists. On 44% of the doctor profile pages checked, advertising code was present in the page itself. A doctor profile tells an ad platform that a browser looked at, say, an oncologist or a fertility specialist. That is how retargeting works, and it is the kind of signal that health privacy rules and the ad platforms’ own health policies treat with care. These counts are minimums: tags fired later through a tag manager were not counted.
None of this is evidence that any hospital has broken a law. India has no stand-alone cookie law, and consent tooling is new to most Indian websites. But the Digital Personal Data Protection Act requires clear notice and consent for processing personal data, and its main obligations take effect by May 2027. My DPDP Act guide for hospital marketers sets out what that means for pixels, retargeting and WhatsApp.
Finding 2: privacy policies have not caught up with the DPDP Act
79% of homepages link to a privacy policy, and 72 of those policies could be read automatically. Of those 72:
- 69% mention health or medical data.
- 46% explain how to withdraw consent.
- 39% name a grievance or data protection officer.
- 22% mention the Digital Personal Data Protection Act at all.
Multi-city chains were the most likely to have updated (33% mention the Act); only 9% of metro standalone hospitals and 17% of tier 2 hospitals do. A privacy policy written for the IT Rules of 2011 will not describe what a 2026 website with several ad tags actually does. The free DPDP consent notice template is a starting point.
Finding 3: fewer than one in four pass Google’s Core Web Vitals
On real-user data from the Chrome UX Report, only 22% of hospital websites pass all three Core Web Vitals; 35% are rated poor on at least one. In the lab, no site reached a Lighthouse mobile performance score of 90 and the median was 43.5.
The causes are visible in the numbers. The median homepage weighs 5.2 MB, and 29% weigh more than 10 MB, usually from heavy hero images, video banners and sliders. Median Total Blocking Time is 686 ms, typically from chat widgets, tag managers and the advertising scripts in Finding 1. The median homepage contacts 14 third-party domains on load. Tier 2 hospitals fare worst: 10% pass Core Web Vitals. My Core Web Vitals glossary entry explains each metric.
Finding 4: 86% fail a basic accessibility check
Five simple, automated checks were run on every homepage. They do not prove a site is accessible, but failing any of them means a screen-reader user or someone with low vision will hit a barrier.
- 70% have links or buttons with no readable name, such as icon-only buttons a screen reader cannot announce.
- 59% have visible form fields with no label.
- 42% have images with no alt text.
- 17% disable pinch-to-zoom on mobile.
- Only 14 of 100 pass all five.
India’s Rights of Persons with Disabilities Act, 2016 and the government’s own web accessibility guidelines set the expectation that services, including health services, are reachable by everyone. Hospital websites are used by many older and visually impaired patients, and a booking form a screen reader cannot read is a direct barrier to care.
Finding 5: what a patient can and cannot find
- Emergency number. 81% of the 90 general hospitals show an emergency or ambulance number on the homepage, and 62% show it in the first screen. The other 38% make a patient in an emergency scroll or search.
- Prices. 36% publish any price, on the homepage or a health-check or packages page.
- Language. 32% offer any Indian-language option, but only 14% have a genuine Indian-language version. For 16 of the other 18, the option is a machine-translation widget.
- Doctor credentials. Only 7% of the doctor profiles checked show the doctor’s medical council registration number, which patients can use to verify a doctor on the National Medical Commission register.
Finding 6: booking buttons are everywhere, booking flows are not
95% of sites have a booking call to action, 83% show it in the first screen and 93% use a tappable phone link. Behind the button, 63% lead to an on-site booking form, 12% hand the patient to a separate portal or app, and on 25% no booking form or portal could be detected from the homepage; the button opens a pop-up, a phone number or a page with no form in its server HTML. Tier 2 hospitals are weakest: only 60% show the booking button in the first screen.
Finding 7: doctor profiles list degrees but not timings
87% of sites have a doctor directory and 78% have individual doctor profiles that the audit could find. Of the 71 profiles readable from server HTML, 80% list qualifications and 87% have a booking button, but only 55% show OPD timings and 34% carry Physician schema markup (56% of chains, 16% of metro standalone hospitals, none in tier 2). See doctor profile pages that convert and the free doctor profile page template.
Finding 8: structured data is common, medical structured data is not
77% of homepages carry JSON-LD structured data, but only 55% use a medical type such as Hospital or MedicalOrganization, 63% link official profiles with sameAs and 10% use FAQ markup. On AI-search readiness, only 2 sites block the major AI crawlers, 34% publish an llms.txt file and 53% combine a medical schema type with sameAs links. See structured data for hospitals and how hospitals get cited by AI search.
Finding 9: WhatsApp is missing from more than half of homepages
Only 44% of homepages have a clickable WhatsApp link and 29% run a chat widget; 37% offer neither. Metro standalone hospitals are lowest at 20%. If you add WhatsApp, design consent and routing in from the start: see WhatsApp Business API for hospitals.
Scores by segment
Each site was scored out of 100 across six categories. The privacy, accessibility and patient-information checks above are reported separately and do not change the score.
| Segment | Sites | Median | Speed | Booking | Doctors | Schema | AI | |
|---|---|---|---|---|---|---|---|---|
| Specialty | 10 | 75 | 50% | 91% | 70% | 63% | 62% | 76% |
| Chains | 40 | 69 | 42% | 86% | 76% | 66% | 50% | 74% |
| Metro standalone | 30 | 56 | 43% | 83% | 57% | 43% | 21% | 63% |
| Tier 2 | 20 | 47 | 40% | 72% | 54% | 33% | 37% | 59% |
| All 100 | 100 | 64 | 43% | 83% | 65% | 52% | 40% | 68% |
Median is the total out of 100; the other columns are the average share of available points in each category. The best-scoring sites are not automatically the most private: 80% of sites scoring 75 or more carry ad-tracking code, against 40% of those scoring under 50. Investment in conversion has come with investment in tracking.
What the top-scoring sites do differently
The 15 sites scoring 80 or more were 9 chains and 6 others. They shared five measurable habits:
- A lighter homepage: median 3.3 MB against 5.2 MB overall.
- On-site booking: 14 of 15 book on their own domain, and all 15 show the button in the first screen.
- Doctor profiles that work as booking pages: 87% show timings and 73% carry Physician schema.
- A clear medical entity: 87% use a medical schema type and all 15 use sameAs.
- A conversation option: 93% have a WhatsApp link.
Methodology
Sample. 100 hospital websites in India in four segments: 40 multi-city hospital chains, 30 metro standalone hospitals (Mumbai, Delhi NCR, Bengaluru, Chennai, Hyderabad, Kolkata and Pune), 20 hospitals in tier 2 cities, and 10 specialty hospitals and chains (eye, fertility, cancer and cardiac). 14 sites on the original list were replaced because the domain was unreachable, parked or redirected to another group. The sample is purposive, not random, so results describe these sites rather than every hospital in India.
Crawl. All sites were crawled on 14 October 2026 in a desktop Chrome browser, with no clicks, scrolls or consent choices made on any site. For each site the homepage was loaded and, from the same domain, robots.txt, llms.txt, the privacy policy linked from the homepage, the booking page, a health-check or packages page, the doctor directory and one doctor profile were fetched. Directories and profiles were parsed as server-delivered HTML.
Privacy checks. Advertising trackers were identified from page source and network requests by their known signatures (Meta Pixel, Google Ads, Microsoft Advertising, LinkedIn Insight, Taboola and similar); Google Analytics and tag managers alone were not counted as advertising trackers. “Load before any click” means a request to the ad platform was observed within about four seconds of page load with no interaction. Tags fired later through a tag manager, or only after scrolling, were not counted, so figures are minimums. Consent banners were detected as visible cookie notices with an accept, reject or manage control. Privacy policies were read as text and searched for references to the DPDP Act, a grievance or data protection officer, consent withdrawal and health data.
Accessibility checks. Five automated homepage checks: images without an alt attribute, visible form fields without a label, links or buttons without a readable name, viewport settings that disable zoom, and a missing page language. These are a subset of WCAG and do not replace a manual audit.
Speed. Lab data from Google PageSpeed Insights (Lighthouse, mobile) on the same day. Field data is the Chrome UX Report result returned by PageSpeed Insights at page or origin level; a site passes when Largest Contentful Paint, Interaction to Next Paint and Cumulative Layout Shift are all rated good. Field data was available for 98 sites. One site failed to render in Lighthouse and one returned an implausibly small page; both were handled as described in the rubric.
Scoring rubric (100 points).
| Category | Points | What earns them |
|---|---|---|
| Speed | 20 | Lighthouse mobile performance (14) plus field Core Web Vitals: all good 6, mixed 3, any poor 0. Field only where lab data was unusable: good 20, mixed 10 |
| Booking | 20 | Booking call to action (4), in first screen (4), on-site booking form 8 or external portal 6, tappable phone link (4) |
| Doctor pages | 20 | Directory (5), profiles found (5), and on the profile: qualifications (3), timings (2), book button (3), Physician schema (2) |
| Structured data | 15 | Any JSON-LD (3), medical type 4 or generic Organization 2, sameAs (3), FAQPage (2), BreadcrumbList (1), Physician schema on profile (2) |
| WhatsApp and chat | 10 | Clickable WhatsApp link 6 or WhatsApp without a link 3, chat widget (4) |
| AI-search readiness | 15 | No major AI crawler blocked 6 (some blocked 3), llms.txt (3), meta description of 50+ characters (2), entity schema with sameAs (2), FAQPage (2) |
Where a component could not be assessed, the total was rescaled over the points that could be. AI crawlers tested: GPTBot, OAI-SearchBot, ClaudeBot, PerplexityBot, Google-Extended and CCBot.
Limitations. One homepage and one doctor profile per site; features that exist only on inner pages, or that load late or inside an iframe, may be missed. The first-screen checks used a desktop viewport. 21 homepages had no privacy policy link, and 7 linked policies could not be read automatically (hosted elsewhere or rendered only by JavaScript). Lighthouse results vary by several points between runs. Nothing in this study is a legal assessment.
Anonymisation and corrections. Hospitals are listed as Hospital 001 to Hospital 100 in random order, with segment only. Names and URLs are not published. If you represent a hospital and believe a result is wrong, contact me and I will re-check it and note any correction on this page.
What to fix first
- Put ad tags behind consent. Load advertising pixels only after a visitor agrees, and keep them off doctor, condition and treatment pages.
- Update the privacy policy for the DPDP Act: name a grievance officer and explain how to withdraw consent.
- Cut homepage weight below 3 MB and defer chat and tag scripts.
- Fix the five accessibility basics: alt text, form labels, named buttons, zoom and page language.
- Show the emergency number in the first screen and add timings and registration numbers to every doctor profile.
For a quick self-check of your own site, use the free hospital digital marketing score.
Questions people ask
63 of the 100 hospital websites studied carry advertising tracking code such as the Meta Pixel or a Google Ads tag, and on 60 of them the trackers loaded as soon as the page opened, before the visitor clicked anything. Only 11 showed a cookie consent banner.
This study does not assess legal compliance. It found that only 22% of readable hospital privacy policies mention the Digital Personal Data Protection Act and 39% name a grievance or data protection officer, with the Act’s main obligations due by May 2027.
Only 22% pass all three Core Web Vitals on real-user Chrome data. No site scored 90 or more on Lighthouse mobile; the median was 43.5 and the median homepage weighed 5.2 MB.
86% failed at least one of five basic automated accessibility checks. The most common problems were buttons with no readable name (70%), unlabelled form fields (59%) and images without alt text (42%).
Only 14% offer a genuine Indian-language version. Another 18% offer an Indian-language switcher, almost always a machine-translation widget.
Yes. The anonymised dataset, charts and summary PDF are free to reuse under CC BY 4.0 with credit to this page. Embed codes and a press summary are on the press kit page.
The study is meant to show where the sector stands and what to fix, not to rank or shame individual hospitals.
Read my takes first in Google Search
