Dental website user behaviour analysis: what visitors do, and what you may record

What behaviour data can and cannot tell you

Behaviour data is the record of actions on the page: page views, clicks, scrolls, form starts. It's good at "where" and poor at "why". It also stops at the edge of the website, so it never sees the phone call to reception the next morning.

Behaviour data tells you where to look. Bookings tell you whether a change worked.

Paths and drop-off in GA4

GA4 is Google Analytics 4, Google's free analytics tool. Two of its reports do most of the work.

A path exploration shows the sequence of pages or events visitors follow, forwards from a starting page or backwards from an ending point¹. Working back from the booking confirmation shows which treatment pages feed it.

A funnel exploration shows the steps towards a goal and how many visitors fall out at each. GA4 allows up to 10 steps, and a visitor who misses a step isn't counted in later ones².

Drop-off is the share of visitors who leave between one step and the next. The biggest drop is the first page to look at. Building these reports is covered in explorations and funnels in GA4.

Two limits apply. GA4 only sees visitors your cookie setup lets it see; how consent affects what analytics can see covers that. And Google's policy is that nothing it could recognise as personally identifiable reaches it, with its help page warning that page URLs and titles are where this often slips through³. A confirmation URL carrying a patient's email address is one way. Check yours.

Heatmaps and scroll depth

A heatmap is an image of a page coloured by where visitors clicked, tapped or scrolled, added up across many visits. Scroll depth is how far down a page a visitor got.

GA4's enhanced measurement scroll event fires once, when a visitor reaches 90 per cent of the page height⁴. That shows who reached the bottom, nothing about the middle. Google Tag Manager's scroll depth trigger fires at percentages you choose⁵, enough to see whether visitors reach the fees on an implant page.

Heatmaps need a separate tool, such as Microsoft Clarity or Hotjar. In both, heatmaps and recordings come from the same script⁶⁷, so the consent question below applies to heatmaps too.

Session recordings and patient data

A session recording is a replay of one visitor's visit: pages, scrolling, taps and mouse movement, rebuilt so you can watch it like a video. It's the most detailed behaviour data there is, which is the problem on a dental site.

My position: I do not switch on session recording until the practice has made a written data protection decision, and I never record a visitor who has not agreed to it.

PECR. The Privacy and Electronic Communications Regulations cover any technology that stores or reads information on a visitor's device. The ICO's guidance, updated 29 April 2026⁸, names scripts, cookies and local storage among them⁹. The analytics exemption is narrow: the sole purpose must be statistics about how the site is used, to improve it¹⁰, and visitors must be told and given a simple, free way to object. In my reading, watching one visit back isn't statistics, so recording needs consent.

UK GDPR special category data. Health data is personal data about physical or mental health, "including the provision of health care services", that reveals someone's health status. The ICO's examples include appointment details¹¹. A recording of someone on your booking page, or typing into a "tell us about your problem" box, sits very close to that line. Special category data needs a lawful basis under Article 6 and a separate condition under Article 9. The ICO says explicit consent must be a clear statement, specify the nature of the data, and be separate from other consents¹². An "accept all" cookie click is a weak fit. Whether another Article 9 condition applies is for your data protection adviser, not me.

Risk assessment. The ICO's list of processing likely to result in high risk includes tracking behaviour online, with web tracking as an example¹³. A data protection impact assessment (DPIA), the written risk assessment UK GDPR expects in such cases, is where this decision belongs.

What the tools do today

Checked against vendor documentation on 1 October 2026.

Two rows matter most. Clarity's default shows the words on the page, and the page address (a dentures page, say) says something about the visitor. And Clarity's consent mode controls cookies, not collection. PECR covers reading from a device as well as storing on it, so I stop the script loading at all until the visitor agrees. Banner and tag setup is on the cookie consent page.

Turning what you see into fixes

A finding is a guess until a change proves it. I make one change at a time and judge it against booked consultations, not clicks.

Testing changes like these without fooling yourself is covered in conversion rate optimisation for a practice site. Behaviour analysis is one part of what an engagement includes, alongside tracking that joins visits to bookings.

If you want to know how your site's paths, funnels and recording setup hold up, email me at Fayez@imfayez.com with your web address. The first look is free: I go through your site's key paths from the outside and reply with what I find. You can read how I work first.