Website for professional firms in Ticino: fiduciaries, law firms and medical practices

The website of a professional firm has two jobs: to build trust and to handle confidential data correctly. In practice you need clear information on people, titles and services, a contact form over HTTPS that asks only for the essentials, email on the firm’s domain configured with SPF, DKIM and DMARC, a privacy policy that complies with the FADP and, for lawyers and doctors, factual communication. A complex website is not necessary: for a fiduciary, law firm or medical practice in Ticino a few well-maintained pages and reliable technology are often enough.

What a professional firm’s website should contain

• About us: the people with their titles, licences and languages, with a professional photo if you wish.
• Services or practice areas described concretely, without jargon.
• How to book an appointment, opening hours, phone number and email address.
• Address with a map, parking, public transport stop and step-free access.
• Information for new clients or patients: which documents to bring, how the first meeting works, fees or billing method.
• Legal notice with company name, address and UID number, plus the privacy policy.

Tip: Avoid superlatives and promises of results such as «the best» or «guaranteed success». For lawyers and doctors they do not fit objective advertising, and for a fiduciary they come across as unprofessional.

Many firms in Ticino also advise clients from German-speaking Switzerland, from Italy or from abroad. If you offer advice in German, French or English, say so clearly on the home page and translate at least the main pages. A law firm that advises in German but only has Italian pages will hardly be found on Google by German-speaking clients. For each person, list the languages in which they actually advise.

Secure contact forms

A firm’s contact form often receives sensitive information: symptoms, ongoing proceedings, a family’s tax situation. The most important rules:

• The entire website on HTTPS with a valid SSL certificate, not just the form page.
• Few fields: name, email or phone, general topic, preferred time. Details are discussed at the first meeting.
• A notice next to the form: «Please do not send documents or health data through this form».
• No file uploads in a simple form. For documents, use a client portal or a password-protected transfer tool.
• Check where the plugin stores messages: many form plugins also keep them in the WordPress database. Delete them regularly or turn storage off.
• Spam protection: a solution that does not send data to third parties, or a mention in the privacy policy.
• WordPress, theme and plugins always up to date, because a vulnerable form is a way in.

Remember too that the form message reaches the firm as an email. Transport between mail servers is usually encrypted with TLS today, but it is not guaranteed on every leg. For very sensitive content it is safer if the notification only says «new message» and the text is read in a protected area.

Email on the firm’s domain

An address like office@rossi-law.ch inspires more trust than a free address and stays with the firm when an employee leaves. Above all, only with your own domain can you protect yourself against fake emails sent in your name: fiduciaries and law firms are frequent targets of fraud using forged invoices or payment instructions.

• Role addresses such as office@, accounts@ or appointments@, plus a personal mailbox for each employee.
• SPF, DKIM and DMARC set up in DNS, so others cannot easily send in your name.
• Long, unique passwords for every mailbox and, where possible, two-factor authentication.
• Sensitive documents not as plain attachments: password-protected files with the password sent through another channel, or a secure transfer platform.
• For exchanges with other healthcare providers, many medical practices use sector-specific services such as HIN.

Data protection under the FADP

The revised Federal Act on Data Protection (FADP) has applied since 1 September 2023. For professional firms some points matter in particular:

• Sensitive personal data: health data, but also data on criminal proceedings or social assistance measures, requires extra care.
• Duty to inform: the privacy policy must state who is responsible, for what purpose data is processed, to whom it is disclosed and in which countries.
• Processors: hosting, email provider, booking tool or accounting software process data on your behalf. You need a contract governing that processing.
• Disclosure abroad: check where your providers are based. Special conditions apply to the United States; since 15 September 2024 transfers are easier to companies certified under the Swiss-U.S. Data Privacy Framework.
• Data security breaches: if they pose a high risk to the people concerned, they must be reported to the FDPIC as soon as possible.
• Record of processing activities: mandatory from 250 employees, but also for smaller companies that process sensitive personal data on a large scale or carry out high-risk profiling.

Doctors, lawyers, notaries and auditors are also bound by professional secrecy under Article 321 of the Swiss Criminal Code, independently of the FADP. So choose providers and tools carefully and keep confidential content out of forms, analytics and marketing tools. This is general information and not legal advice: for your specific case, contact your professional association or a specialised adviser.

Tip: Use analytics tools sparingly, or not at all. On a page called «Book a gynaecology appointment», a tracking pixel from an advertising network reveals more than patients would expect.

Online appointment booking

For a medical practice, online booking reduces phone calls, but an appointment is sensitive data too: it reveals that someone is a patient of a particular specialist. Choose a provider that clearly explains where it stores data, ask only for name, date of birth, contact details and a general reason, and send reminders without details of the treatment. For fiduciaries and law firms, a calendar with a few free slots for the initial meeting is often enough.

Technology: what you really need

At HostOn every hosting plan includes free SSL certificates that renew automatically, daily backups and Imunify360 against malware and attacks. A WordPress website for your firm starts at CHF 10.90 per month with WordPress Säntis, billed annually, with email mailboxes on your domain included. If you prefer to keep email separate from the website, the E-Mail Business plan offers 10 mailboxes for CHF 82.80 per year (CHF 6.90 per month), and Email Team up to 50 mailboxes for CHF 178.80 per year (CHF 14.90 per month); a single mailbox costs CHF 34.80 per year. A .ch domain costs CHF 14.90 per year; with WordPress Säntis it is free for the first year.