How to choose a dental clinic website design company in Saudi Arabia: eight things to settle before you sign

Choose a dental clinic website design company by what you keep, not by the mockup. Get four things in writing before you sign: the domain, hosting and Google accounts in the clinic’s name, a full copy of the site on request, a plan for the patient data your booking form collects, and page text that sits in the HTML.

This guide is for clinic owners and medical directors in Saudi Arabia who are about to hire a web design company, or are unhappy with the one they have. On 5 November 2026 we ran 60 autocomplete searches, read four Google results pages from a Riyadh location, read 17 pages from 16 sites that sell web design or explain how to choose one, opened the English text of the Personal Data Protection Law on SDAIA’s site and five Google help pages, and rechecked how 18 live dental clinic sites are built. We sell SEO for clinics, not design. We say below where that could bias us, and the limits are at the end.

Free 5-point SEO audit before you brief a web company. Send us your clinic’s website address. Within 48 hours a senior specialist sends you 5 prioritized fixes with the evidence, including what Google sees on your key pages today, so your brief starts from facts. Get your free SEO audit.

The short answer: five findings and what to do

What we found	What to do
For the 11 .com and .care domains in our test, the public record names the registrar and the dates but not the owner. The 7 .sa domains returned no record in the service we used.	Log in to the registrar together. The account must be in the clinic’s name.
Of 18 clinic home pages, 12 link a privacy policy and 5 show no privacy wording at all. Of 8 booking pages with a real form, 1 puts consent wording inside the form.	Ask what the form collects, where it goes and which text the patient sees.
5 of 18 sites sit behind Cloudflare, which hides the host. Of the other 13, the network record places 1 in Saudi Arabia and 9 abroad.	Get the server and database location in writing.
2 of 17 home pages send under 200 words in the HTML (62 and 160) and show 399 and 2,079 words once scripts run.	Check the page source. Keep the text in the HTML.
Of 9 Arabic “how to choose” guides on page 1, 3 say who should own the domain, hosting and code, 2 name the Saudi data law and 0 mention the Ministry of Health.	Do not rely on a seller’s checklist for a clinic’s risks.

What clinic owners search, and what they find

We ran 60 autocomplete searches with the Saudi setting (28 English, 32 Arabic, from a machine in Egypt, capped at ten). Sixteen English and 12 Arabic searches returned anything. The job with Saudi words returned nothing: “dental website design saudi arabia”, “dental clinic website design riyadh”, «تصميم موقع عيادة اسنان» and «شركة تصميم مواقع عيادات». What did return: “dental clinic website design” and “dental website design” (ten each, with suggestions that name Australia, the UK, Toronto and India), «تصميم موقع طبي» (three), «شركة تصميم مواقع الرياض» (three) and «شركة تصميم مواقع السعودية» (four, one of them «كيف تختار شركة تصميم مواقع في السعودية»). “who owns my website” returned ten. Autocomplete shows suggestions, not volumes, so we do not claim a search count.

Page 1 from Riyadh for four searches (titles and addresses only, no positions):

• «تصميم موقع عيادة اسنان»: a design-tool template page, an AI website builder, two freelance marketplace pages, a Pinterest board of clinic interiors and three agency pages.
• «كيف تختار شركة تصميم مواقع»: nine pages, each from a company that sells web design or a freelance service. None is about clinics.
• “dental clinic website design company saudi arabia”: eight pages from companies that sell the job, on seven sites.
• “how to choose a web design company for a dental clinic”: nine pages from dental marketing vendors, agencies, lists of agencies, a LinkedIn article and a dental trade magazine. None mentions Saudi Arabia in its title.

Every answer comes from someone who sells the service. We found no page that tests live clinic sites or names the Saudi rules a clinic website meets. We are also a seller, which is why we show our method.

What 18 live clinic sites are built on

We used the same 18 dental clinic sites as our phone test of clinic booking paths: sites that appear on page 1 in Riyadh and Jeddah for five searches. On 5 November we read each one twice, once as plain source code and once rendered in Chrome set to a phone. One site refused the plain fetch, so source facts cover 17 and Chrome facts cover 18.

What we read	Sites
WordPress files or tag in the source (one with a Gatsby front end)	10 of 17
Of those, built with the Elementor page builder	6 of 10
Of those, a Rank Math, Yoast or All in One SEO signal	9 of 10
Tool names and version numbers printed in the page source	9 of 17
A Salla store theme, a Nuxt app, a Laravel app	1 each
No platform signal found	4 of 17
A visible builder credit in the footer	2 of 18
A real robots.txt, listing a sitemap	16 of 17, 14 of 16
A canonical tag	16 of 17

Nothing here says one platform is better. It says what you will be handed. Most clinic sites run on a common CMS with a page builder, which is fine if you receive the accounts, the plugin list and the licences. Nine sites print the names and version numbers of their tools in the page source. That is not a fault, but it shows what someone has to keep updated, and you should know who that is.

On domains, the 11 .com and .care names were registered between 2004 and 2024. The public record shows the registrar (one registrar holds 7 of the 11) and the expiry date, and never an owner. Four expire in 2027, in January, May, June and August. Ask who gets the renewal notice.

On hosting, 5 of 18 sites sit behind Cloudflare, so the real server is hidden. Of the other 13, the network record names a Saudi network for 1, a network registered abroad for 9 (Germany 4, the United States 3, Finland 1, the United Kingdom 1) and gives no country for 3. A network’s registration country is not a server’s location, and our visitor had an Egyptian address, so treat this as a reason to ask, not a finding about any clinic.

What the sellers’ pages leave out

We read the 9 Arabic guides on page 1 for «كيف تختار شركة تصميم مواقع» and the 8 pages (7 sites) on page 1 for the English Saudi dental search. Four pages needed Chrome because they build their text with scripts.

Topic	9 Arabic guides	8 seller pages
Says who should own the domain, hosting and code	3	1
Raises moving the site or changing host	2	0
Names the Saudi personal data law	2	1
Mentions the Ministry of Health	0	1

Only one of the nine Arabic guides mentions clinics, as one item in a list of business types. The seller pages are about dental clinics by design, yet only one mentions the Ministry of Health. In this sample, a checklist written by the party being chosen covers what it sells (design, speed, search) and mostly skips what protects the buyer. The three guides that do cover ownership are useful, so read them too.

What the data law says that touches a clinic website

A booking form collects a name and a phone number, often a treatment and a complaint. The English text of the Personal Data Protection Law that SDAIA publishes lists names and contact numbers as personal data (Article 1) and defines Health Data as data about a person’s health condition or the health services the person receives. Five articles matter when you hire someone to build the form:

• Article 12: the controller shall use a privacy policy and make it available to data subjects before collecting their data, stating the purpose, the data, the means of collection, processing, storage and destruction, and the person’s rights.
• Article 13: when collecting directly, the controller informs the person of the purpose, which data is mandatory, who receives it and whether it will be transferred, disclosed or processed outside the Kingdom.
• Articles 8 and 19: the controller selects processors that give the necessary guarantees and monitors them, and applies organisational and technical protection, including during transfer.
• Article 20: the controller notifies the authority of a breach, and the person where the damage or prejudice test is met.
• Article 29: sets conditions for transferring personal data outside the Kingdom, including adequate protection and the minimum amount of data.

Our reading, which is not legal advice: the clinic is usually the controller, and the web company and the host handle the form data for it. That makes the contract the place to say what they may do with the data. The Implementing Regulations carry detail we did not read, so take the contract to a lawyer.

On the 18 sites, 12 home pages link a privacy policy on their own address, 1 shows the words with no link, and 5 show no privacy wording at all (after scrolling to the bottom). The policy may sit on another page, but a patient sees the form first. We then reloaded the booking page our earlier test reached on each site and listed every form with three or more fields: 8 sites had one. Only 1 had consent wording and a privacy link inside the form, with a separate box for marketing messages, and it names a Personal Data Protection Law.

Eight things to settle before you sign

1. Put the accounts in the clinic’s name. That means the domain registrar, hosting, DNS, Google Search Console, Google Analytics 4 and your Business Profile. Google’s Search Console help says a property needs at least one verified owner, and that a verified owner proves ownership with a token on the site. If only the agency’s account is an owner, you depend on it to add you. In GA4, an Administrator assigns roles at account and property level. Good answer: you log in to the registrar together and see your clinic’s name, email and renewal date. Warning sign: “we handle all of that for you” with no login for you.
2. Ask what you take with you if you leave. A full copy of the files and the database, the list of plugins and licences and whose name each is in, the logo and image source files, and the number of days it takes. Six of ten WordPress sites use a page builder, so ask which paid parts the site needs. Warning sign: the code is “ours until the final payment”, or a monthly fee with no export.
3. Decide where patient data goes before the form is built. Ask in writing what the form collects, where entries are sent (email, database, a messaging tool), who can read them, how long they are kept, where the server and backups are, and who tells you if they leak. Good answer: a one-page data sheet in the contract and a privacy policy linked from every form with a consent line. Warning sign: “it is in the cloud” with no location, or entries forwarded to a personal mailbox.
4. Test the first phone screen before approving the design. Ask for a prototype you can open on your own phone, in Arabic and English: a patient should be able to call or start a booking without scrolling. In our earlier test, 4 of 18 first screens had nothing to act on. Warning sign: desktop mockups only, or a pop-up covering the first screen.
5. Keep the text in the HTML. Google says pages wait in a queue for rendering that can take longer than a few seconds, and 2 of 17 clinic home pages sent under 200 words in the HTML. Open the page source and search for a treatment name, or ask for the page with JavaScript off. Good answer: headings, treatments and doctor names are in the source. Warning sign: a short source file and a large script.
6. List what search needs and who keeps it working. The mobile page has the same content as desktop, as Google’s mobile-first page asks. Each page has one H1, its own title, a canonical tag, an XML sitemap listed in robots.txt, linked language versions and a redirect map if addresses change. In our test one site answered both robots.txt and sitemap.xml with its home page, and 5 of 18 had no visible H1 (from our earlier test). Warning sign: “SEO included” with no list. For a redesign, read how to keep rankings when you redesign.
7. Settle who writes the medical text. The design company’s job is layout, speed, forms and structure. Treatment text, claims, offers and before and after photos are the clinic’s decision, approved by a dentist. Only 1 of the 8 seller pages mentions the Ministry of Health and none of the 9 guides does. In our earlier test, 3 of 18 first screens called the clinic the best or number one. Warning sign: a company that offers to write “best dentist” copy.
8. Read the after-launch terms. Who updates the platform and plugins, who restores a backup and how fast, how a change request is handled, the contract term and the exit notice, and whether a “made by” credit is allowed (2 of 18 sites show one in the footer). Good answer: a named contact, response times in writing and an exit clause with handover days. Warning sign: automatic renewal with a long notice and no stated support hours.

Who does what: design, search and you

A design company builds the site. A search provider decides what Google should find on it, and a clinic owner decides what the site may claim. Hand the design company an SEO brief before design starts: the pages you need (one per treatment, branch and doctor, where a dentist can approve the text), the titles and headings, and the list of old addresses to redirect. Our guides to local SEO for clinics and whether a clinic needs a website at all cover the search side, and how to choose an SEO agency covers the other hire. If you want a second pair of eyes on a proposal or a staging site, that is part of our dental SEO service.

Before you publish: health advertising rules

Treatment pages, offers, before and after photos and testimonials can count as health advertising in Saudi Arabia. Check the current Ministry of Health requirements before you publish any of them, and have a dentist approve the medical accuracy of every treatment page. This guide contains no treatment advice: it is about how to hire the company that builds the site.

How we checked, and the limits

On 5 November 2026 we ran 60 Google autocomplete searches with the Saudi setting (28 English, 32 Arabic, from a machine in Egypt, capped at ten) and read four Google results pages with personalisation off from a Riyadh location, noting titles and addresses and reporting no positions. We then read 17 pages from 16 sites (9 Arabic guides and 8 English seller pages) with a plain fetch, and with Chrome where the plain fetch returned under 300 words; one site returned a short page on one pass and the full text on another, and we counted the full text. We counted topics with patterns and read every hit and every zero by eye, so a page may say something in words we did not match. The sellers’ own claims are theirs and we did not verify them. We name no seller. The 18 clinic sites are the page 1 results of our 2 November searches, so they are not a random sample and they are clinics that already rank. We read them as plain source (one refused the plain fetch with a 403 from Cloudflare) and rendered in a 412 by 915 phone window with Arabic as the language, from an Egyptian address, so consent tools, redirects and the network that answers can differ for a Saudi visitor. Platform and plugin signals come from the page source: a plugin can hide its signature. We looked up the domains with the RDAP service rdap.org, which returned no record for .sa names. A network’s registration country is not the location of a server, and Cloudflare hides the origin. Booking forms were listed, not submitted, on the page our earlier test reached, and a privacy policy may exist on a page we did not open. No clinic is named. The PDPL text was read and its Implementing Regulations were not, and we are not lawyers. No patients, bookings, revenue or ranking were measured, and no figure here says a website will raise bookings. These are readings of one day.

Sources

Saudi Data and AI Authority (SDAIA), Personal Data Protection Law, English text (PDF), fetched on 5 November 2026: sdaia.gov.sa. Google Search Central, JavaScript SEO basics (last updated 2026-03-04) and Mobile-first indexing best practices (last updated 2025-12-10). Search Console Help, Verify your site ownership and Managing owners, users, and permissions. Analytics Help, Access and data-restriction management. All opened on 5 November 2026. The clinic sites, domain records, seller pages and autocomplete and search readings are our own, and no clinic or seller is listed by name.

Is your clinic’s site ready for a new build? Our free 5-point audit shows what Google finds on your current site, which addresses to keep, and what to put in the brief for the web company. It is the first step of our dental SEO service for clinics in Saudi Arabia and the Gulf. No obligation, delivered within 48 hours. Request your free audit.