Web shops for regulated industries: pharma, medical devices, health
A web shop in the health sector is not a normal online store. Registration duties, logo requirements, specially protected data and accessibility belong in the architecture from day one, not in a plugin bolted on later. We build shops that carry these requirements cleanly at the technical level. And you speak directly with the developer.
What the law requires
Four sets of rules determine how a web shop for pharma, medical devices or health services must be built. Every statement links to the official source. Note: the Austrian and German official sources are German-language pages.
Distance selling of medicines in Austria
Anyone who wants to sell medicines through a web shop in Austria needs a BASG registration (Bundesamt für Sicherheit im Gesundheitswesen, the Austrian Federal Office for Safety in Health Care) under Section 59a of the Austrian Medicines Act (Arzneimittelgesetz, AMG). Only non-prescription medicinal products that are authorised in Austria may be sold at a distance.
Registered providers are entered in the official list of mail-order pharmacies and must display the common EU logo for distance selling of medicines, which links to their register entry. Customers can use it to verify directly whether a shop is legitimate.
Sources: BASG: medicines sold at a distance (in German) · BASG: distance selling for health professionals, Section 59a AMG (in German) · Official distance-selling register (in German)
Germany: the BfArM mail-order register
For the German market, the BfArM (Bundesinstitut für Arzneimittel und Medizinprodukte, the German Federal Institute for Drugs and Medical Devices) maintains the mail-order register (Versandhandelsregister). Only pharmacies and traders listed there may offer human medicines online. Since October 2015 the EU security logo (EU-Sicherheitslogo) is also mandatory: it must appear on every page where medicines are offered for mail order and must link to the provider's register entry.
A note on implementation: the logo may only be used by registered traders. That is why we deliberately do not embed it on this page. In the shop of a registered client, however, it must be embedded and linked in a technically correct way.
Sources: BfArM: mail-order register (in German) · BfArM: EU security logo (in German)
GDPR: health data enjoys special protection
Health data belongs to the special categories of personal data under Art. 9 GDPR. Processing it is prohibited in principle and only permitted under the narrow exceptions of Art. 9(2) GDPR. Even an order history containing medical devices or medicines can allow conclusions about a person's health and therefore falls within this protected scope.
This creates concrete duties for running the shop: data processing agreements under Art. 28 GDPR with every service provider involved (hosting, payments, e-mail, analytics) and consistent data minimisation under Art. 5(1)(c) GDPR. Only what is actually necessary for the purpose is collected and stored.
Sources: Austrian Data Protection Authority: special categories of data (in German) · GDPR full text (EUR-Lex)
Accessibility: the BaFG has applied since 28 June 2025
The Barrierefreiheitsgesetz (BaFG, Austrian Accessibility Act) implements the European Accessibility Act and has applied since 28 June 2025. Online shops are explicitly covered. The benchmark is the harmonised standard EN 301 549, which for web content is essentially aligned with WCAG 2.1 level AA. Violations can lead to administrative fines of up to 80,000 euros.
Important for merchants: the exemption for microenterprises only applies to services. Anyone selling products only benefits from certain relaxations, not from a full exemption. A web shop in the health sector should therefore plan for accessibility from the start instead of retrofitting it.
Sources: Austrian Ministry of Social Affairs: Accessibility Act (in German) · W3C: WCAG 2.1
What we implement technically
Our contribution is the software: a shop architecture in which the regulatory requirements are built in as technical components.
Regulated product data
Structured product models with mandatory information, authorisation status and a clean separation of non-prescription and non-shippable items, so the shop only offers what it is allowed to offer.
B2B pricing & authentication
Protected price lists, customer groups and approval workflows: professional buyers see their conditions only after logging in, public visitors only see approved content.
Compliance-ready content workflows
Approval processes and versioning for product texts and health information, so changes stay traceable and nothing unreviewed goes live.
Logging & audit trails
Structured logging of orders, consents and data changes: who changed what and when, provable instead of merely claimed.
EU-focused architecture
EU hosting, documented data flows and service providers with whom data processing agreements can be concluded. The architecture follows the GDPR, not the other way round.
We are not legal advisors. We implement the technical requirements and work together with your legal counsel. Whether a registration is required and which exemptions apply to your business is something you clarify with your legal counsel. We deliver the implementation that carries those requirements reliably.
Already live
No invented metrics: two projects you can open and verify yourself.
hospitec.at · Medical technology e-commerce
Web shop for medical technology and endoscopy accessories for a company that has existed since 1984 and supplies professional B2B customers. Product catalogue, enquiry and ordering flow for a regulated product range.
Visit hospitec.atinnovative-frame.com · International shop
Multilingual e-commerce (four language versions) with Stripe payment processing for a Viennese manufacturer. It shows that we build international shop architectures with a real checkout, not just catalogues.
Visit innovative-frame.comA shop that stands up to scrutiny.
Free intro call. We listen, name the technical requirements of your project and tell you honestly whether we are the right fit.