Module 5 · Money and the first contact

The contact form asks only what it needs

On most small-business websites, the more a visitor writes in the contact form, the better. On a therapy website it’s the opposite. By the end of this lesson you’ll have a contact form that asks only what you need to reply, sent to a business inbox whose provider will sign a privacy agreement (Google Workspace, never personal Gmail), a thank-you page with nothing tracking it, an optional automatic reply, and a first test message that arrived on your own computer.

Why the form asks so little

Picture the usual contact form: a big box labeled “What brings you in?” A frightened stranger will answer it honestly, at 2 a.m., in detail. The moment they do, your website has collected health information: a reason for seeking care, tied to a name and an email address. That message then travels through a form service and lands in an inbox, and none of those places was chosen to hold health information.

There’s a quieter problem too. Any script (a small program running on the page), such as an analytics tool (software that tracks visitors), an advertising “pixel” (a tiny piece of code that reports visitor activity to an ad company) or a chat widget (a pop-up chat box), can read what someone types into a box before they press the button.

The fix isn’t a better privacy policy. It’s not asking the question. Even a name and an email sent to a therapist say something about a person, so the form keeps even that to the minimum. Everything clinical waits for the phone call or for a system built to hold it.

To be straight with you about where the right-hand list comes from: no single published source lists all eight. It follows from one principle, which is that a reason for seeking care is health information, and everything in that column either is one or points at one. The state question sits on the safe side for a practical reason. You can generally only see someone who is located where you’re allowed to practice, so it saves both of you a wasted call, and it’s purely about location. The insurer’s name works the same way: it tells you whether you can take them at all, and says nothing about their health.

The exact form

The kit’s frontend-design skill holds this exact specification (section 8), and Claude builds from it. You’ll see these exact labels on your form. The name column is the label the form uses behind the scenes; you won’t see it on the page, but you’ll see it in the email you receive.

Two small pieces you won’t see on the page:

• A honeypot, not a CAPTCHA. A CAPTCHA is the “click every traffic light” puzzle, and it blocks real people, especially on old phones on bad days. A honeypot is an invisible checkbox called botcheck. Spam robots fill it in; people never see it; anything that arrives with it ticked is thrown away.
• A notification subject that gives nothing away. Every message arrives with the subject New message from your website. Nothing about the person or why they wrote shows on your lock screen.

The crisis line goes above the form

Someone in a very bad moment may use your contact page as if it were a crisis line. So the page opens with the kit’s fixed line, above the form, not just in the footer:

The full crisis block is still in your footer. You built it earlier in the course. Your reply promise sits on the same page, word for word the same as on the thank-you page and in the automatic reply: I reply within one business day. If you haven't heard back, please try again — messages do occasionally go astray. Use your real window if it’s longer, and then use it everywhere.

Where the message goes: three setups

One term first. A business associate agreement (BAA) is a contract in which a company agrees to protect health information it handles on your behalf. For every tool that touches an inquiry, the useful question is: will this company sign one, and have I actually signed it?

There are three ways to set this up. The kit’s skills call them Stack A, B and C (a stack is a set of tools used together), so you may hear Claude use those names.

The logic that ties the three together is simple: the safety of the pipe decides how much you can ask. Setup A’s pipe includes a free form service that has signed nothing, so it asks logistics only. Setups B and C run through companies that sign a BAA, which is why they can hold more.

A few popular tools don’t fit, and you’ll be tempted by them:

• Calendly offers no BAA, and its own customer terms say your data must not include protected health information.
• Squarespace’s form block and Mailchimp aren’t places for health information either. Squarespace says so about its form block, and Mailchimp’s terms contain no BAA.
• Cal.com lists HIPAA support only on its Organizations plan, at $28 per user per month, and doesn’t state that it signs a BAA. This course doesn’t wire in a booking calendar. If you have a setup C platform with booking, link to that.
• Jotform signs a BAA, but only on its Gold plan at $129 a month, which is a lot for one form.

One reassuring detail: the form sends straight from the visitor’s browser to Web3Forms. What someone types never passes through the company hosting your website (keeping it online for visitors), which keeps the host out of the picture. Module 8 comes back to that when you go live.

Set up the Workspace inbox

If your practice already has a Google Workspace email address, skip to the next section. If not, set one up now; the rest of this lesson needs it.

1. Go to workspace.google.com and start a Business Starter sign-up. Google shows its current price on that page; it was about $7 per user per month when this lesson was written.
2. Google will ask about a domain name, the web address your email will use. If you already own your practice’s domain, use it. If you don’t, go to the domain lesson in Module 8 to get one first, then come back. You’ll connect the same domain to your website there.
3. Create the address inquiries will go to, for example hello@ your domain. Pick one you will actually check.
4. Google will now ask you to prove you own the domain and then to “activate Gmail” by adding a few settings called MX records at the place you bought the domain (the registrar). Follow Google’s own on-screen steps for this; they change often, so check what your screen says. If the registrar’s page is confusing, take a screenshot and use the “Ask Claude to read your DNS screen” prompt in the Module 8 domain lesson, with Google’s settings in place of Vercel’s. You’re done when Google shows your new address as active and a test email you send to it from another account arrives.
5. In the Workspace Admin console (the settings area for your Workspace account), find Google’s HIPAA business associate amendment. At the time of writing it sat under Account settings, then Legal and compliance. Check what your screen says, because Google moves things. Accept it now whichever plan you’re on; it costs nothing and you can’t be worse off for having it. If the option isn’t there on your plan, note that in practice-profile.md and raise it in Module 6.

Get your Web3Forms key

1. Go to web3forms.com.
2. Enter your Workspace email address, the inbox where inquiries should arrive, and ask for an access key. Check what your screen says for the button’s name.
3. Open that inbox and find the email containing your Access Key, a long string of letters, numbers and dashes.
4. Copy the key. You’ll paste it into Claude in the prompt below.

Build the contact page and the form

This is the kit’s Stage 4, “lead capture”: turning a visitor into an inquiry. Two terms in the prompt: a tag manager is a tool for adding tracking code, and a video embed is a video from another site shown inside your page.

Stage 4 — lead capture and intake. Follow the frontend-design skill (section 8), the
copywriting skill's fixed words, and the compliance-check skill. No client information is needed
for this, so don't ask for any.

Build the default setup: a logistics-only contact form sent from the browser to Web3Forms,
arriving in my Google Workspace inbox. Use the exact labels and name values from frontend-design
section 8. Do not add, rename or remove fields.

My details:
- Web3Forms access key: [PASTE KEY]. Store it in .env.local as NEXT_PUBLIC_WEB3FORMS_KEY.
- Online sessions: [yes, for clients located in STATES / no].
- Both in person and online: [yes / no].
- I text clients from a tool covered by a business associate agreement: [yes / no].
- Phone: [PHONE].
- Fee line: [FEE] for [LENGTH].
- My reply window: [one business day / MY REAL WINDOW].

Build /contact in the order the skill gives, with the crisis line first. Include the hidden
botcheck honeypot, the subject "New message from your website", and the button "Send my message".
On success, go to /thank-you. Also build /privacy and /policies.

Add no analytics, advertising pixel, tag manager, session replay, chat widget or video embed to any
page. Restart the preview when you're done, then list every field on the form with its label and
name so I can check it against the course.

What to check: compare Claude’s list with the table above, label for label. If there’s any field that asks why someone is seeking help, or any field not in the table, ask Claude to remove it. Open /contact in the preview: the crisis line should be the first thing on the page, the button should read Send my message, and the state field should appear only if you offer online sessions. Open /privacy and check it names Web3Forms and your host in plain words and never calls the site or the form secure, confidential or compliant.

The thank-you page and an optional automatic reply

Nearly everyone who sends the form sees the thank-you page, which makes it one of the most-read things you’ll ever write. It lives at its own address, /thank-you, and carries five things, in this order:

• “Thank you — I've got your message.”
• When they’ll hear back: your reply promise, word for word.
• What the free call will cover, in one or two sentences.
• The crisis block.
• Links to “See fees and insurance” and “What to expect”.

And one thing it never has: no conversion pixel or tracking event of any kind. (A conversion pixel reports each inquiry to an ad company.) A thank-you page is exactly where marketing advice tells you to put one, because it marks the moment someone contacted a therapist. That’s the reason it stays clean.

In the next prompt, “no-index” tells search engines not to list a page, and the sitemap is the list of pages you give them.

Build /thank-you and the automatic reply from the copywriting skill's fixed words.

1. /thank-you: its own page, in the five-part order from the skill, with the crisis block. No
   tracking, pixel or analytics event of any kind. Mark it no-index and keep it out of the sitemap.

2. The automatic reply: write it from the skill's "always in it" list, using my reply window,
   my fee line ([FEE] for [LENGTH]) and my name, letters and phone ([NAME, LETTERS, PHONE]).
   Nothing from the "never in it" list. Then tell me, as numbered steps, where to paste it in the
   Web3Forms dashboard if my plan offers an automatic reply to the sender. If you can't confirm
   that it does, say so plainly and don't add a separate email tool to send one.

What to check: read the automatic reply as if you’d just sent a message you were scared to send. It should tell you that it arrived, when you’ll hear back, what happens next, and where to go in a crisis, and say nothing about you. If the Web3Forms dashboard (your account page on its website) on your plan doesn’t offer an automatic reply, skip it; the thank-you page carries the same information.

No analytics, no pixels, no chat

The kit installs none of these, anywhere on the site: Google Analytics, advertising pixels (Meta, Google Ads, TikTok, LinkedIn), tag managers, session replay or heatmap tools (which record what a visitor does and types), or a chat widget. Google says it doesn’t sign a BAA for Google Analytics, and on a therapy site nearly every page is about seeking care. A chat box invites the exact disclosures your form is designed to avoid, at hours when nobody is there.

If you want to know how many people visit, there are two cookieless tools (they save no tracking file in the browser) that count visits without following individuals: Cloudflare Web Analytics (free) and Plausible (from $9 a month). Neither publishes a BAA that this course could find, so count page visits only, and keep them off /contact and /thank-you. The cheapest honest measurement costs nothing: once a month, tally how many inquiries came in, how many you answered within your promise, and what people said when you asked “how did you hear about me?” on the call. No clinical detail goes in that tally.

Three terms in the next prompt: third-party means from another company, a tag is a snippet of tracking code, and an iframe is another site shown inside yours.

List every third-party script, pixel, tag and iframe that loads on each page of my site: home,
about, fees, what to expect, contact, thank-you, privacy, policies, and any others. For each one,
name the company and what it's for.

Flag any advertising pixel (Meta, Google Ads, TikTok, LinkedIn), Google Analytics, tag manager,
session replay or heatmap tool (for example Hotjar, Mouseflow, Microsoft Clarity), or chat widget,
on any page. Tell me exactly what to remove, and remove it when I say yes. Say which pages you
actually loaded and which you only read in the code.

What to check: the answer you want is zero flags. Web3Forms may appear, because your form sends to it, and fonts or the page’s own files are fine. Anything with an advertising or analytics company’s name comes out. If Claude only read the code, ask it to load each page in the preview too.

Test it on your own computer

Now prove it works, using the preview of your site on your own computer. This is the local test. The live test, on the real internet, happens in Module 8 after you deploy.

1. Open /contact in your preview. Fill in the form with made-up details only: “Test Person”, test@example.com, and “Testing the form” in the message box. Made-up example, never a real client.
2. Press Send my message. Your /thank-you page should load, at its own address, with the crisis block on it.
3. Open your Workspace inbox. A message with the subject New message from your website should be there within a minute or two. If it isn’t, check the spam folder before you change anything.
4. Open the message and look at what arrived: the fields you filled in, with their name values, and nothing else.

Watch this step

This is a vendor's advertisement, included only to show the idea of a form that sends to a protected inbox; it is not an endorsement. Any form vendor still needs a signed business associate agreement, and the form should still ask only for what it needs. It’s from an independent creator — credited below, so go give them a follow.

1:44