A registered practitioner cannot confirm in a public reply that someone was a patient. HCPC standard 5.1 says "you must treat information about service users as confidential", and its social media guidance adds that if information "could allow a service user to be identified, you must not put it on a site without their permission". There is no exception for a five-star review. Which means the warm, personalised thank-you reply that every marketing guide recommends is the compliance problem, and the careful reply to an angry review is the easy part.
Most articles on this subject are written by agencies. They know Google's rules and they do not know yours, so they tell clinics to reply personally, name the treatment, and thank the patient by name. That advice is the one thing a registered practitioner cannot follow.
Why can you not just reply normally?
Because a reply is a disclosure, and a nice reply is still a disclosure.
Read this reply, which appears in some form on thousands of UK clinic profiles:
"Thanks so much Sarah! Delighted your shoulder is feeling better after those six sessions. See you at your check-up in March."
In one sentence that confirms Sarah was a patient, names the body part treated, states the number of sessions she had, and discloses that she has a future appointment. The practitioner wrote it to be kind. It is a disclosure of health information about an identifiable person, in public, to an audience of anyone, by the person professionally responsible for keeping it confidential.
HCPC's guidance on the use of social media, valid from 1 September 2024 and last updated 1 March 2026, is explicit: "If the information could allow a service user to be identified, you must not put it on a site without their permission." It also notes that "comments or posts may be taken out of context or made visible to a wider audience than originally intended."
The standard behind it, HCPC standard 5.1, reads: "You must treat information about service users as confidential."
Nothing in either document turns on whether the review was positive. The duty is about identifiable information, not about tone.
So the useful reframe is this. The constraint everyone worries about, that you cannot discuss a complaint in public, is only half of it. The half that catches clinics is that you cannot confirm the care relationship at all, which makes the friendly reply the riskier one because nobody reviews it before it goes up.
Does the patient's own disclosure release you?
No. Their disclosure is theirs to make. Yours is still yours.
A patient can write whatever they like about their own care on a public website. That is their information and their choice, and it carries no obligation. What it does not do is transfer permission to you. The duty in standard 5.1 is about what you put on a site, and a reply that confirms what they have said is a separate act by a separate person who happens to be a registered professional.
This is the distinction all the wording below is built to respect: you can acknowledge feedback without confirming a care relationship. It reads as slightly cooler than the replies around it. That is the trade, and it is a small one.
What do the other regulators say?
The same thing, in their own words, and two of them are more pointed about advertising than the HCPC.
| Body | What it binds you to | Where it sits |
|---|---|---|
| HCPC (physiotherapists, podiatrists, dietitians, occupational therapists, speech and language therapists, practitioner psychologists, arts therapists) | Standard 5.1: "You must treat information about service users as confidential." Social media guidance adds the identifiability test and permission requirement | Standards of conduct, performance and ethics, plus guidance on the use of social media, updated 1 March 2026 |
| GOsC (osteopaths) | Standard D1, paragraph 2: your "advertising and promotional material, including website content, is legal, decent, honest and truthful", and information about qualifications, practice arrangements and services is "factually accurate" | Osteopathic Practice Standards |
| GCC (chiropractors) | Code Principle B3: "ensure your advertising is legal, decent, honest and truthful as defined by the Advertising Standards Authority" | Code of Practice, with specific review guidance published 16 August 2023 |
| BACP (counsellors and psychotherapists) | Good practice point 45: "Whenever we communicate our qualifications, professional experience and working methods, we will do so accurately and honestly." Point 55 requires actively protecting client information from unauthorised disclosure. Point 35: "We will not exploit or abuse our clients in any way: financially, emotionally, physically, sexually or spiritually." | Ethical Framework for the Counselling Professions |
One line from the GCC's August 2023 guidance on reviews deserves to be pinned above the desk of whoever runs your social accounts. Chiropractors, it says, "are personally accountable for all information that publicises or advertises their work, including website and social media platforms/pages owned or controlled by them, regardless of who wrote the information."
That settles a question clinics ask constantly. Handing the review replies to a marketing agency, a receptionist or a family member does not move the accountability. It moves the keyboard.
The GCC also states plainly what registrants may not do: post or pay for reviews from patients they have never treated, solicit reviews in exchange for payment in cash or in kind, or pay for fake reviews. It adds that you must ensure anyone with access to your accounts is "appropriate and trustworthy".
What does Google allow you to do?
More than most clinics think, and less than most review-collection products assume.
Google's Maps user contributed content policy sets out what merchants may and may not do. The permissive line first, because it matters:
"Solicit or encourage the posting of content that does represent a genuine experience, without offering incentives to do so."
Asking is allowed. Asking is, in fact, Google's own advice: its tips for getting more reviews suggests you "ask customers to visit a Google link or scan a QR code".
Three prohibitions matter to a clinic.
No incentives of any kind. Google's wording: do not "Offer incentives, such as payment, discounts, free goods and/or services, in exchange for posting any review or revision or removal of a negative review." Its dedicated policy on incentivised or biased reviews defines them as reviews "influenced by a payment, discount, free goods or services, or any other benefit offered to the reviewer; or biased by a personal or professional conflict of interest." A prize draw, loyalty points, a free follow-up and "£5 off your next session" are all inside that definition.
No review gating. Google prohibits "Discouraging or prohibiting negative reviews, or selectively soliciting positive reviews from customers." This is the one that catches well-meaning practices, because a great many review-collection tools are built to do exactly this: send a satisfaction question first, route the happy answers to Google and the unhappy ones to a private inbox. That is selective solicitation in Google's own words, whatever the product calls it.
No asking under pressure on the premises. The policy states that merchants "should not require or pressure users to leave ratings or write reviews while on the premises." So the tablet at reception, held out while the patient puts their coat on, is out. Not borderline. Out.
Google enforces this. Its Business Profile restrictions page lists what can happen: the profile may be unable to receive new reviews for a period, existing reviews may be unpublished, or the profile may display a warning telling the public that fake reviews were removed. That last one is the expensive outcome, because it is visible to every prospective patient.
UK consumer protection rules on reviews are enforced by the Competition and Markets Authority as well. If you are considering any sort of reward scheme, that is a question for your own adviser rather than for this article. Google's policy alone is enough reason not to.
When should you ask?
At discharge, and not before. There are two separate reasons, and the professional one is the stronger.
The commercial reason is that the end of an episode is when the patient knows whether it worked. Ask in week two and they are reviewing your reception; ask at discharge and they are reviewing the outcome.
The professional reason is the dependency. A patient still in a course of treatment is in an unequal relationship with the person asking. They need you next week. BACP puts the principle most directly, at good practice point 35: "We will not exploit or abuse our clients in any way: financially, emotionally, physically, sexually or spiritually." HCPC's standards on maintaining appropriate professional boundaries, standards 1.9 to 1.12, point the same way. A request made in the room, face to face, by the clinician, to a patient who has three sessions left, is not a free choice however gently it is put.
Which gives a simple rule with both reasons behind it.
| Ask | Do not ask | |
|---|---|---|
| When | After the episode of care has ended | Mid-course, or at any point where more treatment is pending |
| How | By email or SMS, with a link, once | In the room, face to face, by the treating clinician |
| Where | After they have left | At reception, on a tablet, while they are standing there |
| Who asks | The practice | The individual clinician who treated them |
| Who to ask | Every discharged patient, including the ones who did not improve | Only the ones you expect to be pleased |
That last row is the one practices resist, and it is the one Google requires. Asking everyone is also better content: Google's own tips page notes that "A mix of positive and negative feedback often feels more trustworthy." A profile with 40 reviews and a 5.0 average reads as managed. One with 40 reviews and a 4.7 reads as real.
Discharge is also the natural trigger to automate, which is the only way this gets done consistently. Clinics that ask when they remember end up asking in bursts, and a burst of twelve reviews in one week followed by nothing for a year is both less convincing and less useful.
What do you actually say?
Three pieces of wording. Use them, change the names, keep the structure.
The request
Short, one link, no pressure, easy to ignore. Sent after discharge.
Subject: Thank you from [Clinic name]
Hello [first name],
Thank you for choosing [Clinic name]. Now that we have finished your course of treatment, we would be grateful if you would leave an honest review of your experience with us. It helps other people decide whether we are the right clinic for them.
[Leave a review]
Please say whatever reflects your experience, good or otherwise. We read everything.
If you would rather tell us privately instead, reply to this email and it comes straight to us.
With best wishes, [Clinic name]
Four deliberate choices in that. It says honest rather than positive, which is what Google requires and what makes the ask comfortable to send. It offers a private route as well as, never instead of, the public link, which is the difference between giving people a choice and gating. It comes from the clinic rather than the clinician. And it offers nothing in return.
Send it once. A single polite reminder after a week is defensible. A third message is pestering someone who has finished paying you.
The reply to a positive review
Here is the shape. Note what is missing.
"Thank you for taking the time to leave this. Feedback like this means a lot to the team. If there is anything we can help with in future, our details are on the profile."
No name. No condition. No treatment. No number of sessions. No "see you in March". Nothing that confirms the person was a patient or says anything about their care.
It is slightly cool. Read it next to the gushing reply on the clinic down the road and it reads, if anything, as more professional.
A workable test before you post any reply: if a stranger read only your reply, would they learn anything about this person's health or their relationship with your clinic? If yes, cut it back.
The reply to a negative review
Same shape. That is the point.
"Thank you for taking the time to leave this. We take all feedback seriously and we are sorry your experience fell short. We are not able to discuss anyone's care in a public forum, but we would very much like to hear more. Please contact us on [phone] or at [email] and we will look into it properly."
What it does: acknowledges, apologises for the experience rather than for a disputed fact, explains the silence rather than performing it, and moves the conversation somewhere it can actually be resolved.
What it avoids: any suggestion that you know who they are, any version of events, any mention of their treatment, any hint that they might be mistaken, and any attempt to establish that they were never a patient in the first place. Even a denial is a disclosure about the care relationship.
The line that does the real work is "we are not able to discuss anyone's care in a public forum". It is true, it is understood by readers, and it explains a short reply without sounding defensive. Prospective patients read the pattern of your replies far more than any individual one, and a clinic that answers every review in the same measured way looks considerably better than one that answers the good ones warmly and the bad ones not at all.
Your reply to a one-star review should be structurally identical to your reply to a five-star review. If the two differ in a way that implies you know who the reviewer is, the difference is the disclosure.
What if the review names a condition?
This happens constantly, and almost every instinct about it is wrong.
A patient writing "I came in with sciatica and could barely walk, three sessions later I was back running" has disclosed their own health information on a public website. They are entitled to. You have no obligation to do anything, and the review can stay exactly where it is.
Three things not to do.
Do not reply confirming it. "So pleased the sciatica settled" is the disclosure problem again, and worse, because now a clinician has confirmed a diagnosis in public.
Do not ask them to take it down because it names a condition. You can flag a review that breaches Google's content policy, and Google will assess it. A patient voluntarily describing their own treatment is not a policy breach, and a request to remove a positive review is both futile and odd.
Do not put it on your website. This is the one that turns a non-problem into a real one, and the next section is about why.
When does a review become advertising?
The moment you reproduce it. That is the line, and it is sharper than clinics expect.
A review sitting on Google is the patient's content on somebody else's platform. Copy it onto your home page, into a brochure, or into a social post, and it becomes a testimonial in a marketing communication that you control, which brings it inside the CAP Code. The ASA has regulated marketers' own websites and other non-paid-for space online under their control since 1 March 2011, and that includes advertiser-controlled pages on social platforms.
Four rules then apply:
| CAP Code rule | What it requires |
|---|---|
| 3.47 | "Marketers must hold documentary evidence to show that a testimonial or endorsement used in a marketing communication is genuine", and must "hold contact details for the person (or organisation) that gives it" |
| 3.48 | Testimonials must relate to the product advertised |
| 3.49 | "Claims within a testimonial must not mislead or be likely to mislead the consumer" |
| 3.50 | "Marketing communications must not feature a testimonial without permission" |
Rule 3.50 is the one most clinic websites fail. A Google review is not permission to reproduce it in your advertising. Permission has to be asked for and recorded, and under 3.47 you need the person's contact details on file as well.
Then the harder layer. The ASA's guidance on claims in testimonials and endorsements, dated 16 April 2025, states that "unless they are clearly subjective, marketers must hold evidence for all claims made in testimonials", and that "testimonials alone do not constitute substantiation so marketers should not rely on testimonials as support for any direct or implied claims." Where health is involved, sections 12 and 15 of the Code also bite, and for health therapies the ASA and CAP generally expect evidence in the form of clinical trials.
So the sciatica review, which is perfectly fine on Google, becomes an efficacy claim the day you paste it on your home page: your advertising now says this treatment resolves sciatica in three sessions, and you are the one who has to hold evidence for that. The ASA's position is that where a view "can also be understood to be efficacy claims, then they should not be included in advertising, unless supported by sufficient evidence."
Both GOsC and the GCC route you to the same place. GOsC Standard D1 requires advertising to be legal, decent, honest and truthful and factually accurate, and CAP publishes a list of conditions osteopaths may say they can help. The GCC's Code Principle B3 ties its registrants to the ASA's definition directly.
The practical consequence is a short rule that will keep most clinic websites out of trouble:
- Quote reviews about the experience. Reception, waiting time, feeling listened to, the explanation you gave, whether they would come back. Subjective, verifiable, uncontentious.
- Do not quote reviews about outcomes for named conditions, however genuine, unless you hold evidence for the claim it implies.
- Get written permission before you reproduce anything, and keep it with their contact details.
- Link to your Google profile instead. It sidesteps the entire problem, because the reviews stay where the patient put them, and it is better social proof anyway.
That last point is worth sitting with. The compliant answer and the effective answer are the same answer.
What if the review is fake, or from someone who was never a patient?
Report it to Google, and still say nothing in public. A reply denying that the person was ever a patient is itself a statement about the care relationship, which is the one thing this whole article is built to avoid. Reporting is the only route that asks nothing of you in public.
Only reviews that break Google's content policy are eligible for removal. The page behind Google's Reviews Management Tool says plainly that reviews which "violate Google policies are eligible for removal", so a review you simply disagree with will stay up. The categories that come up in clinic practice are in the Maps user contributed content policy:
- Fake engagement. "Fake engagement is not allowed and will be removed." Paid reviews, and several reviews posted from different accounts by one person, sit here.
- Off topic. Contributors are told to "Only post content that is based on your experience or questions about experiences at a specific location", which excludes a complaint from someone who was never at your clinic.
- Misrepresentation. "False or misleading accounts of the description or quality of a good or service."
- Personal information. "Do not distribute or post personal information without consent." This is the ground to use when a review names one of your staff.
The process, in Google's own steps:
- In the Business Profile app, open Read reviews, tap the report icon beside the review, choose a reason and send the report. On a computer, use the Reviews Management Tool instead: select the business, Continue, then Report a new review for removal.
- Then wait. "Review evaluation typically takes several days." The tool shows a status against each report: decision pending, report reviewed with no policy violation, or escalated.
- If Google declines, you get one appeal and only one. In the Reviews Management Tool choose "Check the status of a review I reported previously and appeal options", select up to ten reviews, and submit the form. Google emails the final decision.
A genuine review you do not like is not a policy breach, and reporting it is a morning you will not get back. For that one, the measured reply above is the whole of the answer.
How many reviews do you actually need?
Nobody can tell you a number, and the ones circulating are not reliable.
What Google says about itself is the solid part. Its tips to improve your local ranking page states that local results are "mainly based on relevance, distance, and popularity", that prominence is "based on info like how many websites link to your business and how many reviews you have", and that "More reviews and positive ratings can help your business's local ranking." On replies it is more guarded: "Positive reviews and helpful replies can help your business stand out", which is a claim about conversion, not about ranking.
The best published dataset we could find is Local Falcon's whitepaper of 14 January 2026, which analysed 50.4 million search results across 1,993 business categories in the fourth quarter of 2025. It is vendor-published and US-only, so treat it as orientation rather than a UK benchmark. Its findings are more interesting than any single threshold:
- The median review count for a business holding a local three-pack position varies from 2 to 976 depending on the category
- Chiropractors sat at a median of 150 reviews, dentists at 346
- Star rating is the part that behaves like a floor: most categories need 4.3 to 4.5 stars to compete, with typical winners at 4.8 to 4.9
A figure of "about 30 reviews" circulates widely in agency material as the threshold for competing in the map pack. We could not find a primary source for it, and the dataset above suggests it is far too low for competitive healthcare categories in populated areas. Timelines of "two to three months to see movement" and "six to twelve months for a top-three position" circulate in the same material and we could not verify either.
So do this instead, which takes twenty minutes and gives you a real target. Search your main term from your own postcode, open the three profiles in the map pack, and write down their review counts and star ratings. That is your number. It is specific to your town, your category and your competition, and it will be nothing like a number from an American dataset.
Then work out the rate. If the leader has 140 reviews and you have 18, asking every discharged patient will close that over a couple of years, not a quarter. Reviews are a compounding asset, which is both the discouraging part and the reason to start this week rather than next year.
One paragraph on the profile itself, because reviews only amplify a profile that is already eligible to rank: it needs to be claimed and verified, in the right primary category, with the same name, address and phone number as every directory listing that mentions you. Reviews do not fix a wrong category. Our guide to getting physiotherapy patients without ads covers where reviews sit among the other free channels, and the profile setup is an article of its own.
Where this advice does not apply
Four situations where the default is wrong, and one of them is a whole profession.
Counselling, psychotherapy and anything where the fact of attendance is itself sensitive. For a physiotherapy patient, a Google review discloses that their knee hurt. For a therapy client it discloses that they were in therapy, to their employer, their family and anyone who searches their name. Many experienced therapists do not ask for reviews at all, and that is a defensible professional position rather than a marketing failure. If you practise in the talking therapies, a BACP or UKCP directory profile, a referral relationship and a clear website will do more for you than a Google review strategy, and asking a client at all needs thinking about against good practice point 35 rather than against a ranking benchmark.
Small towns and distinctive caseloads. A first name plus a condition identifies someone to everyone they know in a village of four thousand people. The identifiability test in the HCPC guidance is about whether the information "could allow a service user to be identified", and in a small community the threshold for that is far lower than you would assume in a city.
Paediatrics, pelvic health, safeguarding-flagged cases. Do not include these patients in an automated discharge request at all. Review the list before it sends. If a parent or representative is the one who would write the review, the person whose care is being described has not chosen to disclose anything.
Where the review was written by a representative rather than the patient. A parent reviewing their child's treatment, or an adult child reviewing their parent's, is describing someone else's health information in public. You still cannot confirm any of it, and the reply template above still applies without modification, which is the advantage of having only one template.
There is also the case where you should stop asking entirely: if your rating is falling, more reviews make the problem more visible, faster. Fix the thing first. A sustained run of three-star reviews about waiting times is a diary problem, not a marketing problem, and no reply template addresses it.
What to do this week
- Read your last twenty replies. Delete or edit any that name a patient, a condition, a treatment or a future appointment. This is the highest-value hour in the whole article.
- Write one reply template and brief everyone with account access on it, including any agency. Use it for five-star and one-star alike.
- Set the discharge trigger, with an exclusion list for the caseloads above.
- Turn off any gating. If your review tool asks a satisfaction question before showing the Google link, that is selective solicitation and it has to go.
- Count your three map pack competitors' reviews and set your own target from that, not from an article.
- Audit your website for reproduced reviews. Anything quoting an outcome for a named condition comes down, and anything that stays needs recorded permission and contact details on file.
Where the sending part lives
Asking every discharged patient, once, without asking anyone mid-course, is an operations problem rather than a marketing one. Done by hand it lasts about three weeks.
Atlacare sends one-off and automated campaigns by email and SMS with targeting, so a request can go to patients whose episode has ended rather than to your whole list, and recalls give you the discharge trigger to hang it on. Marketing consent is enforced at the platform level: only patients who have given marketing consent receive a send, which matters here because a review request is marketing, not care. Targeting is by tag, by recall due date, by location or by how long since a patient was last seen, so you choose who a request goes to rather than mailing the whole list. Checking the recipient list against the exclusions above is still a job you do yourself, and it is worth doing every time. New accounts are on the Free plan, which needs no card and has no time limit.
Start with step one. The replies already on your profile are the part that is live right now.
Frequently asked questions
Where does a clinic find its Google review link?
In a Business Profile, open Read Reviews, then Get more reviews, and copy the link with the copy icon or save the QR code by right-clicking it. Google's help page on this notes that "reviews QR codes can only be generated on a computer browser, not on mobile devices."
Can a clinic put the review QR code on the reception desk?
Not held out to a patient who is standing there. Google's policy says merchants "should not require or pressure users to leave ratings or write reviews while on the premises." Printed on a discharge letter the patient takes home, the same QR code is used in their own time.
Can a clinic delete a patient's Google review on request?
No. Google's Maps help states "You can't delete someone else's review." Only the author can remove it, from Your contributions, then Reviews, then Delete review in their own Google account. Telling the patient where that sits is the whole of the answer.
Does a review request count as a marketing message?
Treat it as marketing. ICO guidance describes service messages as those that "aren't promotional but are for administrative or customer services purposes", and asking a patient to publish a public endorsement of a clinic is promotional. Send review requests only to patients who have agreed to hear from a clinic beyond their own care.
This article covers professional standards and practical wording. It is not legal advice, and it does not cover any legal remedy in relation to a review. Standards, platform policies and advertising rules change, and the versions quoted here were current on 9 October 2026, so check the source before relying on any of it. Where a review raises a complaint or a concern about care, follow your own complaints procedure and your regulator's guidance, and take advice where you need it. The Local Falcon dataset is vendor-published and drawn from US search results; it is included as orientation, not as a UK benchmark.
Sources: HCPC guidance on the use of social media · GCC: reviews, testimonials and endorsements · GOsC advertising guidance · BACP Ethical Framework for the Counselling Professions · ASA: claims in testimonials and endorsements · ASA: testimonials and endorsements · Google Maps user contributed content policy · Google: incentivised or biased reviews · Google: tips to get more reviews · Google: tips to improve your local ranking · Local Falcon local 3-pack whitepaper, January 2026
Related: How to get physiotherapy patients without paid ads · Reactivating lapsed patients · Telling patients about a price rise · Which six numbers should a clinic owner track?
