Reviews and Testimonials for Clinics: Using Them Within the Rules

Three sets of rules

Reviews and testimonials on a clinic website sit under three overlapping sets of rules:

1. Consumer law, through the Digital Markets, Competition and Consumers Act 2024, enforced by the Competition and Markets Authority.
2. Advertising rules, through the CAP Code, enforced by the Advertising Standards Authority.
3. Professional standards, through the clinicians' own regulators, such as the General Medical Council.

A review that is fine under one can still fall foul of another, so it helps to check against all three.

The fake review ban

The CMA's guidance on unfair commercial practices, CMA207, explains that the consumer provisions of the Act apply to practices from 6 April 2025. The banned practices include submitting, or commissioning someone else to submit or write, a fake consumer review or one that "conceals the fact it has been incentivised", and publishing consumer reviews or review information "in a misleading way"^[1]. The CMA's short guide on fake reviews, CMA208, explains the same ban in plain terms for businesses^[2].

The guidance also says it is banned to publish reviews without taking such reasonable and proportionate steps as are necessary to prevent fake or concealed-incentive reviews and misleading review information from being published, and to remove them once published^[1]. For a clinic that shows reviews on its website, that means having a process, not just good intentions.

What the ban means in practice

• No reviews written by staff, friends or family presented as patient reviews.
• No incentives without disclosure. If patients were offered a discount or prize for leaving a review, that must be clear. Avoiding incentives altogether is simpler.
• No cherry-picking that misleads. Showing only five-star reviews while presenting them as a fair picture of all reviews can be misleading. Showing an overall rating from an independent platform alongside selected quotes is clearer.
• No hiding negative reviews on a page that presents itself as showing all reviews.
• A written process for collecting, checking and publishing reviews, and for removing any that turn out to be fake.

The CAP Code on testimonials

Rule 3.47 of the CAP Code says marketers must hold documentary evidence that a testimonial or endorsement used in a marketing communication is genuine^[3]. For a clinic, documentary evidence could be the original review on an independent platform, or a signed and dated statement from the patient giving permission to publish their words.

A testimonial is also a claim. If a patient writes that a treatment "cured" them, publishing that quote is the clinic making an efficacy claim, and rule 12.1 requires objective claims to be backed by evidence^[4]. Choose quotes that describe the patient's experience of the clinic, such as how they were treated, how clearly things were explained, how easy it was to book, rather than quotes that promise results.

Testimonials cannot be used to promote prescription-only medicines. The ASA's guidance on Botox notes that the ban on advertising those medicines extends to testimonials^[5].

Before and after photos

Before and after images are a form of testimonial and carry extra risk. The ASA advises holding signed and dated proof that photos are genuine and have not been manipulated, keeping records of any retouching, and making sure images are representative of the effect consumers could likely expect^[6]. Its guidance on cosmetic procedures warns against exaggerated claims made through before and after images^[7].

A before and after photo of a patient is personal data and may reveal health information. Medical Protection's summary of GMC guidance, covered under professional standards below, links identifiable images in advertising to the patient's explicit consent^[8]. A cautious approach is written consent that covers publication on the website and explains how to withdraw it, obtained before any image is used.

Professional standards

Doctors' own standards set a further limit. Medical Protection's summary of GMC guidance says patients must not be identifiable from advertising without their explicit consent^[8]. That applies to named testimonials, recognisable photos and detailed case descriptions. Other regulators have similar expectations for the clinicians they register.

Clinicians should also avoid soliciting reviews in a way that puts pressure on patients, for example by asking at a vulnerable moment or tying a review to future care.

A safer approach for clinic websites

1. Collect reviews through an independent platform that verifies reviewers.
2. Show the platform's overall rating and link to the full set of reviews.
3. Quote a small number of reviews about the patient experience, not outcomes, with the reviewer's permission.
4. Do not offer incentives for reviews, or disclose them clearly if you do.
5. Keep a written review policy and a record of permissions.
6. Remove any review you discover is fake, and record what you did.
7. Do not use reviews or testimonials on pages about prescription-only medicines.

Responding to reviews

Replying to a review, especially a negative one, can show that the clinic listens. It also carries a real risk: confirming that someone is a patient, or discussing their care, in a public reply can disclose personal and health information. Medical Protection's summary of GMC guidance stresses that patients must not be identifiable from advertising without explicit consent^[8], and the same caution applies to public replies.

A safe reply thanks the reviewer, does not confirm or discuss any treatment, and invites them to contact the practice manager directly. Keep a short set of approved replies so whoever responds does not have to improvise.

Keeping records that show your process

If a review on your website is ever questioned, the clinic should be able to show where it came from and how it was checked. A simple record works: the date each review was collected, the platform or route, whether any incentive was offered, the permission to publish it on the website, and the date it was added. The CMA's guidance makes clear that publishing reviews without reasonable and proportionate steps to prevent fake or misleading ones is itself banned^[1], so the record is evidence of those steps, not paperwork for its own sake.

Review the quotes on your website once a year. Remove any from clinicians who have left, any that describe treatments you no longer offer, and any whose permission has been withdrawn.