Replying to Google Reviews: A Guide for Clinics

Updated 29 October 2026 to reflect the latest rules and guidance.

Most clinics know they should reply to Google reviews. Fewer know what is safe to say in the reply, and that is where good intentions go wrong.

The core problem is simple. If someone writes a review, replying in detail can confirm that they were your patient, and sometimes reveal something about their care. Even when the reviewer has shared details themselves, you are in a different position: you hold their health information, and you have professional and privacy obligations to protect it. A reply can also become advertising. Ahpra’s advertising guidelines warn that engaging with reviews on a third-party site may be considered using a testimonial to advertise a regulated health service.

The rules that apply to review replies

Privacy law

Under the Privacy Act, health information is sensitive information. Confirming that someone attended your practice, or saying anything about their treatment, billing or record, is a disclosure of their personal information. Private health service providers are covered by the Privacy Act regardless of size.

The stakes have risen. Since 11 December 2024, the Privacy and Other Legislation Amendment Act 2024 has provided tiered civil penalties, including a mid tier of up to 2,000 penalty units for any interference with privacy. And since 10 June 2025, individuals can sue directly under a statutory tort for serious invasions of privacy, including misuse of information, without having to prove damage.

The National Law and Ahpra’s guidelines

The National Law prohibits using testimonials in advertising a regulated health service. Ahpra’s Guidelines for advertising a regulated health service make two points that matter for replies:

Patients are free to post reviews. The testimonial ban doesn’t stop people sharing their views online or posting reviews on review platforms.
Section 4.3.3 says practitioners “should take care if they choose to engage with reviews on a third-party site”, because doing so may be considered using a testimonial to advertise.

Ahpra’s testimonial tool also explains that comments only about customer service or communication style aren’t testimonials, and that advertisers aren’t responsible for removing testimonials on sites they don’t control. On sites you do control, such as your own website and social pages, you are responsible, and disabling review functions is one option.

For cosmetic practitioners the rules are stricter. The Medical Board’s guidelines for advertising cosmetic surgery, in effect since 1 July 2023, say reposting, liking or responding to patient posts can count as using a testimonial. Ahpra’s guidelines for advertising higher-risk non-surgical cosmetic procedures, in effect since 2 September 2025, take the same approach.

Consumer law

The Australian Consumer Law prohibits misleading conduct, which includes fake reviews, editing or suppressing genuine reviews and undisclosed incentivised reviews. In 2020 the Federal Court ordered health booking platform HealthEngine to pay $2.9 million in penalties after it admitted, among other things, not publishing around 17,000 reviews and editing around 3,000 to remove negative aspects or embellish them. In December 2023 the ACCC reported that 37% of the 137 businesses it reviewed in an online review sweep had engaged in concerning conduct, including review management services that steer happy customers to public reviews and unhappy ones back to the business.

The golden rule

Reply as if you didn’t know whether they were a patient. Thank them for the feedback and speak generally about your practice. Don’t confirm or discuss anything about their care.

Replying to positive reviews

Keep it short and warm:

“Thank you for taking the time to leave feedback. We’re glad you had a good experience and appreciate your kind words.”
Don’t mention the treatment, or a practitioner’s name in connection with a condition, or anything about results.
Don’t repeat clinical details the reviewer included.
Don’t add a promotional line such as “Book your next treatment with us!” that turns the review into an advertisement.

If you’re a cosmetic practice, consider whether to reply to clinical reviews at all, given the cosmetic guidelines’ position on responding to patient posts.

Replying to negative reviews

Negative reviews are where privacy slips happen, because the urge to explain is strong. A safer approach:

Acknowledge the concern without arguing the facts.
Say that you take feedback seriously and would like to talk.
Offer a general contact, such as a phone number or email, and move the conversation offline.
Never share details of the visit, the diagnosis, billing or the person’s record.

For example: “We’re sorry to hear that your experience didn’t meet your expectations. We take all feedback seriously and we’d like to understand more. Please contact our practice manager on the number on our website.”

Avoid replies that start with “Our records show…” or “As we explained at your appointment…”. Both confirm the person was a patient and invite a back-and-forth in public.

What it means for each channel

Google Business Profile

This is where most replies happen. Google is a third-party site, so reviews there aren’t your advertising unless you use them to promote your services. Replies should follow the rules above. Report reviews that breach Google’s policies, such as fake or abusive ones, through your profile, and keep a record.

Your website

Review widgets that pull Google reviews onto your website turn them into your content. If those reviews mention treatment or results, they become testimonials in your advertising. Either remove the widget or limit what it displays to comments only about customer service, and check it regularly.

Social media

Your Facebook and Instagram pages are sites you control. Reviews and comments there are your responsibility. Consider turning off recommendations or reviews, and don’t like, share or reply warmly to comments praising clinical outcomes.

Paid ads and printed material

Don’t quote clinical reviews or star ratings drawn from clinical reviews in ads, brochures or reception screens. That is using testimonials in advertising.

What not to do with reviews

Don’t offer incentives. Discounts, gifts or prizes in return for reviews undermine their independence. The ACCC has said businesses that don’t disclose incentivised reviews are likely to mislead consumers, and incentives can also cause problems under the advertising rules.
Don’t gate reviews. Sending only happy patients to Google and routing unhappy ones to a private form is the conduct the ACCC flagged in its 2023 sweep.
Don’t edit or suppress genuine reviews. HealthEngine’s penalty shows how seriously this is treated.
Don’t republish clinical reviews. Quoting reviews that talk about treatment or results on your own website or social channels is a testimonial in your advertising, which is prohibited.
Don’t write fake reviews or pressure patients. It breaches platform rules and can breach consumer law.
Don’t like or share positive clinical comments from patients on your own channels.

Asking for reviews the right way

Asking is fine. A neutral request, with no incentive and no pressure, is ideal: a link in a follow-up message, a small sign at reception or a line on your receipts. Make it easy, make it optional and send it to everyone rather than only to patients you expect to be happy.

If you ask by email or SMS and the message also includes promotional content, treat it as marketing under the Spam Act, with consent and a working unsubscribe.

Build a simple process

Decide who replies, how quickly and what wording they use. Keep a short set of approved replies, so a busy practice manager isn’t drafting something sensitive at 6pm on a Friday. Include a rule for escalation: anything that hints at a complaint about clinical care, a threat of legal action or a privacy concern should go to the practice principal before anyone replies.

Common mistakes we see

Replies that thank the reviewer by name and mention their procedure.
Defensive replies to negative reviews that explain what happened during the appointment.
Review widgets on the homepage showing clinical results.
Automated review requests sent only to patients who gave a high satisfaction score.
Discount codes offered “as a thank you” for leaving a review.
Cosmetic practices liking or responding to before-and-after posts that tag them.

A practical checklist

Does the reply avoid confirming the person was a patient?
Does it avoid any detail of treatment, diagnosis, billing or records, even ones the reviewer mentioned?
Is it free of promotional calls to action?
For negative reviews, does it move the conversation offline with a general contact?
Are review requests neutral, incentive-free and sent to all patients, not just happy ones?
Are clinical reviews kept off your website, social pages, ads and printed material?
Are review and recommendation functions on channels you control disabled or moderated?
Do you have approved reply templates and an escalation rule?
Do you report and record fake or abusive reviews rather than arguing with them?

How this fits with other rules

Privacy law governs what you can disclose in a reply. The National Law and Ahpra’s guidelines govern whether your reply, or your use of reviews, becomes advertising with a testimonial. The Australian Consumer Law governs how you collect and display reviews. Your professional code of conduct also expects you to handle complaints respectfully and to protect patient confidentiality. All four point the same way: short, general replies and no clinical detail.

Frequently asked questions

Can we thank a reviewer by name?

Using someone’s name in a reply confirms they were a patient, so general wording is safer.

Should we reply to every review?

Aim to, with short, consistent replies. Prioritise anything negative, and make sure replies never contain clinical details. Cosmetic practices should think carefully about replying to reviews that discuss clinical results.

What about reviews that are fake or abusive?

Report them to Google through your profile and keep a record. If you reply at all, keep it brief and calm.

What if a patient shares their own details in a review?

Don’t repeat them. A patient sharing their own story doesn’t give you permission to discuss it. Reply in general terms and move the conversation offline if that is appropriate.

Can we show our Google star rating on our website?

Be careful. If the rating or the reviews behind it relate to clinical aspects of your service, displaying them can amount to using testimonials. Many practices simply link to their Google profile instead.

Can we delete negative reviews on our own Facebook page?

Selectively removing negative reviews while keeping positive ones can be misleading. A cleaner approach is to turn off reviews on channels you control, rather than curating them.

Need a hand?

Our Google Business Profile service includes a compliant review process, and our compliance training covers how your team should respond. If you’d like your website and social pages checked for review widgets and testimonials, our compliance audit covers that too.

This article is general guidance based on the published rules, not legal advice. Final responsibility for advertising and for patient privacy sits with the registered practitioner and the practice, and complex situations may need independent legal advice.

How to reply to Google reviews without breaching patient privacy