A UK clinic can legally and ethically get more Google reviews by asking every eligible patient in the same way. The request needs to be neutral, with no payment or pressure attached, and the reviews need to land wherever they fall, good or bad. Consistency is what separates a review programme that builds trust from one that creates risk. Ask every patient the same way, offer nothing in exchange for a review, and think carefully about what patient information actually gets published. Skip any of that and the consequences can range from a Google policy strike to CMA enforcement, or even a data protection complaint.
This is general information, not legal advice. GDPR obligations in particular depend on exactly what data is collected, how it’s used and what lawful basis applies, so specific processes should be checked against your own data protection advice.
Can Clinics Legally Ask Patients for Google Reviews?
Yes. There’s no law against a UK clinic asking a patient to leave a review, and Google actively encourages businesses to invite genuine feedback. The Digital Markets, Competition and Consumers Act 2024 (DMCCA), in force since 6 April 2025 and enforced by the Competition and Markets Authority, doesn’t ban asking for reviews. It bans fake reviews, reviews that conceal a hidden incentive, and publishing reviews in a way that misleads people, for example by giving positive reviews more prominence or filtering out negative ones.
The safe version of “asking” is a consistent, open invitation sent to every eligible patient through the same process. Problems start the moment a clinic gets selective. That might mean choosing who gets asked, coaching what they say, or quietly deciding which reviews stay visible, and all three create the same underlying issue.
Can You Offer Incentives for Google Reviews?
Not on Google, no. This is a case where the legal position and the platform rule aren’t quite the same thing. Under the DMCCA, an incentivised review isn’t automatically unlawful, provided it’s clearly and prominently disclosed as incentivised. Google’s own review policy goes further and prohibits incentivised reviews outright, discounts, gifts, prize draws or any other reward offered in exchange for a review, regardless of disclosure.
So a disclosed incentive might sit within DMCCA rules while still breaching Google’s terms and putting the whole profile at risk of review removal or restriction. For a clinic, the practical answer is the same either way: don’t incentivise Google reviews.
Is Review Gating Allowed?
No. Review gating, filtering patients by predicted sentiment before deciding who gets a public review link, breaches Google’s policy directly. It also sits close to what the DMCCA treats as a misleading publishing practice, since routing unhappy patients away from a review site while sending happy ones straight there produces exactly the skewed, unrepresentative picture the legislation is aimed at preventing.
Some review platforms are built so that gating isn’t structurally possible. Doctify, for example, publishes every review that meets its acceptable use policy once a provider has signed up, and states plainly that reviews aren’t removed simply for being negative. A clinic using Doctify can’t curate which reviews go live in the way a manual, gated Google process could.
Can a Clinic Ask Only Happy Patients for Reviews?
This is worth separating from outright gating, because it’s a more common and less obviously wrong version of the same problem. Deliberately choosing which patients to approach, based on how their treatment went or how they seemed at the final appointment, produces a skewed set of reviews even without any technical gating tool involved.
The safer approach is universal asking: the same request, sent to every eligible patient, at the same point in their journey, regardless of how the clinic thinks the appointment went. Some of those patients simply won’t leave a review at all, and that’s fine. The point is that the invitation itself doesn’t pre-judge the outcome.
Are Google Reviews GDPR Compliant?
There’s no single answer, because “GDPR compliant” describes a specific processing activity, not a review platform in general. Using patient contact details to send a review request involves processing personal data, and that needs a proper lawful basis under UK GDPR, along with a clear privacy notice explaining what’s happening and an easy way to opt out.
It gets more sensitive if a review, or the clinic’s use of it, reveals health information about an identifiable patient. Health data is special category data under Article 9 of UK GDPR, and the ICO is clear that processing it needs both an Article 6 lawful basis and a separate Article 9 condition, not just consent assumed from the fact that someone left a public review. Screenshotting a review that names a specific condition or treatment and reposting it on social media is a different, higher-risk activity to simply linking to a public review page. It deserves its own decision, not the same default treatment.
Can Patients Leave Reviews on Doctify?
Yes, and the process works differently to Google. Doctify is a closed, verified platform built specifically for healthcare. A patient needs a review link, either given directly by the clinic or requested from Doctify, and Doctify’s team verifies that the reviewer was a genuine patient before anything is published. An independent clinical governance committee, made up of doctors, a legal advisor and a patient representative, investigates any review that’s flagged as a possible breach of the platform’s acceptable use policy.
Google, by contrast, is an open platform. Anyone can leave a review on a Google Business Profile without proving they were ever a patient, which is part of why Google’s own anti-fraud systems and policies carry so much of the compliance weight on that platform.
What Should a Clinic Do About a Negative Review?
Read it properly before responding, and resist the urge to explain what “really” happened in clinical detail. GMC Good Medical Practice, the NMC Code and GDC guidance all place confidentiality obligations on registered professionals that don’t disappear because a patient chose to comment publicly first. A public reply should never confirm that someone was a patient, describe their treatment, or share anything that could identify them, even to correct the record.
A short, calm, factual response, thanking the reviewer for the feedback and inviting them to get in touch directly, protects the clinic’s reputation without adding a second data protection problem on top of a bad review. Reviews that look genuinely fake, from someone who was never a patient, or clearly written by a competitor, can be flagged through the platform’s own reporting process instead of argued with publicly.
A Compliant Step-by-Step Process for Requesting Reviews
- When to ask: at a natural, consistent point in the patient journey, such as after a completed course of treatment or discharge, applied the same way for everyone, not judged case by case.
- How to ask: verbally at the point of care, or through a single follow-up message, using the same method for every eligible patient.
- What message to use: an open, neutral invitation with no suggested wording, no mention of star ratings, and no hint about what the review should say.
- How to send the request: email or text where the patient has agreed to that contact channel, or a printed card or QR code handed out consistently rather than offered selectively.
- How to handle negative feedback: respond calmly and factually in public, without disclosing patient details, and take the substance of the complaint into the clinic’s own improvement process.
- How to follow up: one polite reminder is reasonable. Repeated chasing starts to look like pressure and works against the point of asking in the first place.
- How to manage reviews consistently: check new reviews on a regular schedule, use a simple response process so nothing goes unanswered for weeks, and keep a record of what was asked, when and how.
Not sure whether your current process would hold up against Google’s policy or the DMCCA rules on misleading reviews? A short Clinic Reputation Review usually answers that within an hour, looking at how requests are sent, how negative feedback is handled, and where the process might be exposed.
What Clinics Should Not Do
- Buy reviews, or pay any third party to generate them
- Post or arrange fake reviews from people who were never patients
- Offer discounts, gifts or prize draws in exchange for a Google review
- Gate the review process by only sending public review links to patients thought to be satisfied
- Selectively hide, delete or discourage negative reviews
- Ask staff, family members or anyone connected to the clinic to leave reviews about it
- Publish patient information, including screenshots of reviews naming a condition or treatment, without proper consideration of consent and confidentiality
- Write or edit a review on a patient’s behalf, even with good intentions
Compliant vs Non-Compliant Review Requests
| Compliant | Non-Compliant |
|---|---|
| Ask every eligible patient the same way | Only send review links to patients believed to be happy |
| Neutral message with no suggested wording | Ask patients to mention specific staff names or treatments |
| No reward offered for leaving a review | Offer a discount or gift for a positive review |
| Respond to all reviews without disclosing patient details | Confirm patient identity or treatment details in a public reply |
| Report genuinely fake reviews through the platform | Post a competing fake positive review to balance a negative one |
| Link to an open review platform for anyone to use | Pre-screen patients before deciding who receives a review link |
Getting this right consistently, across every practitioner and every patient touchpoint, is usually where a documented process and a proper monitoring system earns its keep. A good starting point is a written checklist your front-of-house or clinical team can follow without guessing, covering when to ask, what to say, and what never to publish. If building or reviewing that process from scratch isn’t something you have time for, we help clinics set up a compliant, repeatable review-generation process across Google and Doctify, including staff-facing guidance and a response framework for negative feedback. Get in touch if you’d like help putting one in place.
Sources
- Competition and Markets Authority, guidance on fake and misleading reviews under the Digital Markets, Competition and Consumers Act 2024: gov.uk/cma
- Legislation.gov.uk, Digital Markets, Competition and Consumers Act 2024, Part 4, Chapter 1 (fake consumer reviews): legislation.gov.uk/ukpga/2024/13
- Google, Prohibited and Restricted Content policy for Google Business Profiles (fake engagement, incentivised reviews, review gating): support.google.com/business
- Doctify, About Doctify Reviews and Review Rules and Guidelines: doctify.com/uk/about/trust
- General Medical Council, Good Medical Practice 2024, Domain 4 (Trust and Professionalism): gmc-uk.org/professional-standards
- Information Commissioner’s Office, guidance on special category data and UK GDPR Article 9 conditions: ico.org.uk
NMC Code and GDC guidance on patient confidentiality and advertising were referenced in principle; check the current versions at nmc.org.uk and gdc-uk.org before relying on specific wording, since professional guidance is updated periodically.
