Google reviews and patient reviews: what clinics can and cannot do

When a prospective patient searches for a clinic on Google, the rating and the reviews are among the first things they see. They build trust because, unlike what the clinic says about itself, they are the voice of a third party. For the same reason they are carefully regulated in healthcare: reviews touch Google's policies, health-advertising rules and patient privacy all at once.

There are three separate questions, each with its own rule: asking for a review, replying to a review, and sharing a review on your own channels. Each is covered below.

Under Google's Maps contributed-content policy, businesses may ask customers for reviews based on genuine experiences, but may not offer incentives such as payment, discounts, free goods or services in exchange for a review, a revision or the removal of a negative review. Reviews written because of incentives are removed. The policy also bars businesses from discouraging or prohibiting negative reviews, selectively soliciting only positive ones, requiring customers to review while on the premises, asking for specific review content, and requiring staff to collect a set number of reviews or reviews with specific content. Reviews based on a conflict of interest, such as those from current or former employees, consultants, competitors or family members, are also prohibited.

The consequence may be more than a deleted review: Google can remove reviews, temporarily block new ones and show a warning on the business profile. One bad decision can affect the clinic's whole reputation.

Many clinics ask “how did it go?” in the aftercare message and send the review link only to those who say “great”. This is what Google calls review gating, and it is prohibited. The fix: either send the same review link to everyone or send it to no one; collect private feedback on a separate path, but do not make the review link depend on the answer.

A good practice: the aftercare e-mail goes to everyone on the same day and presents the private-feedback question and the Google review link side by side, in the same form.

To reply on Google your business must be verified; the reply appears as from your business and the reviewer is notified. Replies are checked against Google's content policies, and the reviewer can change their review afterwards.

Privacy is the big trap. A sentence like “we're glad your treatment went well” or “you did not come to your check-up after your implant surgery” tells the public that the reviewer is your patient and what treatment they had. Health data is special-category personal data under KVKK, and the fact that the patient mentioned it in their own review does not give you the right to repeat it. Keep replies general and unconfirming, and discuss specifics privately.

Not on channels aimed at people in Türkiye. The Regulation on Promotion and Information Activities in Health Services bans advertising-style sharing based on thank-you or satisfaction statements by patients or their relatives in the press, publications, social media and websites, and states that patient reviews and thank-you messages are covered. For image posts, such statements cannot be used for advertising even if made elsewhere.

Adding a widget that shows Google reviews to your site, or featuring your average rating, may also fall under this ban. The regulation does not mention that exact case, so ask your provincial health directorate or lawyer before putting a widget live.

On the authorised channel aimed abroad, Article 8 permits patient stories, reviews and thanks, on condition that patient privacy, public morality and patient rights are respected and the patient's explicit consent is documented. Take consent in writing and keep a way to withdraw it open.