A patient with a cracked molar searches for an emergency dentist at ten at night. Three practices show up on the map. One still has last year's opening hours, one has a website that only says ‘call us’, and one lets her pick a slot for eight the next morning. You already know which one gets her, and it isn't always the one with the strongest clinical team.
Clinic marketing isn't hard because the channels are complicated. It's hard because the rules are stricter than in almost any other sector, and the consequences can land on your professional registration as well as your business. This guide covers what clinics in the UK, the EU, the Gulf and the US need to know about advertising codes, before-and-after images, reviews, local search, online booking and the tracking tags quietly running on your site.
Why healthcare marketing plays by different rules
In the UK, most clinic marketing is covered twice. The CAP Code, enforced by the Advertising Standards Authority, applies to your website, social posts, paid ads and emails. On top of that sits your professional regulator: the General Medical Council for doctors, the General Dental Council for dental professionals, and the equivalent bodies for nurses, pharmacists and physiotherapists. A post that slips past the ASA can still turn into a fitness-to-practise question.
The CAP Code's core requirement is simple: you need documentary evidence for a claim before you make it. For health claims that bar is high, and testimonials don't count as evidence. A few rules matter especially for clinics:
- Prescription-only medicines can't be advertised to the public. You can promote a consultation for lines and wrinkles, but you can't name or show botulinum toxin, and before-and-after images of toxin results are treated as advertising the medicine.
- Ads for cosmetic interventions must not be aimed at under-18s, and they shouldn't make procedures look trivial, risk-free or like something to decide on a whim.
- Time-limited deals and ‘book this week’ pressure sit badly with cosmetic work. The GMC's guidance for doctors who offer cosmetic interventions warns against promotional tactics that could push people into ill-considered decisions.
- Titles must be accurate. Under the GDC's guidance only dentists on a specialist list may call themselves specialists; others can say they have a special interest in a treatment or that their practice is limited to it.
If you're registered with the Care Quality Commission in England, you must also display your latest CQC rating on your website, not just in reception. It's a small requirement that tends to disappear in redesigns.
Outside the UK the details change but the shape is the same. In Dubai, the Dubai Health Authority's standards for medical advertising on social media ban claims such as ‘100%’ or ‘no side effects’ and put conditions on before-and-after images. In the US, the FTC's truth-in-advertising rules and its 2024 rule on consumer reviews and testimonials apply alongside state medical and dental board rules.
Before-and-after photos without the trouble
Before-and-after images are the most persuasive material a clinic has, which is exactly why regulators look at them first. The ASA treats them as objective claims about what a treatment achieves, so the ‘after’ image has to reflect what patients can generally expect, not your single most dramatic case.
| Check | What it means | How to handle it |
|---|---|---|
| Genuine images | Real patients, real results | Keep signed and dated evidence that the photos are genuine and unaltered |
| Same conditions | Lighting, angle, distance and expression match | Use one fixed photo corner and a written shot list |
| No filters or retouching | Nothing that could exaggerate the effect | Ban beauty filters and background edits in your social media workflow |
| Representative result | The after shot reflects typical outcomes | Choose cases that reflect your usual results, not outliers |
| Marketing consent | Explicit, specific and withdrawable | Ask separately from treatment consent and record it in the patient file |
| Medicines | No visual claim about a prescription-only medicine | Don't post results of toxin treatments at all |
Consent deserves its own paragraph. Treatment consent doesn't cover marketing. Ask separately, say exactly where the image will appear, let the patient see it before it goes up, and take it down promptly if they change their mind. Photos taken during a procedure, or showing intimate areas, are rarely worth the risk.
If you advertise to patients in Germany, be stricter still. German law bans before-and-after comparisons in advertising for cosmetic procedures without medical necessity, and in 2025 the Federal Court of Justice ruled that hyaluronic acid injections used to reshape the nose fall under that ban. Turkey's 2025 regulation on health promotion allows such images only under detailed conditions, including a fixed statement that results vary from person to person.
Reviews and testimonials
Reviews do more for a clinic than almost any ad, and they're also where clinics most often trip over data protection. Asking for reviews is fine. How you ask, and how you reply, is where the trouble starts.
- Ask every patient the same way. Google's policies prohibit offering incentives for reviews and selectively asking only the patients you expect to be happy.
- Don't write, buy or swap reviews, and don't let staff review the practice. Since April 2025 the Digital Markets, Competition and Consumers Act has banned fake reviews and concealed incentivised reviews outright.
- If you publish reviews on your own site, explain how you collect and check them. EU consumer law requires traders to say whether and how they verify reviews, and UK rules on misleading review practices point the same way.
- Testimonials in ads are claims. A patient saying ‘my back pain disappeared’ needs the same evidence as if you'd said it yourself.
Replies need more care than most practices give them. Writing ‘we're glad your implant healed so well’ confirms that the reviewer is a patient and discloses what treatment they had. That's health data, a special category under UK GDPR and the EU GDPR, and your duty of confidentiality as a clinician applies on top. Thank positive reviewers briefly and without detail. With negative reviews, acknowledge the concern, invite the person to contact the practice manager and take the conversation offline.
Your website and local search
Google holds health content to a higher standard. Its search quality rater guidelines put it in the ‘Your Money or Your Life’ group, where poor information can genuinely harm people, and they look for clear authorship and real expertise. A clinic site that reads like a brochure tends to lose to one that explains treatments honestly.
- One page per treatment: what it is, who it suits, what happens on the day, recovery, risks and alternatives. Write for an anxious patient, not a search engine.
- One page per clinician, with qualifications, the country where they were obtained and registration numbers where your regulator requires them. The GDC's guidance asks practice websites for exactly that, plus the complaints procedure, GDC contact details and the date the site was last updated.
- Location pages with address, map, parking, step-free access, opening hours and a booking link.
- Fast, accessible pages that work one-handed on a phone. WCAG 2.2 is the sensible baseline; plenty of your patients will be older, anxious or in pain when they visit.
On Google Business Profile, choose the most precise primary category, verify each location separately and keep bank holiday hours up to date. Photos should show the building, reception, treatment rooms and the team, never patients. Google allows separate profiles for individual practitioners where several clinicians see patients at one location; where one clinician is the only public face of a branded practice, it wants a single shared profile. What actually gets listings suspended is stuffing keywords such as ‘implants’ into the business name or creating profiles for addresses where you don't see patients.
Mark up your pages with structured data from Schema.org, such as Dentist, MedicalClinic or Physician, covering address, opening hours and phone number. Skip review star markup on your own site: Google only recommends it for sites that collect reviews about other businesses.
Online booking, WhatsApp and the first reply
The quickest marketing win in most clinics isn't a campaign. It's answering faster. If the phone goes to voicemail at lunchtime and the web form promises a call back ‘within two working days’, you're paying to create demand that walks to the next practice.
- Offer real-time booking for routine appointments through your practice management system, and keep complex cases for a phone call.
- Keep the booking form short: name, contact details, location, type of appointment and preferred time. Medical history belongs in clinical systems, not in a marketing form.
- Send confirmations and reminders automatically, with a one-tap link to cancel or rebook.
- In the Gulf and in much of Europe, patients expect WhatsApp. Use a business account on a practice phone rather than a receptionist's personal number, and decide who replies, when, and how photos sent by patients are stored and deleted.
Keep service messages and marketing apart. A reminder about tomorrow's appointment is part of care. A message about a new whitening offer is marketing, and under PECR you generally need consent before sending it by email or text. The soft opt-in exists, but it's narrow, and health is a context where patients notice when you stretch it. UK GDPR, read with the Data Protection Act 2018, lets you use health data to provide care; that condition doesn't stretch to promoting treatments.
Tracking pixels, consent and health data
This is where well-meaning clinics get into serious trouble. A Meta pixel or Google tag on your ‘IVF consultation’ page, or a conversion event called ‘implant_booking’, can send signals about someone's health to an ad platform. Under UK GDPR and the EU GDPR that's special category data, and under PECR and the ePrivacy rules non-essential cookies and pixels need consent before they fire at all.
The platforms have tightened up as well. Google's personalised advertising policy treats health as a sensitive category and names invasive procedures, including cosmetic surgery and injections. Advertiser-curated audiences such as remarketing lists, Customer Match and lookalike segments aren't supported there. Meta says it filters potentially sensitive health information out of its ad optimisation systems, and health advertisers increasingly find some conversion events restricted. In the EU, the Digital Services Act also bars online platforms from showing ads based on profiling that uses special category data.
In the US the picture is different but no safer. HHS guidance on online tracking technologies said that pixels on HIPAA-regulated sites can disclose protected health information. In June 2024 a federal court in Texas vacated the part that treated an IP address combined with a visit to a public, unauthenticated page as protected information, and HHS later dropped its appeal. Tracking inside patient portals and other logged-in areas remains squarely in scope, and the FTC and several states, with Washington's My Health My Data Act the most prominent, have their own rules.
- Fire marketing tags only after consent, and test that your consent tool genuinely blocks them.
- Name events neutrally, for example ‘booking_request’ instead of the treatment.
- Never pass form contents, symptoms or treatment names to ad platforms.
- Keep a tag inventory: which tool collects what, where it sends it and why.
- Keep advertising tags out of patient portals and logged-in areas entirely.
Marketing to international patients
Clinics that treat patients from abroad, whether that's Gulf patients coming to London or UK patients travelling for dental work, have two sets of rules to satisfy: those where the clinic operates and those where the patient sees the ad. If your ads target UK patients, write them to CAP Code standards, wherever your clinic happens to be.
| Market | Main rulebook | Watch out for |
|---|---|---|
| United Kingdom | CAP Code, GMC and GDC guidance, PECR, UK GDPR | Prescription-only medicines, evidence for claims, proof behind before-and-after images |
| Germany | Heilmittelwerbegesetz, professional codes, GDPR | Before-and-after ban for cosmetic procedures, testimonials, superlatives |
| Turkey | 2025 health promotion regulation, KVKK | Paid ads aimed at Turkey largely ruled out, strict image conditions, health tourism licence |
| Dubai | Dubai Health Authority advertising standards | Banned claims, conditions on images and procedure footage |
| United States | FTC Act, HIPAA, state health data laws | Tracking in logged-in areas, testimonials, state-level consent rules |
Language matters as much as law. Machine-translated Arabic or German undermines trust in the first paragraph. Write each language version so it reads as if it were written in that country, link the versions with hreflang, show local contact routes and time zones, and answer the questions international patients actually ask: total treatment time, number of visits, aftercare back home and what happens if something goes wrong.
Where to start
- Audit every public channel: website, Google Business Profile, Instagram, Facebook, TikTok and paid ads. List claims, offers, titles, testimonials and before-and-after images.
- Remove anything that names or shows a prescription-only medicine, and anything you can't back up with evidence.
- Write a photo protocol covering consent, set-up, retouching and removal requests.
- Check clinician pages for qualifications, registration numbers and accurate titles.
- Tidy up Google Business Profile for each location: categories, hours, photos and booking links.
- Shorten booking forms and automate confirmations and reminders.
- Set rules for WhatsApp and other messaging: who replies, response times and how images are stored.
- Review consent, tags and event names, and take tracking out of logged-in areas.
- Prepare review reply templates and a single, consistent way of asking every patient for feedback.
- Have your legal adviser review the result, and repeat this checklist at least once a year.
At AYTE Digital we build clinic websites, booking flows and measurement set-ups around this checklist. We handle the technical side and work alongside your legal adviser on the rest. If you'd like a second pair of eyes on your current set-up, get in touch.
