This is the single most common question we get from practice managers, and it usually arrives with a hopeful tone: we've got all these lovely reviews, surely we can put them on the site?
The instinct is completely understandable. You've done good work, patients are grateful, and social proof is how the rest of the internet builds trust. Then someone mentions AHPRA and the whole thing feels like a minefield. So people either paper the website with testimonials and hope nobody notices, or they panic and strip out every positive word a patient ever said. Both reactions are wrong, and the truth sits in a more workable place in between.
Here's the short version, then we'll show you exactly where the line is. You mostly cannot use reviews that touch clinical care. You have more room than you think with everything else. And the Google reviews sitting on your listing right now are almost certainly fine to leave alone.
This article is general information about advertising compliance, not legal advice. AHPRA's guidelines are the authority and the details change over time, so check the current guidance for your profession before you publish. This piece builds on our longer AHPRA advertising rules guide, which is the place to start if you want the full picture.
The short answer, and why the rule exists
Under Section 133 of the Health Practitioner Regulation National Law, you must not advertise a regulated health service using a testimonial about the clinical aspects of that service. That's the law, and it's not new or ambiguous.
The reason matters, because once you understand it the rest becomes intuitive. Think about who reads a patient testimonial. It's often someone unwell, worried, and trying to decide who to trust with their health. A glowing story about how a treatment cured someone else is powerful precisely because that reader is vulnerable and hungry for reassurance, and one person's outcome tells you almost nothing about what will happen to the next person.
Medicine doesn't work like a restaurant review. Two patients with the same diagnosis can have completely different results for reasons neither of them controls. A testimonial flattens all of that into "it worked for them, so it'll work for me," which is exactly the false expectation the law is trying to prevent. Any clinician has sat across from a patient carrying hope built on someone else's story, and it's a hard thing to gently unwind. The rule isn't bureaucratic caution. It's patient protection, and as a doctor-founded team we think it's right.
What actually counts as a "testimonial"
AHPRA's definition is broader than most people assume. A testimonial is a positive statement about a person or thing, so a negative review is not a testimonial, and it's caught by the ban when it refers to the clinical aspects of care.
A clinical aspect is present if the comment expresses any of these:
- A symptom: the reason the patient sought care ("I came in with crippling back pain").
- A diagnosis: the condition identified.
- A treatment: the specific procedure or care provided.
- An outcome: the result ("I'm completely pain-free now").
If a review touches any of those, it's a clinical testimonial and it cannot appear in your advertising: website, social media, brochures, ads, anywhere you control the message.
Here's the distinction laid out plainly:
| Comment | Clinical? | Usable in advertising? |
|---|---|---|
| "Dr Lee removed my skin cancer and I healed perfectly." | Yes, diagnosis plus outcome | No |
| "The treatment fixed my migraines completely." | Yes, symptom plus outcome | No |
| "Reception was warm and I never waited long." | No | Yes |
| "Easy to book, clear communication, great parking." | No | Yes |
| "Billing was transparent and the rooms were spotless." | No | Yes |
The test is quick: does the comment mention a symptom, diagnosis, treatment or outcome? If yes, leave it off. If it's purely about the experience of dealing with your practice, it's fair game.
The part everyone gets wrong: Google and third-party reviews
This is where practices tie themselves in knots, so it's worth being precise.
You are not required to remove reviews on platforms you don't control. AHPRA does not treat your Google listing as something within your control, whether or not you've verified it, so you are not expected to hunt down, edit, or try to delete the reviews patients leave there. The same goes for independent directories and other platforms you don't own. A patient sharing their own experience online is their right, and the ban doesn't touch it.
That's a relief for most practices, because the fear that every clinical Google review is a liability simply isn't true. Those reviews existing is not you advertising.
The line you must not cross is using them. You breach the rule the moment you take a clinical review and turn it into advertising:
- Re-sharing or embedding a clinical Google review on your own website.
- Quoting a patient's clinical story in a social post or an ad.
- Screenshotting flattering clinical reviews into a "what our patients say" section.
- Soliciting clinical reviews from patients, actively asking for testimonials about their treatment or outcome.
There's a subtler trap too. If you reply to a Google review and your reply mentions clinical aspects of care, your response can itself become a testimonial, because now you, the advertiser, have published clinical content. Keep replies gracious and generic. "Thank you for the kind words, we appreciate you taking the time" is safe. Confirming a diagnosis or treatment in a public reply is not.
And on platforms you do control, such as your own website's review widget or your Facebook page's recommendations, you are responsible for what appears. If clinical testimonials accumulate there, the fix may be to switch the reviews function off. You can't claim "the patients posted it, not me" when it's your surface displaying it.
One last thing practices do that quietly creates risk: selectively showing only the glowing clinical reviews. Curating the flattering ones and hiding the rest can be misleading in its own right, which is a separate breach. If you're going to show feedback, don't cherry-pick it into something rosier than reality.
Star ratings, awards, and the "review of the business" carve-out
A couple of nuances worth knowing, because they open up genuine, compliant options.
Star ratings and award symbols. This one is genuinely unsettled, and we would rather say so than give you false comfort. AHPRA's published guidance does not deal with aggregate ratings directly. What is clear is the part underneath: republishing the written clinical reviews a rating is built on is a breach. A "4.8 stars from 200 reviews" figure carries far less clinical content than the individual stories, and it must not be false or misleading, but we are not going to tell you it is definitively safe when the guidance does not say so. If a rating is load-bearing for your marketing, get advice on it rather than relying on a blog.
Reviews of your business, not your clinical care. The prohibition is specifically about the clinical aspects of a regulated health service. Feedback about an ordinary business that isn't providing clinical care isn't caught at all. That's why a marketing agency, a software company, or a consultant can happily publish client testimonials, including us. The line AHPRA draws is clinical care, not the word "review." If your practice runs a genuinely non-clinical arm, the same logic can apply, but be honest about where the clinical service starts.
What you can safely do instead
Read all of the above and it's tempting to conclude the safe website has no social proof at all. Not true. There's plenty you can do that builds trust without going near the line:
- Publish non-clinical feedback. Comments about reception, communication, ease of booking, wait times, accessibility, billing clarity, and the feel of the rooms are not testimonials. This is real, usable social proof.
- Show an overall rating without the clinical stories. A star figure, tastefully presented, without republishing the underlying clinical reviews.
- Leave your Google reviews where they are. Let patients say what they want on platforms you don't control. Don't import them; just let them exist and reply generically.
- Lead with substance. Your qualifications, training, memberships, the services you offer, your fees, and factual health education are all not just permitted but genuinely useful. A trustworthy medical site is built on verifiable facts, not on borrowed outcomes.
- Reframe the win. Instead of "this treatment changed my life," a compliant site says what you do, who you are, and why patients find the practice easy to deal with. That's more durable trust anyway.
If you want a system for gathering the safe feedback, managing your Google presence, and keeping replies compliant, that's exactly what our Google Business Profile service is built to do. It collects and surfaces the non-clinical social proof you're allowed to use, and handles the review platforms properly rather than nervously.
The habit that keeps you safe
You don't need to memorise the National Law to get this right. You need one reflex before anything with a patient's words goes live: does this mention a symptom, diagnosis, treatment, or outcome?
If it does, it doesn't go on a surface you control. If it's about the experience of dealing with your practice, it's fine. And the reviews patients leave on Google or anywhere else you don't own: leave them be, reply kindly and generically, and never import them.
That single question resolves the vast majority of the anxiety we hear about reviews. It's not that you can't show social proof. It's that the proof has to be about the experience, not the medicine.
Getting this right at the design stage is far cheaper than untangling it after a complaint, which is why we bake it into how we build. If you'd rather not carry the risk of interpreting all of this yourself, our AHPRA-compliant content service writes and reviews your site to stay on the right side of these rules, and our Google Business Profile service handles the reviews side properly. Either way, the goal is the same: a website patients trust, built on things you can actually stand behind.