No. National Law section 133 bans a regulated health service from using a patient testimonial, a quoted review, or a star rating inside its own advertising. Asking a patient for a review is legal. The review sitting on your Google Business Profile is legal. The breach starts only when you repost a patient's words as your own promotional claim, in an ad, on a landing page, or in social creative.
Key takeaways
- Asking patients for reviews is legal. Section 133 of the National Law regulates advertising, not solicitation.
- A review sitting on your Google Business Profile is the patient's own speech, not the practice's advertisement.
- Quoting a review or a star rating inside ad copy, a landing page, or social creative is the testimonial breach.
- A public reply can count as the practice adopting and endorsing the review, which is a separate trap from quoting one.
- Factual experience markers (years operating, AHPRA registration number, accreditations) are the compliant substitute for social proof.
- Penalties run up to $60,000 per offence for an individual and $120,000 for a body corporate, and the marketing agency is in scope too.
Can a clinic ask patients for Google reviews?
Yes. Section 133 of the National Law governs how a regulated health service *advertises*, and asking a patient for a rating is not an advertisement, it is a request. Nothing in the National Law stops a clinic from inviting patients to leave a review.
What matters is how the request is made. Every eligible patient gets the same neutral invitation, sent the same way, at the same point after their visit. No filtering people by how the appointment went before deciding who gets asked, and no discount or gift offered in exchange for a rating. That last point matters beyond AHPRA too: the Australian Consumer Law treats review gating and paid-for reviews as misleading conduct in their own right, separate from any health-specific rule.
Is it a problem that reviews sit on my Google Business Profile?
No. A review on your profile is the patient's own speech. The practice did not write it, is not required to write it, and does not control what it says. That is a meaningful difference from advertising, which is copy the practice itself authors and controls.
The distinction the National Law actually draws is between content a patient publishes independently on a third-party platform, and content the practice takes and republishes as part of its own promotional material. The first sits outside advertising. The second is exactly what section 133 was written to stop.
Can I quote a patient review in my ads?
This is where the line actually sits, and it is the part clinics get wrong most often.
The moment a practice lifts a patient's words, or a star rating, out of a review and puts them into anything the practice controls, that content becomes the practice's own advertising claim. It no longer matters that a patient said it first. The practice chose to use it, which makes the practice responsible for it.
| What happens to the review | Where it sits |
|---|---|
| Patient leaves it on your Google Business Profile | Fine. It is the patient's speech, not the practice's advertisement. |
| You invite every patient the same way, on the same schedule | Fine. Section 133 governs advertising, not solicitation. |
| You quote the review, or the star rating, in an ad, a landing page, or social creative | The breach. The practice has made the patient's words its own advertising claim. |
| You reply publicly to the review | Can be a breach. A reply can be treated as adopting and endorsing what it says. |
| You cite years operating, an AHPRA registration number, or accreditations instead | Fine. Factual claims about the practice, not a testimonial about an outcome. |
The rule applies everywhere the practice controls the message: Google and Meta ad copy, the website, landing pages, social posts, email, and printed material. For cosmetic procedures the restriction is even tighter again: no patient endorsements, no "as seen on" framing, and no review quotes or star ratings anywhere in the funnel, ad or landing page alike.
Can replying to a review get a clinic in trouble?
It can, and this is the trap that catches clinics trying to do the right thing.
A public reply looks like good customer service. But a practice replying to a review is treated as the practice engaging with, and potentially adopting, what that review says. Reply "thank you, we're so glad the treatment worked for you" and the practice has just repeated a clinical outcome claim in its own voice, on a page it does not fully control the fate of. That is functionally the same problem as quoting the review in an ad, reached by a different route.
The conservative position is not to reply to reviews that touch on clinical care at all. If a reply is considered for something clearly non-clinical, like parking or wait times, it should be checked the same way a piece of ad copy would be, before it goes up, not after.
What can I use instead of reviews in my advertising?
Factual, verifiable claims about the practice rather than claims about outcomes.
- Years operating. "Serving [suburb] since [year]" is a fact about the business, not a testimonial.
- AHPRA registration. Naming a practitioner's registration type and number is allowed, and expected wherever a practitioner is named.
- Accreditations. Practice-level accreditation is a verifiable, third-party fact, not a self-assessment.
None of these describe how a patient felt about their treatment, which is exactly why they clear the testimonial ban that a quoted review or star rating cannot.
What happens if a clinic breaches this rule?
Penalties under National Law section 133 run up to $60,000 per offence for an individual and $120,000 for a body corporate. AHPRA runs proactive compliance sweeps, so a breach does not need a patient or a competitor to complain before it gets picked up. The marketing agency that wrote the copy carries liability alongside the clinic, not instead of it, which is why the line between "reviews exist" and "reviews are quoted" is worth getting right the first time rather than fixing after a notice arrives.
Getting the invitation, the profile, and the ad copy each handled correctly is most of what our healthcare reviews and reputation service does: a neutral, consistent invitation to every eligible patient, reviews left where patients put them, and clinical content kept out of anything the practice publishes as its own. It sits alongside the document side of the same problem, covered under practice compliance, where the policy manual and patient consent paperwork get the same current, audit-ready treatment.
If the same invitation workflow is meant to fire off the back of a completed appointment rather than get sent manually, that trigger usually lives on the same phone and booking system patients already call. If you want to hear what an AI-run reception line sounds like before deciding whether to wire the two together, the voice options are here.
Founder, LUNA Systems · Registered Nurse (AHPRA: NMW0002113429)
Former nurse and beauty therapist turned automation consultant. Justine builds custom AI systems for Australian service businesses, so they can stop chasing leads and start growing.
Want automation tips in your inbox?
Get weekly insights on business automation. No spam, unsubscribe anytime.
