# Patient reviews on a medical website: the rules > When a UK practice may publish patient reviews, what the CAP Code, the GMC, the GDC and consumer law require of each one, and a way to show them that holds up. Source: https://www.nodsites.com/blog/patient-reviews-on-a-medical-website/ Updated: 2026-10-12 Rules When a UK practice may publish patient reviews, what the CAP Code, the GMC, the GDC and consumer law require of each one, and a way to show them that holds up. NodsitesPublished 5 October 20266 min read A UK practice may publish patient reviews on its website. Once there, they are advertising, and four sets of rules apply at once: the CAP Code that the ASA enforces, the professional regulator’s standards, the duty of confidentiality to the patient, and consumer law on fake and hidden-incentive reviews. None bans reviews; all four govern which, with what evidence, and how. **Key points** - Every testimonial needs documentary evidence that it is genuine, the person’s permission and their contact details on file. - A claim inside a review is a claim like any other: a review that says a treatment ended a condition needs the same evidence as the practice’s own claim. - A review that reveals a condition is the patient’s to publish; republishing it needs written consent, and a reply never confirms that someone was a patient. - Fake reviews, concealed incentives and cherry-picking are banned practices in consumer law; show reviews dated, sourced, unedited and with the platform named. ## The advertising rules: a testimonial is a claim The CAP Code applies to a practice’s website as to any advertisement, and section 3 has rules written for testimonials: documentary evidence that each is genuine and contact details for the person who gave it (rule 3.47), the person’s permission (3.50), relevance to the service advertised (3.48), and no claim in it that a reader would take as fact and that misleads (3.49). An incentivised review must say so (3.45), and reviews may not be presented selectively (3.46). Objective claims need documentary evidence before publication (3.7), and CAP’s advice is explicit that a testimonial is not that evidence. A review that says the consultation was unhurried describes an experience; a review that says a procedure ended years of pain is an efficacy claim, which for a health claim means clinical evidence; a review that says the result is permanent is a promised outcome, which no practice can publish. Section 12 adds the medical layer: objective claims about a treatment need evidence (12.1); advice, diagnosis or treatment for a condition that needs medical supervision may be offered only under a suitably qualified health professional, and nothing may discourage essential treatment (12.2); nothing may falsely claim that a treatment works against a disease (12.6), and words that promise complete recovery are generally unacceptable (12.7). CAP’s health advice names cancer, fertility problems, depression, arthritis and insomnia among the conditions it reworks in practitioners’ copy, and prefers testimonials about how the person felt. ## What the GMC and the GDC expect Good medical practice 2024, in force for doctors since 30 January 2024, deals with this in three paragraphs: a doctor must be honest and trustworthy, and keep patient confidentiality, in every communication (88); information communicated as a medical professional must be accurate and not misleading, with nothing relevant left out and opinion not presented as fact (89); and when advertising services the doctor follows those two paragraphs, declares any conflict of interest and must not exploit people’s vulnerability or lack of medical knowledge (90). The GDC’s guidance on advertising, under principle 1.3.3 of its Standards, asks that advertising be legal, decent, honest and truthful, that claims be backed by facts, and that nothing create unjustified expectations about the results a dentist can achieve, and lists what a practice website must show. A row of reviews that all describe the same perfect outcome creates an expectation no dentist can justify. The registration number and the complaints route are among the fixed things [a private practice website needs](https://www.nodsites.com/blog/what-a-private-practice-website-needs/). ## Consent and confidentiality A review that names a condition or a treatment is the patient’s story. On the practice’s website the practice is telling it, and the GMC’s duty of confidentiality applies to the retelling. So a review that reveals anything about a person’s health is republished with written consent or not at all. Replies follow the same duty: thank the writer, say nothing about their care, never confirm that the person was a patient, never correct a clinical detail in public, and answer a complaint by offering a private route. The review is also health data under data protection law; the rules are in [what a practice website’s privacy notice has to say](https://www.nodsites.com/blog/privacy-and-cookies-on-a-practice-website/). ## Consumer law: fake, incentivised and cherry-picked From 6 April 2025 the Digital Markets, Competition and Consumers Act 2024 replaced the Consumer Protection from Unfair Trading Regulations 2008, and its list of banned practices gained a paragraph on reviews. The CMA’s guidance of 4 April 2025 defines a fake review as one that purports to be based on genuine experience and is not, and a concealed incentivised review as one commissioned without that being made apparent. The same paragraph bans publishing reviews in a misleading way: suppressing genuine critical reviews, selecting favourable ones, editing or withholding negative ones, or inviting reviews solely from people known to be satisfied. A practice that publishes reviews on its own site is a publisher under this rule and must take reasonable and proportionate steps to keep banned reviews off its pages: a policy, a risk assessment and a process. Still allowed: inviting every patient to leave a review without steering the content, and an incentive the review discloses. ## A way to present reviews that holds up - Each review carries its date and the platform it came from. - The text is unedited; a cut is marked as a cut. - The writer appears by first name or initials, with their agreement, and no clinical detail appears without written consent. - No star rating stands as a claim: a figure needs its source, the number of reviews behind it and the period. - One line says how reviews are collected and whether any were incentivised; an evidence file holds each review’s original, date, permission, contact details and consent. - Each review is read against the claims rule before it goes up: experience stays, outcome claims come out. Reviews are copy, and the discipline that makes [a treatment page say no more than can be shown](https://www.nodsites.com/blog/writing-a-treatment-page-patients-understand/) applies to them; both are part of the [practice copywriting](https://www.nodsites.com/medical-website-design/#practice-copywriting) of a site. ## Common questions ### Can we embed a widget that pulls reviews from a review platform? The reviews are still published by you, so the same rules apply, and a feed that filters out critical reviews is selective presentation. A widget is also a script, with a consent question of its own; the plain alternative is a short, dated selection and a link to the platform. ### Can we ask patients for reviews? Yes. Invite everyone; do not suggest what to write; disclose any incentive; and make nothing conditional on a positive review. ### A genuine review promises a result. Can we show it? A true review of an outcome is still an efficacy claim, so it needs the evidence that claim would need. Without it, show the experience part with the cut marked, or keep the review in the evidence file. This article explains the rules in general terms and is not legal advice. This is part of the practice copywriting work on every website we look after. ## References 1. CAP Code: 03 Misleading advertising, Committee of Advertising Practice — [asa.org.uk](https://www.asa.org.uk/type/non_broadcast/code_section/03.html) · Accessed 2026-10-11 2. CAP Code: 12 Medicines, medical devices, health-related products and beauty products, Committee of Advertising Practice — [asa.org.uk](https://www.asa.org.uk/type/non_broadcast/code_section/12.html) · Accessed 2026-10-11 3. Testimonials and endorsements, CAP AdviceOnline (2026) — [asa.org.uk](https://www.asa.org.uk/advice-online/testimonials-and-endorsements.html) · Accessed 2026-10-11 4. Claims in testimonials and endorsements, CAP AdviceOnline (2025) — [asa.org.uk](https://www.asa.org.uk/advice-online/claims-in-testimonials-and-endorsements.html) · Accessed 2026-10-11 5. Health: Therapies (General), CAP AdviceOnline (2022) — [asa.org.uk](https://www.asa.org.uk/advice-online/health-therapies-general.html) · Accessed 2026-10-11 6. Good medical practice: Domain 4, Trust and professionalism, General Medical Council (2024) — [gmc-uk.org](https://www.gmc-uk.org/professional-standards/the-professional-standards/good-medical-practice/domain-4-trust-and-professionalism) · Accessed 2026-10-11 7. Guidance on advertising, General Dental Council (2013) — [gdc-uk.org](https://www.gdc-uk.org/standards-guidance/standards-and-guidance/gdc-guidance-for-dental-professionals/guidance-on-advertising) · Accessed 2026-10-11 8. Fake reviews (CMA208): guidance on the prohibition under paragraph 13 of Schedule 20 to the DMCC Act 2024, Competition and Markets Authority (2025) — [gov.uk](https://www.gov.uk/government/publications/fake-reviews-cma208) · Accessed 2026-10-11 ## Related posts [All posts](https://www.nodsites.com/blog/) - Rules ### [Advertising licence for a UAE clinic website](https://www.nodsites.com/blog/advertising-licence-for-a-uae-clinic-website/) A UAE clinic website is healthcare advertising: the MOHAP licence, the emirate’s approval, Arabic, what is barred, and keeping health data in the UAE. 11 October 20266 min read - Rules ### [A clinic website in Türkiye: one site or two?](https://www.nodsites.com/blog/clinic-website-in-turkiye-one-site-or-two/) Patients in Türkiye may be informed, not advertised to; a health-tourism authorisation allows promotion abroad on a separate site. Where the line sits. 9 October 20266 min read - Rules ### [Privacy and cookies on a UK practice website](https://www.nodsites.com/blog/privacy-and-cookies-on-a-practice-website/) What a practice website’s privacy notice must say under UK GDPR, when a cookie needs consent, and what the 2025 Data Act changed for a small practice. 1 October 20266 min read Ready when you are ## Your website, without the project Tell us about your practice in one short form. We read it the same working day, reply within one working day, and if it looks like a match we book the call around your clinic hours. [Start Your Project](https://www.nodsites.com/enquire/)[Our Process](https://www.nodsites.com/process/)