Asking patients for reviews without breaking the law

The belief worth correcting first

Most clinic owners we talk to assume that offering something small in exchange for a review, £5 off the next session, entry into a prize draw, a free follow-up, is generous customer service rather than a legal problem. It was a grey area for years and it is not one now.

The Digital Markets, Competition and Consumers Act added fake and concealed incentivised reviews to the list of banned commercial practices, applying to anything done from 6 April 2025 onward. The CMA's fake reviews guidance (CMA208) sets out how it reads the rules. The maximum penalty for a breach of the consumer protection regime is up to 10% of global turnover.

Read the ban precisely, because the detail matters: incentivising a review is not itself illegal. Concealing the incentive is. What is banned outright is commissioning or publishing fake reviews, offering an incentive without clear disclosure, hiding genuine negative reviews, and presenting a star rating in a misleading way.

This is being enforced, not just legislated

On 27 March 2026 the CMA opened investigations into five named businesses over their handling of reviews. The practices under examination map almost exactly onto the shortcuts small businesses take: withholding one-star reviews from publication and from the rating calculation, staff being asked to write positive reviews, discounts offered for five-star ratings without disclosure, and rating systems that inflate scores.

None of the five is a clinic. The relevance is that these are the specific behaviours the regulator has decided to test, and every one of them has a small-business version. Platforms also now have their own duty to detect and remove fake reviews, so the old workarounds are getting harder from both directions.

What a clinic may do

• Ask every patient, plainly. There is no limit on asking. A direct request at the point of discharge, or a follow-up message a few days later, is entirely compliant.
• Ask everyone, not only the happy ones. Selecting who gets asked based on how well their treatment went is where "asking" turns into curating a rating.
• Make it easy. A short link straight to the review form, sent by text or email, converts far better than a QR code on a leaflet.
• Reply to everything, including the critical ones, within the confidentiality limits below.
• Offer an incentive only with clear disclosure, disclosed by the reviewer, in the review itself, and made available regardless of whether the review is positive. In practice this is more trouble than it is worth for a clinic, and we would advise against it. If you do it, the disclosure has to be visible to someone reading the review, not buried in your terms.

What a clinic must not do

• Write reviews yourself, or ask staff, family or friends to. This includes a receptionist leaving one "to get the account started".
• Buy reviews, from anywhere, at any price.
• Offer a discount, freebie or draw entry for a five-star review specifically. Conditioning the reward on the rating is the clearest version of the offence.
• Filter which reviews get published. If you gather feedback and only route the positive respondents to Google while the unhappy ones get a private form, that is review-gating, and it is exactly the pattern under investigation.
• Display a rating that flatters. An average on your website that excludes the bad ones, or a "rated 5 stars by our patients" claim you cannot evidence, is a misleading practice in its own right, and healthcare advertising sits under the CAP Code as well.

The part that is specific to healthcare: confidentiality

This trips up more clinics than the DMCC rules do, because it feels like ordinary customer service. A patient leaves a negative review claiming their treatment did nothing. The instinct is to correct the record: "you attended three sessions and did not complete the home programme we agreed".

That reply confirms the person is a patient and discloses clinical detail in public. It is a confidentiality breach, which makes it a regulatory matter for the registrant rather than a marketing misstep. It is also, from a purely commercial standpoint, the worst-reading reply on any clinic's profile.

The reply that works acknowledges the feedback, gives no clinical detail, confirms nothing about attendance, and moves the conversation off the platform. Something in the shape of: "Thank you for taking the time to share this. We are sorry to hear that your experience did not meet expectations. We take all feedback seriously and would welcome the chance to discuss it directly, please contact the practice manager on [number] or at [email]." Say the same thing whether the reviewer is a patient, a former patient, or nobody you recognise, because your reply must not reveal which.

A review process that stands up

1. Ask at the end of the episode of care, when the patient has the outcome they came for. Discharge is the natural moment.
2. Send one message, with a direct link. Text tends to work better than email for this.
3. Send it to everyone discharged, on the same schedule, with no filtering by how it went. Automating it is the simplest way to prove you did not choose.
4. One reminder, then stop.
5. Reply to every review within a few days, using a template for negative ones so nobody replies while annoyed.
6. Keep a record of how the request is worded and who it goes to. If your process is ever questioned, being able to show what you asked and who you asked is most of the answer.

Why the compliant route also performs better

A profile of consistently perfect five-star reviews reads as bought, to patients as much as to regulators. A rating in the high fours with a handful of measured criticisms and thoughtful replies underneath reads as a real practice. The replies do more work than the reviews: a prospective patient reading a critical review and a calm, professional response learns something useful about how you would treat them if something went wrong.

Steady flow matters more than total count. Twenty reviews spread across the year beats sixty from one campaign in 2023, both for how it looks to a patient and for how a local search ranking treats freshness.

Reviews also increasingly get read back to patients by something other than a patient. The summaries an AI assistant produces about a local clinic draw on the same review text, which is another reason a profile of thoughtful replies outperforms a wall of five-star one-liners. We covered that in more detail in how to get your clinic found in AI search.

How this works at ClinicGrowth

The assumption we most often have to unpick is that reviews are a scoreboard to be managed, that the aim is a clean five-star average and the job is keeping the bad ones off it. It is an understandable instinct, and since April 2025 it is also the assumption that carries legal risk, because almost every technique for maintaining a perfect average is now a banned practice.

The commercial reality points the same way as the law. Patients choosing a physiotherapist in Reading or Southampton are not comparing 4.9 against 4.7; they are reading the three most recent reviews and your replies to them. What converts is evidence that a real practice handles real people well, which a curated profile actively undermines. Clinics that ask everybody, publish what comes back and reply carefully end up with fewer perfect ratings and more bookings, and nothing on the profile that a competitor could report.

At ClinicGrowth we see this most weeks with clinics that have inherited a review process nobody has looked at since the rules changed. A free clinic review includes checking yours against what is now allowed.

Questions we get asked

Ask everyone, disclose anything you give, reply to all of it, and never confirm in public who is a patient. That is the whole policy, and it fits on a card by the front desk.

Get a free clinic review Back to Blog