AHPRA and Google Reviews: What Australian Clinics Can (and Can't) Do in 2026

If you run a physio, dental, GP, chiro, podiatry or allied health clinic in Australia, you have probably heard some version of "AHPRA doesn't allow reviews". It is one of the most repeated — and most wrong — pieces of compliance folklore in Australian healthcare. The result is that thousands of excellent clinics sit on a handful of ancient Google reviews while less careful competitors dominate the local map pack.

The truth is more useful: the National Law restricts testimonials in your advertising, not the existence of Google reviews. There is a clear, defensible way for clinics to ask for reviews, respond to them, and grow their Google presence without going anywhere near a breach.

This guide walks through what the law actually says, where the real tripwires are (hint: it is your website, not Google), safe wording for asking patients, privacy-safe responses, and a workflow your front desk can run on autopilot. It is general information, not legal advice — the disclaimer at the end matters, so read it.

What counts as a testimonial under the National Law

The rule everyone is worried about is section 133 of the Health Practitioner Regulation National Law. In plain terms, it prohibits advertising a regulated health service in a way that uses testimonials or purported testimonials about the service or the business providing it. The section also prohibits advertising that is false, misleading or deceptive, offers inducements without stating the terms, or creates unreasonable expectations of beneficial treatment.

Three words carry almost all the weight: advertising, testimonial, and regulated health service.

Advertising

Advertising is content you use to promote your services — your website, your social media accounts, brochures, signage, paid ads, email newsletters. The key is control and purpose: if you chose to publish or republish it to promote the clinic, it is advertising.

Testimonial

In AHPRA's guidance, a testimonial is a statement about the clinical aspects of a regulated health service — symptoms, diagnosis, treatment, outcomes, a practitioner's clinical skill. A comment that your receptionist is lovely and the car park is easy is feedback, but it is generally not a clinical testimonial. "Dr Chen fixed my sciatica in three sessions" absolutely is.

Regulated health service

The ban applies to services provided by (or usually provided by) AHPRA-registered practitioners — the 16 registered professions including medicine, dentistry, physiotherapy, psychology, chiropractic, nursing and Chinese medicine. A beauty salon or personal trainer is not caught by the National Law (though everyone is caught by the Australian Consumer Law rules on fake and misleading reviews).

Put those together and the shape of the rule appears: you must not use clinical testimonials in content you publish to promote a regulated health service. Nothing in that sentence says patients cannot review you on Google.

Why reviews on Google itself are usually fine — but embedding them on your site isn't

This is the distinction that trips up most clinic owners, and it is worth being precise about.

Google reviews live on Google's platform. You did not publish them, you cannot edit them, and you do not control whether they appear. AHPRA's guidance recognises that practitioners are not expected to police what patients say on third-party review platforms they do not control. A five-star review describing a patient's treatment, sitting on your Google Business Profile, is generally not your advertising and generally not your breach.

The moment you republish that review, everything changes. Copy it onto your website, screenshot it for Instagram, quote it in a brochure or a Google ad — now you have used a testimonial in your advertising, and if it touches clinical matters you have a section 133 problem.

Scenario	Generally OK?	Why
Patient posts a clinical review on Google unprompted	Yes	Third-party platform you do not control; not your advertising
You link to your Google profile ("Find us on Google")	Yes, with care	A neutral link is not the same as republishing testimonials
You embed a review widget showing clinical reviews on your site	No	Republishing clinical testimonials in your advertising
You display only non-clinical reviews (service, wait times, facilities)	Usually	Not testimonials about clinical care — but do not edit or cherry-pick misleadingly
You screenshot a glowing review for social media	No, if clinical	Social posts promoting the clinic are advertising
You ask a patient to describe their treatment outcome in a review	No	Soliciting a clinical testimonial for promotional use

Notice the nuance in row four. AHPRA's guidance distinguishes clinical from non-clinical content within reviews. A review widget is not automatically banned — a widget that displays clinical testimonials is. That means clinics face a filtering problem no generic review tool solves: most widgets are built for cafes and plumbers and will happily render "cured my back pain" on your homepage.

Limelight's review widget has a clinic mode built for exactly this: it screens review content for clinical claims — treatments, outcomes, symptoms — and only displays reviews that pass, so your website shows social proof without republishing testimonials. It is the only Australian review platform built with the National Law in mind. See how it fits your clinic at our pricing page.

Can you ask patients for reviews? Yes — carefully

Nothing in the National Law prohibits asking a patient for feedback or a review. What matters is how you ask. Three principles keep you safe:

1. Ask for their experience, not their outcome. Never prompt for clinical content. "Tell people how your treatment went" is asking for a testimonial. "We'd love your feedback on your visit" is not.
2. No incentives, no conditions. Do not offer discounts, gifts or entries into draws for reviews, and never make a request conditional on the review being positive. That risks both AHPRA's inducement rules and the ACCC's position on incentivised and fake reviews.
3. Ask everyone. Only asking the patients you know are delighted is review gating — against Google's policies and a misleading-conduct risk. A consistent ask to every patient is both fairer and, in practice, more effective.

Safe wording that works

SMS after an appointment: "Hi Sam, thanks for visiting Coastline Physio today. If you have a moment, we'd appreciate your feedback on your experience with us: [link]. — The Coastline team"

Front desk script: "If you were happy with how everything went today, we'd really value a Google review — there's a QR code at the desk. Whatever you'd like to share about your experience helps other locals find us."

Both versions ask for experience, promise nothing, and leave the content entirely to the patient. If the patient chooses to write about their treatment, that is their speech on Google's platform — the compliance issue only arises if you solicited it or republish it. For more templates across industries, see our review request template library.

Responding to reviews without breaching privacy

Review responses are where clinics get into trouble fastest, because the risk here is not advertising law — it is privacy. Your obligations to protect patient information do not pause because the patient went public first.

The cardinal rule: never confirm the reviewer was your patient, and never discuss their care — even if they described it in detail, even if what they wrote is wrong, even if you are certain who they are. "You missed two appointments before complaining" is a privacy breach dressed as a defence.

A safe response pattern:

"Thank you for taking the time to share this. We take all feedback seriously and are committed to providing high-quality care and service to everyone who visits us. We can't discuss individual circumstances here, but we'd welcome the chance to talk directly — please call us on (03) XXXX XXXX or email the practice manager."

Note what it does not do: it does not say "your appointment", "your treatment" or anything acknowledging a clinical relationship. It moves the conversation offline, which is both compliant and the only place a resolution can actually happen. We have a full set of privacy-safe scripts in our negative review response examples, including a dedicated clinic section.

Positive reviews deserve replies too — they signal engagement to Google and to prospective patients. Keep them equally generic: "Thanks so much for the kind words — we really appreciate you taking the time." No treatment talk, no patient confirmation.

A compliant review workflow for clinics

Here is a workflow that grows your Google profile steadily without a single grey-area step. Clinics running a version of this typically see reviews arrive weekly instead of yearly, because the ask happens every time rather than when someone remembers.

1. Trigger on the appointment, not on vibes. When an appointment is completed in your practice management system, that is the moment to ask — consistently, for every patient, with no gating.
2. Send a neutral SMS. Use experience-based wording like the templates above, with a direct link to your Google review box. SMS gets read; emails about feedback mostly do not.
3. Route concerns privately first. Give unhappy patients an obvious direct channel (reply to the SMS, call the desk). You are not blocking them from Google — you are making it easy to raise problems with you, which is good clinical governance anyway.
4. Respond to every review with privacy-safe replies. Draft responses that never confirm patient status; have one owner approve before posting.
5. Only display filtered, non-clinical reviews on your own channels. If you want reviews on your website, every displayed review must be screened for clinical content first.
6. Audit quarterly. Check your profile for unanswered reviews, check your website and socials for accidentally republished testimonials, and benchmark against nearby clinics.

Limelight runs steps 1–5 for you: it connects to Cliniko, sends a compliant SMS review request after each completed appointment, drafts privacy-safe replies for you to approve, and its AHPRA-aware widget filters clinical content before anything touches your website. For step 6, run the free Google Review Checker — 60 seconds, no account, and it flags unanswered reviews and shows how you compare with clinics near you.

Compliance checklist

Before you send a single review request, confirm:

• Requests ask for feedback or experience — never outcomes, results or treatment stories
• No incentives, discounts, gifts or prize draws attached to reviews
• Every patient gets the same ask — no gating by satisfaction
• No Google reviews copied to your website, socials or brochures unless screened as non-clinical
• No editing, trimming or selective quoting of reviews you do display
• Review replies never confirm someone was a patient or reference their care
• One person owns approval of all public replies
• You have read the current guidance on AHPRA's advertising hub — it is updated periodically and prevails over any summary, including this one

Where clinics actually stand in 2026

The clinics winning local search are not the ones bending the rules — they are the ones who realised the rules never banned asking. A consistent, neutral, un-incentivised ask after every appointment compounds: most Australians read reviews before choosing a healthcare provider, and a profile with recent, responded-to reviews is what convinces them. Meanwhile the compliance risks — republishing, cherry-picking, privacy-breaching replies — are all avoidable with a decent workflow.

Start by seeing where you stand today: the free Limelight Review Checker gives you a health score, an unanswered-review audit and a benchmark against local competitors in about a minute. Then choose tooling that understands healthcare, because generic review software will cheerfully walk you into a section 133 problem.

Disclaimer

This article is general information for Australian clinic owners, not legal advice, and it summarises the position at the time of writing. The National Law, AHPRA's advertising guidance and privacy obligations are detailed and change over time, and how they apply depends on your profession and circumstances. Before making decisions about advertising or patient communications, check the current guidance on AHPRA's advertising hub and, where the stakes are significant, get advice from a lawyer or your professional indemnity insurer.