Responding to reviews without breaching confidentiality

Every review reply a clinic writes is read by future patients and, potentially, by a regulator. The constraint that makes clinic replies different from any other sector is that confirming a person was a patient is itself a disclosure, and it is not waived by the fact that they said so publicly first.

What follows is a framework that satisfies the reader without crossing that line.

The rule underneath everything

Registered practitioners have confidentiality obligations governed by their regulator. The GMC standards set these out for doctors, and equivalent obligations exist across the regulated professions. Data protection law applies alongside them, and the Information Commissioner's Office publishes guidance on handling personal data.

The practical consequence: a public reply must not confirm attendance, treatment, dates, clinical findings or outcomes. It must not correct the reviewer's clinical account, however wrong it is.

The four-part reply

1. Thank and acknowledge. One sentence, warm, no defensiveness.
2. State the general standard. What the clinic does as a matter of course, phrased generally and not as a claim about this person.
3. Offer a private route. A named contact and a method, so a reader sees a real path.
4. Stop. No clinical detail, no correction, no confirmation of attendance.

What that sounds like

For a critical review where you believe the account is inaccurate:

Thank you for taking the time to write. We are sorry to read this. We are not able to discuss any individual's care in a public forum, but we take every concern of this kind seriously and we would like to look into it properly. Please contact our practice manager on the number on our contact page, or email the address listed there, and we will respond within two working days.

For a positive review:

Thank you, that is very kind. We are glad the experience was a good one, and we appreciate you taking the time to say so.

Note what the second one does not do. It does not name a treatment, does not confirm the person attended, and does not add a marketing line. Brevity is not a missed opportunity here.

Things never to write

• Anything confirming the person was seen at the clinic.
• Any clinical detail, including describing what is normal after a treatment they mentioned.
• Dates, appointment times or staff names in connection with a case.
• Any suggestion the reviewer is lying, mistaken or a competitor.
• Any statement that the review breaches a policy. Report it privately instead.
• Any legal threat.

Handling it internally

Reviews should be routed to one named person with authority to reply, who is not the clinician involved. That separation removes the emotional charge and produces better replies. Keep a short internal note of what was investigated and what was resolved, kept in the clinical record system where appropriate rather than in a marketing folder.

When to seek removal

Platforms remove reviews that breach their policies: abuse, obvious spam, conflicts of interest, content that is not about an experience with the business. Report through the platform process, keep a record of the report, and reply publicly in the meantime, because an unanswered review looks worse while the report is pending and most reports do not succeed.

Reviews that describe harm

If a review describes a clinical complication or a safety concern, treat it as a complaint entering through an unusual channel. It should go into the clinic's complaints process with the same rigour as a letter, including any duty of candour obligations that apply. The public reply is the smallest part of that response and should invite the private route immediately.

Write the policy down

A one-page internal document should specify who replies, within what timescale, using which approved phrasings, what is never written, and when a review is escalated to the complaints process. Without it, replies are written by whoever has the login on the day the review appears, which is how confidentiality breaches happen.

The reply is public content

Review replies are indexed, quoted and read by people deciding whether to book. Treat them as published communications with the same care as a page on the site: consistent voice, accurate general statements, no claims that would fail an advertising test, and no clinical assertion you would not make in writing anywhere else.

Approved phrasings, written in advance

The worst replies are written in the ten minutes after someone reads a review that upset them. Writing the phrasings in advance, when nobody is annoyed, removes that risk entirely. Four templates cover almost everything: a short thank you for a positive review, an acknowledgement for a critical one, a response to a review describing a clinical concern, and a response to a review that appears to be about a different business.

Each template should be reviewed once by someone who understands the confidentiality position, and then used as written with only the reviewer's name changed. Improvising is where breaches come from, and a template removes the improvisation without making the reply sound automated, provided the templates are written in a human voice in the first place.

Reading reviews as a signal about the clinic

A single critical review is an event. Three describing the same thing is information. Read the last twenty reviews quarterly and look for the repeated words: waiting, cost, follow-up, being rushed, difficulty getting through on the phone. Those themes are the operational issues that will keep producing reviews until something changes, and no reply strategy addresses them. The reply manages the public record. The pattern tells you what to fix.