How a Medical Clinic Can Reply to a Negative Google Review Without Breaching Patient Privacy

2026-09-24

Someone has left your clinic a one-star review about a long wait, a gap fee or a doctor who did not listen, and everything you would need to answer it is sitting in a patient file. You cannot use any of it. You cannot even say whether the reviewer is a patient.

That is the constraint every medical clinic, physio, psychology practice and specialist rooms works under, and it catches out practice managers who reply the way a café would. Here is what a clinic can safely say, the handful of review types that still come down, and how to file them without putting patient information anywhere it should not be.

What a clinic cannot say in public

Health information is among the most protected kinds of personal information in Australian privacy law, and registered practitioners carry professional duties of confidentiality on top of that. A public Google reply is a disclosure to anyone with an internet connection. So the rule for a clinic is simple and strict: a public reply must not confirm or deny that the reviewer is, or ever was, a patient.

That rules out more than most people expect:

• Confirming the visit. "We are sorry your appointment ran late" confirms there was an appointment.
• Denying the visit. "We have no record of you" is a statement about a person's patient status too.
• Treatment, diagnosis and results. Nothing about what was examined, prescribed, referred or found.
• Billing. No gap fees, bulk billing status, Medicare items, outstanding accounts or missed appointment fees.
• Their own disclosures. If the reviewer has posted their name, condition and appointment time, that was their choice. Your reply cannot add to it, correct it or confirm it.

The slips usually come from trying to be helpful. This is the difference in practice:

The left column may be accurate. It is still a disclosure. The right column tells the next reader how the clinic works without saying a word about the person who wrote the review.

The reply that works: general standards, then the practice manager

A good clinic reply is short, and it is written for the next patient deciding whether to book, not for the reviewer. It does three things:

• Explains, in general terms, why the clinic will not discuss the detail. Worded so it would be true whether or not the reviewer is a patient.
• States one practice standard that speaks to the complaint. On waits, how reception tells people when a doctor is running behind. On fees, when they are explained. On care, how concerns are handled.
• Invites direct contact through the practice manager, by role or first name, with a phone number or email for the practice.

The sentence that carries most of it might read: "We cannot discuss anyone's care in a public forum, but our practice manager would like to hear from you directly on [practice phone]." Everything else in the reply supports that sentence.

Three things to leave out even when the review invites them:

• The clinician's name. If the reviewer named a doctor, your reply should not repeat it.
• Any defence of the clinical decision. The review can argue about care. The reply cannot.
• A reaction to a complaint threat. A reviewer who says they are reporting the clinic to AHPRA or a health complaints commissioner is using a right they have. That is not a threat of harm, and it is not removable. The same calm, general reply works, and a line pointing to your complaints process shows you have one.

The Google Review Removal Playbook has a reply template for a review you dispute that suits most clinic replies, with two changes: make its practice sentence a general standard like the ones above, and drop any line that refers to your records, because for a clinic that line is itself a disclosure.

What still comes down

Clinics are held to the same content rules as every other business on Google. A harsh, one-sided account of a real appointment stays up, including sharp criticism of a doctor's manner or decisions. But a clinic's reviews cross the same lines as anyone else's, and these are the ones we see most in health.

Personal attacks on a named clinician or staff member. Reviewers are allowed to name the doctor who saw them and describe how they were treated. "Dr [name] rushed me and did not examine my knee" is an account, and it stays. The breach is when the review turns on the person: "Dr [name] is a quack and a disgrace who should be struck off" goes after their competence as a person, their character and their right to practise. Receptionists are the other frequent target, and an attack on a named front-desk worker is often a stronger case than one on a doctor. Report as Bullying or harassment; the appeal policy is Harassment. Our posts on reviews attacking an employee and dental reviews that name staff show where the line sits.

Private details. A doctor's personal mobile number, the street a nurse lives on, or details about another patient ("the woman in the waiting room with the rash on her face"). Report as Personal information, which is also the policy name for the appeal.

Threats of harm. "I'll be waiting for that doctor in the car park" is a threat against a person. Report as Bullying or harassment; the policy is Harassment.

A crime stated as fact. "They rort Medicare" or "fraudsters who bill for things they never did", stated flatly as a fact about the practice, is a label rather than an account. Report it as Spam; the appeal policy is Misrepresentation. "I was charged a gap fee nobody told me about" is an account of a billing experience, and it stays.

All of these are reported from Google's Reviews Management Tool, signed in to the account that manages the clinic's profile. If a first report comes back "Report reviewed, no policy violation", the review becomes eligible for one appeal, and our guide to how to appeal a Google review decision walks through the form.

Patient information has no place in the appeal either. The appeal is not public, but it is still a disclosure to a third party, and it does not need anything from the file. A strong appeal quotes the words in the review, names the policy and connects the two. "This patient attended on the 14th and was treated appropriately" helps nothing and discloses a great deal. It also turns the appeal into an argument about what happened in the room, which Google will not referee.

Do not trade a resolution for a review

AHPRA's advertising guidelines restrict how registered health practitioners use testimonials about clinical care, and offering anything in return for a review is off limits under those guidelines and under Google's own rules. In a complaint, that has a practical consequence clinics miss.

When the practice manager calls the patient to resolve the complaint, the review stays out of the conversation. No asking them to take it down, change the rating or post a new one. No fee waiver or refund that depends on it. Resolve the complaint on its merits. If the patient decides to update the review afterwards, that is their decision, made freely.

The same care applies to asking for reviews in general. Ask every patient the same way at the same point, never offer an incentive, and be careful about reposting patient reviews about clinical care on your own website or social pages, because that is where the testimonial rules apply most directly. Dental practices work under the same rules, and our page on review removal for dental and medical practices covers how we approach health profiles.

Before anyone at the clinic replies

Run the reply past one question: could a stranger learn anything about this person's health, care, bills or attendance from it? If yes, rewrite it.

Then read the review itself for the four breaches above: an attack on a named person, a private detail, a threat, or a crime stated as fact. Report any you find the same day, keep a screenshot, and post the general reply at the same time. If the review comes down, the reply goes with it, and if it stays, the next patient reads a clinic that kept its patient's confidence even under pressure.

Several locations or a group? Talk to us about a managed service · Popular locations: Sydney · Melbourne · Brisbane · Perth · Adelaide · Gold Coast · all locations