Healthcare Reputation Specialists
A negative patient review creates an awkward problem for healthcare providers: you need to show that you take concerns seriously, but you cannot publicly confirm a patient’s identity, treatment or medical history. This article explains the GDPR risks, safer response structures, escalation options and practical examples for UK healthcare practices.
A patient leaves a one-star Google review saying, “The doctor completely ignored my symptoms and I was left waiting for over an hour.” The practice knows exactly who wrote it. The receptionist remembers the appointment. The clinician has the notes. The practice manager knows what happened. And that is precisely where the temptation to write a detailed defence becomes dangerous. The public reply is not the place to prove that the reviewer was wrong. In healthcare, the facts you have available internally are often the very facts you should not publish externally.
Health information receives special protection under the UK GDPR. The ICO classifies information concerning a person's health as special category data, and the definition is broad enough to include information connected with healthcare provision that reveals something about health status. That changes how a GP surgery, dental practice or private clinic should approach review management. The goal of a public response is not to win the argument. It is to demonstrate that the organisation takes concerns seriously without revealing confidential information.
The simplest rule is also the one practices break most easily:
Do not confirm or disclose information about the reviewer simply because they have mentioned it publicly themselves.
A patient might write: “I visited the clinic last Tuesday for treatment and was unhappy with the outcome.”
That does not give the clinic a free pass to reply: “We saw you last Tuesday and explained that your infection was caused by…”
The second response potentially confirms information held by the clinic about that person and their healthcare.
The fact that the patient has disclosed something publicly does not automatically mean the practice can repeat information from its own records. The ICO makes clear that health data is special category data and that processing requires both an Article 6 lawful basis and an Article 9 condition.
For a practice manager, this means the safest public response usually stays at the level of process.
You can say: “We are sorry to hear that you were unhappy with your experience. We take concerns about our service seriously and would welcome the opportunity to discuss this privately.”
You should be much more cautious about saying: “We reviewed your appointment and can confirm that our clinician followed the correct procedure.”
That second sentence may look harmless. It still confirms that the person was a patient and that the practice has reviewed information relating to them.
Avoid publishing:
The same principle applies even when the review is aggressive. A rude review does not reduce the patient's privacy rights. The ICO's guidance also stresses that organisations need to identify a lawful basis before sharing personal data and demonstrate that they have considered the lawfulness of the sharing. That is why a public review response should be treated as an external communication, not as an extension of the patient's record.
Most practices do not need a clever response. They need a repeatable one.
A useful structure has four parts:
For example: “We are sorry to hear that you were unhappy with your experience. We take feedback seriously and would like the opportunity to understand your concerns. For privacy reasons, we cannot discuss individual circumstances in a public forum, but please contact our practice team directly so we can look into this appropriately.”
That is enough. You do not need to defend every criticism. You do not need to explain what the clinician supposedly said. You certainly do not need to write a paragraph proving that the reviewer misunderstood the appointment. Google itself advises businesses responding to negative reviews not to share a reviewer's private information and recommends moving complex situations into a private conversation. For healthcare providers, the reason for that caution is even stronger.
Imagine a dental practice receives this: “Terrible service. I waited forever, then the dentist rushed my appointment and told me I needed expensive treatment. Avoid this place.” The practice knows the appointment lasted the expected time. It knows the dentist discussed several options. It knows the patient's treatment history. None of that belongs in a Google reply.
A sensible response could be: “We are sorry to hear that you felt disappointed with your experience. We take concerns about communication and waiting times seriously. Due to patient confidentiality, we cannot discuss individual cases publicly. Please contact the practice directly so our team can review your concerns with you.” The public reader gets the message. The patient gets an invitation to resolve the issue privately. The practice has avoided turning a one-star review into a public disclosure. That is a much better outcome.
Taking a conversation offline does not mean ignoring the review. That distinction matters. A completely silent response can leave prospective patients wondering whether the practice saw the complaint. A short public acknowledgement followed by a private invitation often works better.
There are situations where a public reply is appropriate:
There are also situations where the public conversation should stop quickly. If the reviewer starts discussing symptoms, treatment, medication or clinical events, do not follow them into those details.
For example, a physiotherapy practice might receive: “After my second appointment for my back problem, I was told…”
The practice should not respond by confirming what happened at the second appointment.
A better reply is: “Thank you for sharing your concerns. We cannot discuss individual patient circumstances publicly, but our team would be happy to discuss this with you privately.”
Then actually provide a route for contact. That last part is often missed. If the review raises a genuine complaint, the practice should also have a proper complaints process behind the public response. NHS England says patients have the right to complain about NHS care, treatment or service, and encourages concerns to be raised with the provider so they can be addressed.
For NHS services, public review management should never replace the formal complaints process. A Google reply is reputation management. A complaint investigation is something else.
There is a common defensive response: “Due to GDPR, we cannot comment.” Technically cautious. Practically poor. It can sound as though the practice is hiding behind data protection law. The problem is not that GDPR prevents a practice from saying anything. The problem is that the practice must avoid disclosing personal information without a lawful basis and appropriate conditions. The ICO explains that organisations must consider lawfulness before sharing personal data.
So give the reader something useful without discussing the patient's case.
Try: “We take concerns about patient experience seriously. Because we must protect patient confidentiality, we cannot discuss individual circumstances publicly. Please contact our practice manager directly so we can review your concerns through the appropriate process.” That sounds like a healthcare organisation behaving responsibly, rather than a business refusing to engage.
Not every unfair review should be reported. This is where practices often waste time. A review saying “The reception team were rude” may be unpleasant, but that does not automatically make it removable. Google says businesses should not report reviews simply because they disagree with them or dislike them. Reviews are generally eligible for removal only when they violate Google's policies. That distinction is important. A review can be:
Negative but legitimate
“I found the waiting time frustrating and the receptionist was dismissive.”
The practice may disagree. That does not necessarily make it a policy violation.
Potentially fake
“I have never been to this clinic, but the doctor treated me badly.”
This may warrant investigation and reporting through the platform's procedures.
Potentially abusive or threatening
“Everyone working here deserves…”
The precise wording matters, but content that crosses platform policy boundaries can be reported.
Potentially defamatory
This is more complicated.
A defamatory allegation is not simply an opinion the practice dislikes. UK defamation law has specific requirements, including the serious-harm threshold under the Defamation Act 2013. A practice should not casually label a review “defamation” because it contains an unpleasant allegation. If a review makes a serious factual allegation that could materially damage an individual clinician or the organisation, get appropriate legal advice before sending threats to the reviewer or platform. Do not turn a review dispute into a second reputational problem.
Google's current guidance allows businesses to report reviews that violate its policies, but it specifically warns against treating the reporting process as a way to remove ordinary negative feedback. A sensible escalation path is:
Check the facts internally → preserve the review → identify the specific policy or legal issue → report through the platform → escalate to legal advisers where appropriate.
Keep screenshots and records of what was published, particularly if the review changes or disappears. And do not ask staff to create positive reviews to bury a negative one. Google prohibits incentivised reviews and other forms of fake engagement. It can also impose restrictions on Business Profiles when it identifies policy violations.
The worst time to decide who can respond to reviews is five minutes after a one-star rating appears. Create a simple internal rule. One person or role should own the public response. A second person should handle escalation when the review involves clinical care, confidentiality, safeguarding, serious allegations or a formal complaint. For a GP surgery, that might mean the practice manager handles ordinary service reviews while clinical or confidentiality concerns are escalated internally. For a private clinic, the same principle can sit with the operations or patient experience team, with clinical leadership involved where the substance of the complaint requires it.
The response process should also distinguish between:
| Review type | Public response | Internal action |
|---|---|---|
| Waiting time | Brief acknowledgement | Check operational issue |
| Reception experience | Acknowledge and invite contact | Review service issue |
| Clinical complaint | Keep response general | Escalate through complaints process |
| Patient-specific treatment allegation | Do not confirm details | Review privately |
| Suspected fake review | Minimal response or none | Preserve evidence and report |
| Threatening or abusive content | Avoid argument | Platform/legal escalation if appropriate |
That small decision tree can save a lot of bad replies.
If your team needs something easy to remember, use:
Acknowledge → Protect privacy → Offer a route forward.
For example: “Thank you for sharing your concerns. We are sorry that you were unhappy with your experience. We cannot discuss individual patient circumstances publicly, but we would welcome the opportunity to discuss this privately. Please contact the practice team directly.”
Then stop. Do not add a paragraph defending the clinician. Do not quote the patient record. Do not hint that the patient is exaggerating. Do not try to persuade the public that the reviewer is wrong. The audience for your response is not only the reviewer. It is also every future patient reading the exchange. That is why calm, restrained replies usually serve a healthcare brand better than aggressive rebuttals.
There is another side to this that gets less attention. The review itself may contain personal information. Your internal handling of screenshots, usernames, correspondence and patient records should therefore be considered separately from what you publish publicly. Health information is special category data under the UK GDPR, and the ICO says organisations need to establish the relevant Article 6 lawful basis as well as an Article 9 condition when processing special category data.
That does not mean a practice should panic every time someone mentions a diagnosis in a review. It does mean your staff should understand that copying a review into internal systems, attaching it to a patient record, sharing it by email or using it in a staff discussion can raise different data protection questions. Keep access limited. Use your established information governance procedures. And if a situation is unusually sensitive, involve your data protection lead or DPO rather than improvising.
Yes. A practice can respond, but the reply should not reveal confidential patient information or confirm details from the patient's healthcare record. A short acknowledgement and invitation to continue the discussion privately is usually safer than a detailed defence.
Not automatically. A patient's public statement does not give a healthcare provider a blanket permission to disclose information held by the provider. Health information has special category protection under the UK GDPR.
It can, but that wording is usually too blunt. A better response explains that patient confidentiality prevents discussion of individual circumstances publicly and then gives the patient a private route to raise the issue.
Yes, if the review appears to violate Google's policies. A practice should not report a review simply because it is negative or unfair. Google specifically distinguishes ordinary negative feedback from content that breaches its policies.
Be careful. Publicly confirming information about whether someone has a relationship with the practice can itself create privacy concerns. If a review appears fake, it is generally safer to preserve the evidence and use the platform's reporting process rather than publicly investigating the reviewer.
The public response should remain general and protect confidentiality. The underlying concern should then be routed through the practice's formal complaints or clinical governance process. For NHS services, patients have established routes for raising concerns about care and treatment.
A negative review creates pressure to explain. Resist it. Healthcare providers have information that ordinary businesses do not. That information can make a public defence look convincing while quietly creating a confidentiality problem. A better system separates the two jobs. The public reply protects trust and shows that concerns are taken seriously. The private process investigates what actually happened.
Set that boundary before the next review arrives. Train whoever manages your profiles to use it consistently, and make sure serious complaints go through the proper internal route rather than being fought out in the Google comments. That is how you protect both patient confidentiality and the reputation you are trying to build.
Get a live 1-on-1 walkthrough tailored to your clinic’s workflow and see how easily you can automate review requests, monitor your reputation, and reply with AI.
