Med Spa Testimonials and Reviews: Separate Patient Permission from Review Integrity

Before using a patient testimonial in med spa marketing, review permission, truthfulness and the rules of the publication channel separately. A review already visible online is not automatic authorization to reuse a patient's name, image or treatment details in an ad. Permission also does not make misleading claims acceptable.

Boost Medspa Marketing provides this as an operational checklist, not legal advice or a compliance certification. HIPAA applicability depends on the organization and the information involved; other laws and platform rules may apply even when HIPAA does not.

Distinguish public feedback from advertising reuse

A person's public review and the practice's later use of it are different actions. Evaluate what the practice would publish, where it would appear and whether it identifies a patient or reveals treatment information.

Copying a review into an ad, filming a testimonial or sharing a patient photograph should trigger a publication review. Do not assume that removing a surname makes all information anonymous. Images, dates and context may still identify a person.

Determine the practice's actual privacy obligations

For covered entities, HHS states that marketing uses or disclosures of protected health information generally require written authorization, with limited exceptions. Whether a particular med spa is a covered entity needs assessment rather than a blanket assumption.

HHS has documented an enforcement matter involving identifiable patient testimonials published without valid authorizations. That example demonstrates why an ordinary publicity request is not always sufficient. Have qualified counsel or a privacy professional review the practice's authorization process and intended use.

If HIPAA does not apply, still assess applicable privacy, publicity and consumer-protection requirements. A platform's permission to display an ad is not legal approval.

Record what was authorized

A practical publication process keeps a record of the person granting permission, the content approved and the intended channels. The exact authorization requirements should be determined for the practice by qualified advice.

Separate participation in care from agreeing to appear in marketing. Staff should know where to store authorization records and who can approve publication. Review requests to change or withdraw permission through the actual applicable process rather than improvising in a marketing chat.

Do not use a generic website checkbox as a substitute for a legally reviewed authorization when a more specific process is required.

Check that the testimonial is truthful and representative

Testimonials must not fabricate experiences or turn an individual's statement into an unsupported promise for everyone. Review the surrounding headline, imagery and offer as well as the quoted words.

Do not create fake patient reviews or imply that a paid spokesperson is an ordinary patient without appropriate disclosure. Editing for length should not change the meaning. A disclaimer such as “results may vary” does not automatically cure an otherwise misleading impression.

The FTC's consumer review and testimonial rules address deceptive conduct including fake reviews and certain conditioned incentives. Google reviews have their own stricter restrictions on incentives, so do not treat legal and platform rules as interchangeable.

Respond to reviews without disclosing care

A public complaint does not authorize the practice to reveal treatment history in its response. Keep replies professional and move sensitive discussions to an appropriate private channel.

Do not confirm a patient relationship or add clinical details merely to defend the practice. Use a reviewed response process and seek privacy advice when the situation is unclear. Our local-search audit guide covers review practices as part of profile maintenance.

Review the destination and ad channel

Website publication, paid ads and social posts can have different requirements. A testimonial approved for one use should not be treated as automatically ready for every other channel.

Before publishing, check platform policies, clinical claims, authorization and disclosure needs. Review the landing page as well as the ad. Maintain a correction process for expired offers, inaccurate captions or changed permissions.

Explore Boost Medspa Marketing's services, facial marketing, the ROI service and budget guide, or contact us about marketing priorities. Legal and privacy questions should also go to an appropriately qualified adviser.

Sources

See HHS marketing guidance, the HHS testimonial enforcement example, FTC review and testimonial rule Q&A and Google Maps contribution policy. This checklist does not determine legal compliance.