Patient testimonials for dental practices: the UK rules

Patient testimonials for dental practices are statements from real patients about their experience, used in your marketing: quotes on your website, video stories, case write-ups, or reviews shown on a treatment page. They work because prospective patients trust other patients more than they trust the practice. In the UK they are also governed by three sets of rules at once: the CAP Code on advertising, the GDC's standards on confidentiality, and UK GDPR. This guide sets out what each requires and how to collect and use testimonials safely.

What is a patient testimonial?

A patient testimonial is a patient's account of their experience, published by the practice to encourage others to choose it. That is the difference from a review. A review is posted by the patient on a platform such as Google. A testimonial is something you select and publish in your own marketing, which makes you responsible for it in the same way you are responsible for any advert.

Patient stories, case studies and video testimonials are all forms of testimonial. So is a Google review once you copy it onto your website or into an ad.

The advertising rules: CAP Code

The CAP Code's rules on endorsements and testimonials apply to testimonials in your marketing, including on your own website. The rules most relevant to a practice:

Rule 3.7 also applies. Before publishing, you must hold documentary evidence to prove objective claims. A testimonial does not turn an unproven claim into a proven one. If a patient says their aligners "worked in half the time", you cannot publish that unless you could substantiate it yourself. The ASA has specifically warned dental advertisers about claims that braces are "faster" or "less painful" without robust evidence.

The cherry-picking problem

Rule 3.46 deserves attention because it catches the most common practice website: a testimonials page of glowing quotes. The rule says publishing consumer reviews in a misleading way includes failing to publish negative reviews while publishing positive ones, and giving positive reviews greater prominence. If you show reviews on your site, the safest approach is to present them honestly: show your overall rating and count, link to your full Google profile, and avoid implying a hand-picked selection is the whole picture.

The professional rules: GDC confidentiality

The CAP Code treats testimonials as advertising. The GDC treats them as patient information, which is stricter.

• Confidentiality is the default. The GDC's standards say "you must keep patient information confidential". A testimonial reveals that a named person is your patient and what treatment they had.
• Explicit consent is required to identify a patient. The GDC's guidance on using social media says you must not publish any information which could identify patients without their explicit consent.
• Consent must be specific. The same guidance says that when obtaining consent you should tell the patient how exactly the information will be used, for what purpose and where it will be available.
• No unjustified expectations. The GDC's guidance on advertising rules out statements likely to create an unjustified expectation about results. A testimonial that implies every patient will get the same outcome can do exactly that.

The data protection rules: UK GDPR

A testimonial naming a patient and their treatment is personal data, and information about treatment is health data. Data concerning health is special category data under UK GDPR, so if you rely on consent it needs to meet the higher, explicit standard.

The ICO says valid consent must be freely given, specific, informed and unambiguous, that explicit consent needs a clear statement rather than being inferred, that you must keep records showing consent was given, and that people must be able to withdraw it easily at any time.

In practice that means:

• Separate consent, not a line buried in your registration form or terms.
• Specific to the use: website, social media, printed material, video. Ask for each.
• Freely given: the patient's care must not depend on it, and it should not be asked for at a vulnerable moment, such as in the chair mid-treatment.
• Recorded: keep the signed form or written confirmation with the testimonial.
• Withdrawable: if a patient changes their mind, remove the testimonial promptly from everywhere you control.

How to collect patient testimonials properly

1. Ask at the right time. After treatment is complete and the patient has said they are pleased, not during treatment.
2. Ask open questions. "What was it like?" rather than "Was it painless?". Leading questions produce testimonials that contain claims you cannot support.
3. Use their words. Correct spelling if they ask you to, but do not rewrite meaning. If you shorten a quote, do not change what it says.
4. Get written consent covering how, where and for how long it will be used, and whether the patient's name, photo or treatment will be shown.
5. Check the claims. Remove or decline any testimonial containing a claim you could not substantiate.
6. File the evidence: the original words, the consent form, the date and the patient's contact details, as rule 3.47 requires.
7. Review annually. Old testimonials for treatments you no longer offer, or by clinicians who have left, should come down.

Patient testimonial template

A simple format keeps testimonials consistent and compliant. Each published testimonial should carry:

• The patient's words, unaltered in meaning
• How they wish to be identified, for example first name only, or initials
• The treatment, only if they agreed to it being named
• The month and year, so readers know it is current

Behind it, in your records: the signed consent form listing each place it may appear, the original submission, and contact details.

Patient testimonials examples: formats and their risks

Can you use Google reviews as testimonials?

CAP rule 3.50 normally allows an exception to the permission requirement for accurate statements from published sources, and a public Google review is published. For a dental practice, though, the GDC's confidentiality standards point to caution: republishing a review in your own marketing is the practice choosing to publicise that a named person was its patient. The safer course is to ask the reviewer's permission before using their review in ads or on your website, or to show reviews through a widget that displays your rating and recent reviews as they are, rather than a hand-picked set.

The better long-term answer is to make your Google profile itself convincing. Our guide to working out a review target explains how many reviews practices in your kind of town tend to have.

Testimonials on social media

Everything above applies on Facebook, Instagram and TikTok, with one extra point. The GDC's social media guidance reminds professionals that anything posted is instantly public, can be copied and redistributed, and should be presumed permanent even after deletion. So when a patient withdraws consent, you can remove your post but not every copy. Make sure the patient understands that before they agree. Our guide to social media marketing for dentists covers the wider rules.

Common testimonial mistakes

• Writing testimonials for patients, or "tidying up" their words until they say something new.
• Using a patient's photo or full name with only verbal agreement.
• Publishing claims you could not prove, such as "pain-free" or "results in days".
• Offering a discount or gift in return for a testimonial.
• Showing only five-star quotes while implying they represent all feedback.
• Leaving testimonials up after consent is withdrawn, or after the clinician named has left the practice.
• Replying to a review in a way that confirms treatment details. That is a confidentiality issue in its own right, covered in how to reply to Google reviews.

Handled properly, testimonials are worth the effort. A few genuine, consented, carefully placed patient voices on the pages where people make decisions will do more than a wall of anonymous praise, and they will stand up if anyone ever asks where they came from.