Reviews for wellness clinics, minus the privacy risk

Summer is busy for the clinics we work with. Weekend sports and yard work fill the chiropractic and physical therapy schedules, and the massage and wellness practices pick up everyone who promised themselves they would finally deal with their back. More visits should mean more reviews. Instead, the question we keep hearing from clinic owners this month is whether they are allowed to ask at all, and what on earth they are supposed to write back.

They are right to be careful. A clinic’s review section sits in public, next to the address, and anything the clinic posts there is the clinic talking about a patient. Here is how we handle it.

First, a word on the rules

Wellness is a mixed group. A physical therapy practice that bills insurance electronically is very likely a covered entity under HIPAA. A cash-only massage studio may not be. A medical weight loss clinic, an acupuncturist and a counseling practice all sit somewhere different again, and many states have their own health privacy laws and licensing boards with their own views on testimonials.

We are not lawyers, and nothing here is legal advice. If you do not know which rules apply to your clinic, ask an attorney who works with healthcare practices in your state. In the meantime, the safe default is simple: treat every patient relationship as confidential, because that is what the patient assumes. It costs nothing, and it removes most of the risk before anyone has to interpret a statute.

Asking without giving anything away

Most owners worry about the reply. Fewer notice that the request itself can disclose something.

A text whose preview reads “Thanks for your visit to the weight loss program” tells anyone who glances at a shared phone or a lock screen something the patient did not choose to share. The same goes for an email subject line naming a service. So the ask gets built with that in mind:

• Get consent to text at intake, in writing, and record it on the contact in your CRM. Texting has its own consent rules, separate from health privacy, and a signed intake line covers both conversations.
• Keep the preview neutral. The clinic’s short name and “we would love your feedback.” No service, no condition, no provider name.
• Ask about the clinic, not the condition. “How was booking, the front desk and the way things were explained?” invites a review about the experience rather than a medical history.
• Ask everyone the same way. Google does not allow sending the link only to patients you expect to be happy, and it does not allow rewards for reviews either.
• Leave some services out of the automation. For counseling, addiction care, sexual health or anything a patient might reasonably keep private from their own family, we turn off the automatic request and use a small card at checkout instead. The patient decides whether to take it.

Replying without confirming anyone is a patient

Here is the part that trips people up. A patient can say whatever they like about their own care. The clinic cannot repeat it, confirm it or add to it, even when the review is glowing and the details came from the patient.

That means a reply never mentions the treatment, the visit date, the therapist who saw them, the number of sessions, a balance or an insurance claim. It does not say “we are glad your knee is better,” because that confirms a knee and a patient. Replies should be about the clinic, written so they would read the same under any review.

For a positive review:

Thank you for taking the time to write this. Notes like yours go straight to the whole team, and they mean a lot.

For a complaint:

We take every comment about our clinic seriously and want to hear more. Our office manager can be reached through the contact details on our website, and will follow up personally.

That second one feels thin to an owner who knows the full story and wants to correct the record. That instinct is exactly the one to resist. Anyone reading a calm, generic reply under an angry review sees a professional clinic. Anyone reading a detailed rebuttal sees a clinic that discusses its patients in public.

A few more habits that keep replies safe:

• One named person replies, from written templates, and anything unusual gets a second read from the owner before it is posted.
• If someone drafts replies with an AI writing tool, nothing from the chart, the schedule or the billing system goes into it. The tool only ever sees the public review.
• A review that breaks Google’s policies, such as spam or a review of the wrong business, can be flagged for removal. A patient describing their own visit, however unfairly, is usually not a policy violation, so plan to answer it rather than hoping it disappears.

Building the ask into the visit

A review habit that depends on someone remembering will stop within a month. It has to be part of how the visit ends.

1. Pick the moment by specialty. For physical therapy and chiropractic, ask at a milestone: the end of a care plan, a re-evaluation that shows progress, or discharge. For one-off services like massage, ask at checkout.
2. The practitioner mentions it once, in person. Something like: “If you have a minute this week, a review about how we run things helps other people find us.”
3. The text follows within a couple of hours from the clinic’s own system, with the direct review link from your Google Business Profile.
4. Tag the contact as requested so nobody is asked twice, and keep a do-not-request tag for the services you have taken out of the automation.
5. Book the replies into the week. Two fixed slots, one owner, every review answered within a few business days.

One more housekeeping item for July. Google is switching off chat on Business Profiles at the end of this month. If patients have been messaging you there, point them to your phone number and online booking in your profile description and posts now, so those conversations move somewhere you control and can keep private.

What to do this month

• Read every reply your clinic has posted and edit any that confirm a visit, a treatment, a provider or a bill.
• Write your two reply templates, one for praise and one for complaints, and give one person the job of posting them.
• Rewrite the review request so the preview names only the clinic and never the service.
• Add a texting consent line to the intake form and a do-not-request tag for sensitive services.
• Choose the milestone visit for each service line and put the in-person mention into the practitioners’ routine.
• Move anyone who used profile chat to your phone and booking link before July 31.

None of this slows down a clinic once it is written down and assigned. The careful version of reviews and reputation work is the only version we run for clinics, and it sits alongside the profile, website and booking setup that make up our work with wellness practices.