Healthcare marketing compliance in the UK: a working reference for private clinics

This page is not legal advice; confirm specifics with your regulator or adviser. Last updated 1 November 2026.

Marketing a private clinic in the UK means answering to several bodies at once. The ASA enforces the CAP Code on every ad and every claim on your own website. The MHRA and the law ban advertising prescription-only medicines to the public. Your professional regulator (GMC, GDC, HCPC, NMC or GPhC) holds you personally responsible for what is published in your name. Your system regulator (CQC, Healthcare Improvement Scotland or Healthcare Inspectorate Wales) sets rules on registration and ratings. The ICO governs the patient data your forms, cookies and pixels collect. Google adds its own ad policies on top.

For each area below: what the rule covers, mistakes seen in published rulings and guidance, and a short checklist. Each section links to the official source, so check the current wording before you rely on any summary, including this one.

Who regulates what: a quick map

ASA and the CAP Code: health and beauty claims

What it covers. The CAP Code applies to non-broadcast ads, which includes paid search, social posts, emails and the claims you make about your own services on your own website. Two sections matter most for clinics. Section 3 (misleading advertising) requires you to hold documentary evidence for objective claims before you publish them (rule 3.7). Section 12 (medicines, medical devices, health-related products and beauty products) adds health-specific rules: claims need evidence, including trials on people where relevant (12.1); you must not discourage essential treatment for conditions that need medical supervision (12.2); practitioners must hold relevant, recognised qualifications and marketers may be asked for full details of the treatment and who delivers it (12.3); and you must not falsely claim a product treats disease or changes appearance (12.6).

Cosmetic interventions. Rule 12.25 says ads for cosmetic interventions, surgical or non-surgical, must not be targeted at under-18s through the media chosen or the context. The ASA's advice on cosmetic surgery advertising warns against presenting surgery as safe, easy or risk free, against linking surgery with a holiday in a way that trivialises it, and against urgency. It cites a 2022 ruling against a Transform Hospital Group Instagram ad that referred to "Black Friday prices" for breast surgery. The broader cosmetic interventions advice also covers when doctors may call themselves surgeons or cosmetic surgeons, and how terms such as "specialist", "consultant" and "leading" are judged.

Before-and-after images. The same advice says imagery must reflect what patients can generally achieve, and records a 2015 ruling against a hair transplant company that could not show its before-and-after images were representative. In practice: genuine patients, comparable lighting and angle, no retouching that changes the result, written consent, and not only your best case. For prescription-only treatments, CAP advice says before-and-after images are not permitted at all. Our article on before-and-after photos, consent and compliance goes into consent forms and image handling.

"Free" claims. Rules 3.23 to 3.26 in Section 3 say you must not call something free if the patient pays more than the unavoidable cost of responding, you must make clear any commitment needed to get it, and you must not describe part of a package as free when its cost is built into the package price. A "free consultation" that is only free if the patient books treatment on the day, or that is deducted from a treatment price which was raised to absorb it, is the pattern to avoid.

Mistakes that recur in rulings and ASA advice:

• Calling a treatment "safe", "painless" or "risk free".

• Countdown offers and seasonal sales on surgery or invasive procedures.

• "Specialist" or "expert" claims with no recognised basis.

• Success rates and "up to" figures without evidence that matches the claim.

• Social posts or influencer content that reach under-18s for cosmetic procedures.

Checklist

• Every objective claim on the site has a file of evidence behind it, dated before publication.

• No "safe", "guaranteed", "permanent" or "risk free" wording on treatment pages.

• Before-and-after sets are genuine, consented, unretouched and representative.

• Any "free" offer states its conditions next to the offer, not in small print.

• Cosmetic ads exclude under-18 audiences on every platform.

Testimonials and reviews: CAP Code and the DMCC Act

What it covers. CAP rules 3.45 to 3.50 cover testimonials and reviews. You must hold evidence that a testimonial is genuine, together with the person's contact details (3.47); it must relate to the treatment advertised (3.48); factual claims inside it must not mislead (3.49); and you need permission to use it (3.50). Incentivised reviews must be disclosed (3.45) and you must not publish reviews selectively so that negative ones are hidden (3.46). The ASA's testimonials and endorsements advice adds that health professionals and celebrities cannot endorse medicines (rule 12.18), so a doctor's or influencer's endorsement of a medicine is off limits.

Consumer law now sits alongside the Code. The Digital Markets, Competition and Consumers Act 2024 made fake reviews and concealed incentivised reviews a banned practice, and the CMA's fake reviews guidance, published on 4 April 2025, explains what businesses must do. Writing or paying for reviews, or rewarding reviews without saying so, are the obvious risks.

A testimonial is also a claim. If a patient writes "my migraines have gone for good" and you put it on your migraine page, you need the evidence you would need if you had written it yourself. For the practical side of collecting and showing reviews, see patient reviews and testimonials as marketing assets.

Checklist

• Signed or emailed permission is on file for every testimonial, with contact details.

• No reviews written, edited or rewarded by the clinic without clear disclosure.

• Review widgets show your real rating, not a filtered set of five-star posts.

• Testimonials that make clinical claims are treated as your own claims and checked.

MHRA: no advertising prescription-only medicines to the public

What it covers. Prescription-only medicines cannot be advertised to the public. CAP rule 12.12 states it plainly, the law behind it is set out in the MHRA's Blue Guide on advertising and promoting medicines, and the ban covers your website, social media, paid search, price lists and influencer content. It applies whether or not a doctor administers the medicine and whether the use is medical or cosmetic.

Weight-loss injections. The ASA, MHRA and GPhC issued a joint enforcement notice on weight-loss prescription-only medicines, first applying from 11 April 2025 and replaced on 23 September 2025. The MHRA announcement of the update says terms such as "weight-loss injection", "obesity treatment jab" or "GLP-1" can amount to advertising the medicine, as can images people would read as a prescription medicine, and general weight-loss ads that send people to landing pages promoting those medicines. In July 2025 the ASA took action against nine advertisers; the rulings treated "Weight Loss Pen", abbreviated drug names, unbranded injection pens, partial images of branded pens and images of vials as promotion of the medicine.

Botulinum toxin. Botox and other botulinum toxin products are prescription-only medicines. In 2014 the ASA ruled against two clinics, HB Health of Knightsbridge and Dermaskin Clinics, and its summary of those Botox rulings notes that removing the word from the home page did not fix the problem when links still led to Botox content. In 2023 the ASA upheld complaints against Glowery Ltd (Glowday), whose pages promoted Botox to the public and let consumers book it; a consultation step before treatment did not make that acceptable.

What you can do. CAP's current advice on prescription-only medicine says promoting a consultation for a treatment area is likely to be acceptable, for example "a consultation for the treatment of lines and wrinkles", provided the medicine is not referenced directly or indirectly. Your own website can carry balanced, factual information about a medicine, but not on the home page and not in a promotional way. Offers and discounts that could apply to a prescription-only treatment are a risk unless the ad makes clear they do not. If you run a weight-loss service, our page on marketing for weight loss clinics explains how we approach consultation-led campaigns.

Mistakes that recur

• Price lists that include toxin by name or by unit.

• Hashtags, hover text or captions that name the medicine.

• Offers that bundle fillers with anti-wrinkle treatments without making clear the offer excludes prescription-only medicines.

• Ads for a general weight service that link to a page selling a named injection.

• Recruiting "models" for toxin treatments on social media.

Checklist

• No prescription-only medicine named, abbreviated, pictured or implied in any ad, post or price list.

• Ads promote the consultation and the condition, and their landing pages do the same.

• Factual medicine information sits on inner pages and matches the licensed use.

• Affiliates and influencers are briefed in writing and their content is checked.

GMC: doctors, advertising and cosmetic interventions

What it covers. Good medical practice applies to doctors, physician associates and anaesthesia associates. Its Trust and professionalism domain expects honesty in everything you communicate, including information about you and your services, and you remain responsible for material published in your name even when an agency or clinic writes it. The GMC's separate guidance for doctors who offer cosmetic interventions includes a section on marketing responsibly: marketing must not minimise or trivialise risk, must not exploit vulnerability, must not use promotional tactics that could push people into an ill-considered decision, must say if a medical assessment is needed before treatment, and must not target children and young people.

Mistakes we see described in guidance

• Group-buy vouchers, loyalty schemes and "book today" discounts on cosmetic procedures.

• Biographies that overstate roles, titles or qualifications.

• Content that implies a procedure is suitable for everyone before any assessment.

Checklist

• Every doctor biography states GMC number, qualifications and current roles accurately.

• Cosmetic pages explain that an assessment comes first and that not everyone will be suitable.

• No time-limited or volume deals on cosmetic interventions.

• The doctor has read and approved the final copy, not only the draft.

Our guide on whether doctors can advertise in the UK covers the wider question for consultants starting out.

GDC: dental advertising

What it covers. Standard 1.3.3 of the GDC's Standards for the Dental Team requires advertising to be accurate, not misleading and in line with the GDC's guidance on advertising. That guidance is unusually specific. A practice website should show the practice name and address, contact details, the GDC's address or a link to its website, the complaints procedure (the NHS body for NHS care, the Dental Complaints Service for private care) and the date the site was last updated. Any website naming a dental professional should show their qualification, the country it was obtained in, and their GDC number. Ads must say whether the practice is NHS, mixed or wholly private.

Titles cause the most trouble. Only dentists on a GDC specialist list may call themselves specialists or use titles such as Orthodontist or Endodontist. Others can say "special interest in", "experienced in" or "practice limited to". Dental care professionals have no specialist lists, so titles like "smile specialist" are out. The guidance also says websites should not compare the skills or qualifications of one dental professional with others, and should not list memberships or honorary degrees in abbreviated form.

Checklist

• Each clinician profile shows qualification, country of qualification and GDC number.

• Footer carries the GDC link, complaints route and last-updated date.

• "Specialist" appears only next to clinicians on a specialist list.

• NHS, mixed or private status is clear on the site and in ads.

See marketing for dental clinics for how we build compliant practice sites.

HCPC, NMC and GPhC registrants

Physiotherapists, practitioner psychologists, dietitians, podiatrists and other HCPC registrants must follow the HCPC standards of conduct, performance and ethics; standard 9.3 says you must take reasonable steps to make sure any promotional activity you are involved in is accurate and not likely to mislead. Nurses, midwives and nursing associates follow the NMC Code, where standard 21.4 requires that advertisements and published material for your services are accurate, responsible and ethical, do not mislead or exploit vulnerabilities, and accurately reflect your skills, experience and qualifications. Nurse prescribers in aesthetics are also bound by the prescription-only medicine rules above, and pharmacies by the GPhC, which co-signed the weight-loss enforcement notice.

Checklist

• Registration numbers and protected titles are shown correctly for every practitioner.

• Claims about outcomes match the evidence for the specific therapy.

• Team pages make clear who is a registered professional and who is not.

Physiotherapy and rehabilitation clinics can read more on marketing for physiotherapy and rehabilitation clinics.

CQC, Healthcare Improvement Scotland and Healthcare Inspectorate Wales

England. If you are registered with the CQC and have been rated, regulation 20A requires you to display your CQC rating on websites where you describe your service, as well as at your premises, within 21 calendar days of publication, and to keep it clear and conspicuous. That applies even if you have asked for a review of the rating. The CQC may act against providers that display false or misleading ratings information. Watch for out-of-date ratings on location pages and wording such as "CQC approved".

Scotland. Independent clinics must register with Healthcare Improvement Scotland, which inspects them and can take enforcement action. Its guidance on choosing a clinic explains what the public can check. Wales. Independent hospitals, clinics, medical agencies and private dental services must register with Healthcare Inspectorate Wales under the Care Standards Act 2000.

Checklist

• The current rating or registration appears on every relevant location page, using the official widget where one is offered.

• Registration claims name the regulator and say what is registered, without "approved" or "endorsed".

• A named person checks the website within 21 days of any new CQC rating.

Our article on CQC compliance in private clinic marketing goes further on wording.

HFEA: fertility clinics

Fertility clinics are licensed by the HFEA, and patients compare clinics using its data, so marketing claims sit against an official reference point. The HFEA rates treatment add-ons using a traffic-light system, from green (high-quality evidence of effectiveness) to red (potential safety concerns or evidence that it may reduce effectiveness), and says add-ons without strong evidence should only be offered in a research setting. Promoting an add-on as improving success without saying how the HFEA rates it, or quoting success rates that do not match the published data, invites complaints under the CAP Code as well as scrutiny from the HFEA. For pricing pages, the HFEA points clinics to the CMA's consumer law guidance. Our page on marketing for fertility clinics covers how we handle success-rate content.

Checklist

• Success rates are sourced, dated and comparable with HFEA data.

• Every add-on page states the HFEA rating and links to it.

• Package prices show what is and is not included, including medicines and add-ons.

ICO: UK GDPR, PECR, cookies and email marketing

Health data in forms. Health data is special category data. The ICO's guidance on conditions for processing special category data confirms you need both an Article 6 lawful basis and an Article 9 condition. The health or social care condition covers providing care, not marketing, so using health information for marketing will usually need explicit consent, given as a clear statement that names the type of data. An enquiry form that asks "what condition are you interested in?" collects health data, so the privacy notice beside it should say why, how long you keep it, and who sees it.

Cookies and tracking pixels. The ICO's guidance on storage and access technologies, last updated in April 2026 to reflect the Data (Use and Access) Act 2025, lists tracking pixels alongside cookies. Advertising pixels generally need consent before they fire. The ICO also notes that information about which health services someone used, or inferences drawn from browsing medical pages, can be special category data. A Meta or Google pixel firing on a "thank you" page for an HIV test booking, or passing the treatment name in the URL, is the scenario to design out.

Email and text marketing. Under PECR's electronic mail rules you need specific consent to send marketing emails or texts to individuals, unless the soft opt-in applies: existing patients who bought or asked about a similar service, offered a simple opt-out at collection and in every message. It does not cover bought-in lists. Sole traders count as individuals. The ICO's direct marketing guidance is the place to start before building a campaign that segments by condition. Our GDPR guide to patient data in marketing goes into consent wording.

Checklist

• No advertising or analytics tags fire before consent, and the banner offers reject as easily as accept.

• Conversion events send no condition, treatment or free-text form data to ad platforms.

• Enquiry forms ask only what triage needs and carry a short privacy notice.

• Marketing lists record when and how each person consented, and opt-outs are honoured.

Google Ads: healthcare and medicines policy

Google's healthcare and medicines policy sits on top of UK law. In the UK, online pharmacies and telemedicine providers cannot promote prescription drugs in ads or on landing pages; online pharmacies need GPhC registration and Google certification, and telemedicine providers need LegitScript and Google certification. Unapproved substances and speculative or experimental treatments cannot be promoted. Separately, Google's restricted targeting in personalised advertising policy lists health as a sensitive category, so you cannot use Customer Match, your own data segments or lookalikes built from them for health ads. Our healthcare Google Ads management service handles certification and policy reviews, and our article on Google Ads compliance for UK clinics lists common disapproval reasons.

Checklist

• Certification is in place before any pharmacy or telemedicine campaign runs.

• Keywords, ad text and landing pages are all free of prescription medicine names.

• No patient list uploads or remarketing lists built on health pages.

How this fits with your SEO and content

Compliance is not only a matter for ads. The ASA treats claims on your own website as advertising, and search engines reward the same things regulators ask for: named authors, accurate qualifications, sourced claims and balanced information. When we write healthcare SEO content, each treatment page is checked against the rules above before it goes to the clinician for sign-off. Our wider guide to digital marketing for healthcare explains how channels fit together, and specialty pages such as marketing for medical aesthetic clinics, marketing for plastic surgery clinics and marketing for hair transplant clinics cover the rules that bite hardest in each field.

Compliance review is part of the work we quote for, not an extra. To see what drives the cost of a project or retainer, read how we price healthcare marketing.