Google reviews for UK dental practices: what the GDC actually allows

Ask a room of UK dentists whether they invite patients to leave Google reviews and someone will say it with complete confidence: "we're not allowed to ask." I hear it all the time in our work with dental practices, usually attributed to the GDC. No such rule exists. Nothing in the GDC's standards or its advertising guidance prohibits asking a patient for an honest review. What the rules actually govern is how you ask, what you must never offer in return, and what you may say when you reply. Meanwhile, the practice down the road with 400 reviews quietly absorbs the new patients.

This guide sets out what the documents say, with each source named, and ends with a workflow any practice can run from the front desk. One caveat first: I am not a solicitor and this is not legal advice, just the working position we apply with our own clients.

Why reviews decide which practice gets chosen

Almost every new private patient now starts in the same place: a phone, a search like "dentist near me", and a map showing three local practices. The star rating and review count are the first things a stranger can compare, long before any website loads. Google is open about the mechanics: its own guidance on improving local ranking says that more reviews and positive ratings can help a business's local ranking.

Patient behaviour has moved the same way. 80% of patients want to book any time from their phone (Experian Health, 2025), and the same phone is where they weigh you against the practice two streets over. Recent, specific reviews with warm replies read like evidence. A thin profile, or a three-year-old complaint sitting unanswered, reads like evidence too.

And there is a newer reader in the room. When someone asks ChatGPT or another assistant to recommend a dentist nearby, the answer is assembled from public sources, and review content is a large part of what gets read. Few practices have thought about this channel; it is the heart of our AI visibility work, and reviews feed it directly.

What the GDC actually says

The governing document is the GDC's Standards for the Dental Team. Standard 1.3.3 says you must make sure that any advertising, promotional material or other information you produce is "accurate and not misleading", and that it complies with the GDC's guidance on ethical advertising. That guidance, in turn, expects information about dental services to be "legal, decent, honest and truthful", warns against claims likely to create unjustified expectations, and notes that misleading advertising can lead to a fitness to practise investigation.

Read both documents end to end, as I have, and you will not find a sentence prohibiting a practice from inviting reviews. The myth survives, I suspect, because the guidance is strict about misleading material and cautious professionals round "be careful" up to "don't". The accurate summary is shorter: you may ask; you may not mislead.

So an honest review from a real patient, invited politely, is not the compliance risk. The risks live elsewhere. A manufactured picture of the practice, whether through fake reviews or careful filtering, collides with 1.3.3. And confidentiality governs what happens when you respond: standard 4.2.3, echoed in the GDC's guidance on using social media, says you must not post any information or comments about patients on social networking or blogging sites. A reply to a Google review is exactly that kind of public post.

The five rules that keep an ask compliant

Put the GDC's honesty duties next to Google's review policies and UK messaging law and the whole picture reduces to five rules. They are the same rules our Review Engine is built around, and they apply whether software or your Saturday receptionist does the work.

1. Ask at the right moment

The right moment is shortly after a completed appointment, while the visit is fresh, not weeks later and not part-way through a treatment plan discussion. One detail from Google's own policy that surprises people: businesses should not pressure customers into leaving reviews while they are on the premises. So the tablet passed across the reception desk is out; a short message that arrives once the patient is home is better on every count.

2. No gating

Review gating is the "how was your visit?" survey that routes happy patients to Google and unhappy ones to a private form. Plenty of reputation tools still sell it. Google's review policies prohibit it directly: businesses must not discourage or prohibit negative reviews, or selectively solicit positive ones. It is also hard to square with the GDC's honesty standard, because a filtered five-star wall is a curated picture presented as a natural one. The compliant alternative is simple: ask everyone the same way, and let the rating land where it lands.

3. No incentives

Google prohibits offering payment, discounts, or free goods and services in exchange for reviews. That includes the prize draw and the whitening discount for anyone who posts. Incentivised reviews are bought praise wearing a disguise, the misleading impression the GDC's advertising guidance exists to prevent. The ask has to stay free. Staff and family reviews fail for a related reason: Google treats reviewing your own workplace as a conflict of interest.

4. Make it one tap, and make the message lawful

The fewer the steps, the more the reviews: a direct review link by text or email beats "find us on Google" every time. The message itself sits under PECR, the UK's electronic messaging rules, so the safe assumption is to treat a review request as marketing. For your own patients that is workable: PECR's soft opt-in generally covers messages to people whose details you collected in the course of a sale or negotiations for one, about your own similar services, provided they had a chance to opt out when their details were collected and in every message since. Anyone who opts out comes off the list the same day, permanently. The same logic governs recall and reactivation messaging, which I unpacked in the patient reactivation playbook.

5. Reply as if the whole town is reading

Because it is. Every reply is public, permanent and attached to your practice's name, and the person most influenced by it is not the reviewer but the hundreds of prospective patients who read it later.

How to reply to a negative review without breaching confidentiality

The instinct when an unfair review lands is to set the record straight: the missed appointments, the fee that was quoted twice, the clinical reality. Doing that in public is how a bad week becomes a regulatory problem. Under UK GDPR and the GDC's confidentiality duties, information about a patient is not yours to publish, and that includes the fact that someone is a patient at all. The defence organisations are unambiguous here: MDDUS, for one, advises keeping responses succinct and giving no specific detail about the person commenting, including "even confirming that they attend the practice". A patient who posts about their own treatment has waived nothing on your side; your duties stay exactly as they were.

The reply pattern that works has four moves: thank, state your standards, move it offline, sign it. In practice it reads something like: "Thank you for taking the time to leave feedback. We aim for a high standard of care for everyone we see, and confidentiality means we cannot discuss any individual's visit here, but we would like to understand what happened. Please call the practice and ask for me directly. - Sarah, practice manager." Nothing is confirmed, nothing clinical is discussed, and every future reader sees a practice that responds to criticism calmly. Handled this way, one considered reply under a harsh review often does more for trust than another five-star rating.

Two edge cases. If a review is fake or defamatory, do not fight it in the replies: flag it through your Business Profile, and involve your defence organisation if it is serious. And keep the same discipline on positive reviews: "so glad the implant went well, Mrs Patel" is a confidentiality breach with a smile on it. Thank people warmly and generically. These are the same habits behind good data handling generally, which I covered in the piece on GDPR and AI receptionists.

A compliant workflow you can run manually

None of this needs software. Here is the manual version, as I would run it:

• Pick one trigger. The end of a completed appointment is the cleanest. Everyone whose visit is finished gets the same ask, which is what keeps you clear of selective solicitation.
• Send one short message that evening. Named practice, a thank you, one direct review link, an opt-out line. Something like: "Thanks for visiting Croft Dental today. If you have a moment, a Google review helps other patients find us: [link]. Reply STOP to opt out of messages like this."
• Honour opt-outs the same day. A STOP comes off the list immediately and permanently, on a suppression list that survives staff changes and system migrations.
• Reply to every review within a few days. Warm and generic for the positives, the four-move pattern for the negatives, never confirming anyone's patient status in either direction.
• Log it as feedback, not just marketing. For CQC-registered practices in England, regulation 17 on good governance requires providers to seek and act on feedback for the purpose of evaluating and improving the service. Reviews you gather, discuss at practice meetings and visibly act on are exactly that evidence, and inspectors do ask how feedback is collected and used.
• Never touch the dark arts. No bought reviews, no staff accounts, no gating, no incentives. The downside goes beyond removal by Google: it can mean explaining a misleading marketing operation to your regulator.

The difficulty is not any single step; it is doing them every clinic day without fail. In my experience the manual version runs well for a fortnight and then dies the first week the practice gets busy. I wrote about that pattern of quiet leakage in how private clinics lose patients between enquiry and booking.

Where the Review Engine fits

Our Review Engine exists to run exactly the compliant version described above, every day, without relying on anyone remembering. Patients are asked at the right moment after their visit, everyone gets the same ask with no gating and no incentives, the link is one tap, opt-outs are honoured automatically and permanently, and nothing goes out whose wording you have not approved. There is no trick in it; it simply never gets busy and never forgets.

It also does not stand alone. Reviews raise your visibility on the map and shape what AI assistants say when asked to recommend a practice, and a strong profile is the page an ad click or a referral checks before booking, so it sits alongside our lead generation work. The enquiries reviews produce still have to be answered quickly to become bookings: enquiries answered within the first minute convert up to 391% better (Velocify, from an analysis of roughly 3.5 million leads). If you want to see how the Review Engine is priced, current prices are on the pricing page.

The practices pulling ahead on Google are not gaming anything. They ask politely, at the right moment, every time; they reply with care and confirm nothing; and they treat what comes back as feedback worth acting on. Every part of that is open to any UK practice from Monday morning, and nothing in the GDC's rules stands in the way.