The AHPRA Trap Hiding in Your Google Review Replies

Key takeaways

• AHPRA’s cosmetic procedure advertising guidelines say a practitioner who likes or otherwise responds to a review that names a clinical outcome can be treated as using that review as a testimonial, in effect since 2 September 2025
• A testimonial breach under section 133 of the Health Practitioner Regulation National Law carries a maximum penalty of $60,000 for an individual and $120,000 for a body corporate
• The clinical aspect test has three triggers: a symptom, a specific diagnosis or treatment, or an outcome, stated directly or by comparison
• Most advertising breaches start with a written notice giving the advertiser 30 days to correct it before matters escalate
• Between September 2022 and March 2025, AHPRA investigated about 360 notifications about non-surgical cosmetic procedures and closed around 300 of them
• Google Business Profile lets an owner edit or delete a posted reply at any time, so a risky reply already live can still be fixed
• A neutral, service-only reply, such as thanking a patient for their time, clears the clinical aspect test every time
• The rule applies the same way to a cosmetic dental practice replying about veneers as it does to a cosmetic clinic replying about injectables

A five-star Google review that says “lovely team, felt looked after the whole time” creates no compliance risk for a cosmetic clinic. Reply to it with “so glad you’re loving your new lips” and the clinic has a problem, even though the original review never mentioned lips at all. AHPRA’s guidelines for advertising higher risk non-surgical cosmetic procedures, in effect since 2 September 2025, treat a practitioner’s own reply as advertising in its own right. If that reply repeats a symptom, a treatment, or an outcome, it can be treated as using a testimonial, and the maximum penalty for a testimonial breach is $120,000 for a clinic. This guide sets out exactly what a compliant reply can and cannot say, a safe reply template you can hand to whoever answers your reviews, and the specific trap where the business’s own words create a breach the patient’s review never did.

What AHPRA’s Guidelines Actually Say About Replies

AHPRA’s Guidelines for advertising higher risk non-surgical cosmetic procedures define a testimonial as a positive statement about the clinical aspects of a regulated health service, used in advertising. A clinical aspect exists if the content names a specific symptom or reason for seeking treatment, a specific diagnosis or treatment, or an outcome, including the practitioner’s skill or experience, stated directly or by comparison.

The guidelines then set out, in plain terms, the ways a practitioner is considered to have used a testimonial. Alongside publishing a testimonial directly, the list includes linking to testimonials on third-party advertising, re-sharing a patient’s story or post, and interacting with a review on a third-party website or social media page, “such as liking or otherwise responding to a patient’s social media post.” The guidelines go further and put an affirmative duty on the practitioner: “health practitioners must take steps to ensure that they do not interact with testimonials.”

That last point is the one most clinic owners miss. It does not say a practitioner must avoid publishing a testimonial. It says a practitioner must avoid interacting with one, and a reply is an interaction.

Takeaway: the reviewer’s words are usually protected speech the clinic does not control. The clinic’s own reply, like, or share is not. It is the clinic’s advertising, tested the same way any other advertising is tested.

The penalty is not a marketing figure. Section 133 of the Health Practitioner Regulation National Law sets a maximum penalty of $60,000 for an individual and $120,000 for a body corporate for advertising that uses a testimonial, current as at April 2026. Some websites quote a lower figure, commonly $30,000 for an individual, for the same offence. That figure is wrong. The legislation itself, not a marketing blog, is the source to check.

Takeaway: a reply that crosses the line is judged against the same penalty scale as any other testimonial breach. There is no separate, lighter rule for something typed in the reply box.

Writing a Reply That Cannot Become the Breach

The fix is not to stop replying to reviews. It is to keep every reply inside a narrow, boring lane: service, gratitude, and time. Never the clinical content the review might have raised.

1. Read the review for a clinical aspect first. Does it name a symptom, a treatment, or an outcome? If yes, treat the review as containing a clinical aspect, whether or not you plan to reply.
2. Keep the reply to service language only. Thanks, time, team, visit, welcome back. Nothing about how the patient looks, feels, or the result they got.
3. Never repeat the review’s words back. If the review says “my lips look amazing,” the reply must not say “lips” or “amazing” or anything that confirms the outcome, even in passing.
4. Do not like, heart, or react to a review that names a clinical aspect. AHPRA’s guidelines list this as its own trigger, separate from replying.
5. Use one written, pre-approved reply template across every staff member with account access. A single approved line removes an entire category of accidental breach caused by one team member replying differently to another.
6. When in doubt, use the shortest possible thank-you and stop. A short, generic reply carries less risk than a warm, specific one.

Two safe templates that clear the clinical aspect test on every review, regardless of what the review itself says:

“Thank you so much for taking the time to leave a review. We really appreciate it, and we hope to see you again soon.”

“Thanks for the kind words. It was a pleasure having you in the clinic, and we’ve passed your feedback on to the team.”

Neither line references a symptom, a treatment, or an outcome. Both work whether the review was about injectables, veneers, or the parking out front.

Takeaway: a safe reply is not a clever one. It is a boring one, used consistently, that never gives the clinical content anywhere to hide.

Reply Phrase Patterns: Compliant or Risky

Takeaway: the risky column shares one habit. It answers the review as if the reply’s job was to confirm the outcome. The compliant column answers as if the reply’s job was to say thank you.

Worked Examples: A Cosmetic Clinic and a Cosmetic Dental Practice

Cosmetic clinic. A patient leaves this review: “Amazing experience, my lip filler looks so natural, I get compliments every day. Highly recommend this clinic.” The review names an outcome, so it already contains a clinical aspect. The natural instinct is to reply “so glad you love your natural-looking lips, thank you for trusting us with your filler,” which repeats the outcome word for word and turns the clinic’s own reply into the testimonial the review only implied. The compliant reply stays on the visit: “Thank you so much for the kind words and for taking the time to leave a review. It was a pleasure having you in the clinic, and we hope to see you again soon.” Nothing in that sentence could be read as a clinical claim, regardless of what the patient wrote.

Cosmetic dental practice. A patient writes: “Best decision I ever made getting veneers here, my smile has completely changed my confidence.” Veneers are named directly in AHPRA’s own resources for advertising higher risk cosmetic procedures, so this review sits squarely inside the clinical aspect test. A reply of “we’re so glad your new smile has boosted your confidence, your veneers look amazing” repeats both the treatment and the outcome in one line. A compliant reply looks the same as the clinic’s: “Thank you for such a lovely review. We really appreciate you taking the time to share your experience with our team, and we’re glad you enjoyed your visit.” The treatment sits in the patient’s words only, never in the practice’s own.

Takeaway: the same two safe templates worked for a clinic replying about filler and a dental practice replying about veneers, because neither template ever touches the clinical content in the first place.

Audit Your Last 10 Review Replies

1. Open your Google Business Profile and filter to reviews you have replied to.
2. Pull the last 10 replies your business has posted, across every staff member with access.
3. For each reply, check whether it contains a symptom, a treatment name, or an outcome word such as “results,” “transformation,” or “amazing” tied to a clinical claim.
4. Check reactions too. Look for likes or hearts on reviews that name a clinical aspect, on Google, Instagram, and Facebook alike.
5. Flag anything that fails. Google Business Profile lets an owner edit or delete a posted reply at any time, so a risky reply already live is fixable, not permanent.
6. Replace flagged replies with one of the two safe templates above, and note which staff member posted them so the pre-approved template reaches everyone with reply access.

Takeaway: 360 notifications investigated and 300 already closed in under three years is not a dormant rule. It is a regulator that works through complaints at a steady pace, and a review reply sits inside the same complaint pathway as any other piece of advertising.

The Enforcement Anchor

There is no published AHPRA case, as at this review, naming a reply’s own wording as the cause of a breach specifically. That is worth saying plainly rather than implying otherwise. What is published and verifiable is the general advertising complaints process that any testimonial breach, including one created by a reply, would follow: AHPRA reviews the advertising, assesses the risk, and in most cases writes to the advertiser requiring the breach to be corrected within 30 days before the matter escalates to registration conditions or, in serious cases, prosecution.

That process does not care whether the offending words came from a patient’s review or a clinic’s reply to one. Section 133 tests the content of the advertising, not who typed it first.

Takeaway: the absence of a named “reply” case is not the same as an absence of exposure. The same complaint pathway that has already produced roughly 360 investigations in under three years applies in full to a reply that repeats a clinical outcome.

Where This Gets Hard

Group and multi-practitioner clinics are the hardest case. Reception staff, practice managers, and individual practitioners often all hold access to the same Google Business Profile, and each brings their own instinct for what a warm reply sounds like. One staff member’s habit of writing “so glad you’re happy with your results” can undo a compliant reply policy every other staff member is following correctly. The fix is procedural, not technical: one written template, one person responsible for reviewing new replies weekly, and a short note in the induction pack for anyone who gets account access.

Genuinely ambiguous reviews are the second hard case. A review that says “the whole experience was amazing, would come back in a heartbeat” is almost certainly about service, not outcome, but a clinic replying “so glad you had an amazing experience” is fine only because the review itself never named a clinical aspect to repeat. The safest posture, when a review sits close to the line, is still the boring reply: thank the patient for their time and stop there.

AHPRA’s guidelines say a reply that interacts with a testimonial can itself be treated as using that testimonial; the build consequence is a fixed, pre-approved reply template that never touches clinical content; whether a specific reply you have already posted crosses that line is a question for your medical defence organisation or your lawyer.

Status

In force since 2 September 2025. AHPRA’s guidelines for advertising higher risk non-surgical cosmetic procedures, including the guidance on interacting with reviews, are current and not a proposal or a pending change. Section 133 of the Health Practitioner Regulation National Law and its $60,000/$120,000 penalty maxima are in force nationally, subject to the version adopted in each state and territory.

Frequently Asked Questions

Can I reply to a Google review at all as a cosmetic clinic?

Yes. Replying is not banned. The risk sits in what the reply itself says. AHPRA’s guidelines treat a reply that repeats a symptom, a treatment, or an outcome back to the reviewer as using that review as a testimonial, so a reply that stays on service and experience clears the test every time.

Does liking or reacting to a review count the same as replying?

Yes. AHPRA’s cosmetic procedure advertising guidelines list interacting with a review, including liking or otherwise responding, alongside replying and re-sharing as ways a practitioner can be treated as using that review as a testimonial.

What is the maximum penalty if a reply breaches the rule?

Up to $60,000 for an individual practitioner and $120,000 for a body corporate, under section 133 of the Health Practitioner Regulation National Law. Some secondary sources circulate lower figures. The legislation itself sets the higher amount.

Can I fix a reply I already posted?

Yes. Google Business Profile lets a business owner edit or delete a posted reply at any time, so a risky reply already live can be corrected without waiting for a complaint to arrive.

Does this apply to cosmetic dental practices as well as cosmetic clinics?

Yes. The testimonial ban sits under the same National Law provision that governs every registered health practitioner, including dentists. A dental practice’s reply about veneers is tested exactly the same way as a clinic’s reply about injectables.

Get in Touch

RockingWeb reviews replies across your Google Business Profile and social accounts against AHPRA’s clinical aspect test, flags anything that repeats a symptom, treatment, or outcome, and reports back on what needs to change.

Get in touch

Sources

1. AHPRA

   • Guidelines for advertising higher risk non-surgical cosmetic procedures, including the sections on testimonials and on interacting with reviews. Checked 11 August 2026.

2. AHPRA

   • Testimonials: Understand the requirements, including the clinical aspect test and third-party review platform responsibilities. Checked 11 August 2026.

3. Queensland Legislation

   • Health Practitioner Regulation National Law Act 2009, Schedule, section 133 (Advertising), current as at 10 April
   2026. The primary source for the $60,000/$120,000 penalty maxima.

4. AHPRA

   • How we manage advertising complaints, including the 30-day correction window. Checked 11 August 2026.

5. AHPRA

   • Cosmetic procedure guideline announcement, including the notification volumes for September 2022 to March 2025. Checked 11 August 2026.

6. Google Business Profile Help

   • Edit or delete a posted reply. Checked 11 August 2026.

Related reading:

• Google Reviews and AHPRA: A Reply Can Cost You $120K: the full clinical aspect test for what counts as a banned testimonial
• $2.9M ACCC Fine: How to Run Compliant Clinic Google Reviews: the rules for collecting and publishing reviews in the first place
• Cosmetic Clinic Websites: compliant website builds for AHPRA-regulated clinics

For a written reply template your whole team can use from day one, see talk to us about your clinic’s marketing.

Last reviewed: 11 August 2026.