A patient wrote in Google that it hurt, that they waited half an hour, that they didn't like the price — and along the way described exactly what the treatment involved. That doesn't release the clinic from medical confidentiality: the duty applies to you regardless of what the reviewer chose to disclose. You can still reply factually, defend your side, and never confirm a single word about how the treatment went.
On this page you'll find a reply formula that works for any complaint, a list of what you never write publicly, and the rule for when to report a review to Google instead of just answering it.
The trap: the patient disclosed details, the clinic still stays silent about treatment
The most common mistake looks like this: a patient writes "the root canal hurt for three days afterwards," and the front desk replies "your treatment followed the standard protocol, pain after a root canal is normal." That looks like a defense, but the clinic has just publicly confirmed that this specific person was a patient and what procedure they had. The fact that the patient disclosed it first doesn't transfer any right to the clinic to confirm anything — confidentiality runs one way and binds the person practicing the medical profession, not the reviewer.
The second trap is silence out of fear of getting it wrong. The next patient reads a missing reply to a negative review just as carefully as the review itself — and concludes the complaint must be true since nobody responded. A factual reply without details is safer than saying nothing. We cover who in a business should even be answering reviews, and on what schedule, in a separate piece on responding to Google reviews — here the focus is the confidentiality wall that most other industries simply don't have.
Medical confidentiality doesn't disappear just because the patient wrote first
Poland's Act on Patient Rights and the Patient Rights Ombudsman grants the patient, in art. 13, the right to keep information related to them confidential, and art. 14(1) obliges people practicing a medical profession to keep patient-related information confidential, in particular about their health condition — the exceptions in section 2 cover situations like the patient's consent or separate statutory provisions, not a public reply to a comment (act text, ISAP). For physicians and dentists there's also art. 40(1) of the Act on the Professions of Physician and Dentist: a physician is obliged to keep confidential any patient-related information obtained in connection with practicing the profession (act text, ISAP).
The mechanism is simple: the duty to stay silent sits with the clinic, not with the patient. A patient can describe their own treatment publicly — it's their information and their choice. The clinic cannot confirm or expand on it, because it isn't the clinic's information to disclose, even when a reply feels like "just a correction." Whether a specific reply in a specific situation crosses that line is something a lawyer or a data protection officer (DPO) should assess, especially once medical records enter the picture.
What this means for the wording of a reply
A safe reply doesn't repeat the patient's words about the procedure, doesn't state visit dates, doesn't explain how the treatment went, and doesn't judge whether the pain was "normal." It sticks to emotion and process: apologize for the impression, invite contact, sign off.
Google's rules: professional, brief, no promotion, no reviewer data
Google's guidance for businesses recommends that replies to reviews be factual, short, and not promotional — and for negative reviews it explicitly warns against exposing the reviewer's private information: never share a reviewer's private information or engage in personal attacks, and for a complex situation politely ask the reviewer to contact you by phone or email (Google's tips for businesses). It works both ways: a constructive, polite reply sometimes prompts a customer to update their review — but that's a side effect, not a reason to break confidentiality.
Offering incentives for posting, changing, or removing a review counts as fake content under Google's policy — never offer a discount for a better star rating, even in a private message. In the food service industry the same rules overlap with different guest-facing laws — what's allowed there is covered in guest reviews and the law.
A reply formula that gives nothing away
Every reply:
- 01thank the reviewer
- →02no confirmation
- →03invite contact
- →04short signature
Below are three ready skeletons for the most common complaints, built on exactly that pattern — with zero clinical detail.
| Write publicly | Never write publicly |
|---|---|
| A thank-you for the feedback | The type of procedure or its name |
| An apology for the impression or inconvenience | The date or time of a specific visit |
| An invitation to contact by phone or email | How the treatment went or its outcome |
| A short, neutral signature from whoever replies | Confirmation that this person was ever a patient |
Complaint about price
"Thank you for your feedback, and we're sorry the pricing came as a surprise. We set procedure prices individually after a consultation, so we're happy to explain them by phone — please reach us at the number listed on the site."
Complaint about pain or discomfort
"We're sorry the visit involved discomfort. Every treatment is different, so rather than assess it publicly, please contact our front desk — we'd be glad to talk through what happened."
Complaint about waiting time
"Thank you for the feedback, and we apologize for the wait. We're working on the schedule so this happens less often. If you'd like to share details, please email us — it helps us improve how we organize appointments."
None of the three skeletons mentions a procedure, a date, or a health condition — they work identically no matter how much the patient disclosed in the review itself.
When to report a review to Google, and when to just reply
Google removes only reviews that violate its content policies — you shouldn't report a review just because you disagree with it, since Google doesn't get involved in conflicts between a business and a customer (Google's review reporting policy). Evaluation typically takes several days, with status visible in the review management tool; you can select up to ten reviews per report and there's a one-time appeal if the decision seems wrong. Automated spam detection can be imperfect and occasionally removes genuine reviews too — a reason not to rely on reporting alone and to always answer publicly as well.
Reporting makes sense for insults, a review posted by a competitor, impersonation of a patient who never existed, or someone else's personal data appearing in a comment. It doesn't make sense for ordinary dissatisfaction with price, timing, or outcome — there, only a factual reply helps.
The conversation moves off the review: who calls back and what goes in the chart
An invitation to "please contact us by phone" only works if the phone number is actually visible and clickable on the site — otherwise the patient is left alone with the comment.
Once the patient does call or write, the conversation is already off the review — and a second confidentiality boundary appears here: a note from the call becomes part of the medical record only when it concerns health or treatment; a simple entry like "called back, matter resolved" can stay in a complaints log without being linked to the patient's chart. If you're wondering where such notes physically end up once handling is automated, we cover that separately in automation and GDPR.
An internal policy: who replies, within what deadline, who approves
A reply written in a hurry by someone without the right context, packed with clinical detail, is the most common source of trouble. It helps to set a simple policy: who has access to the Google Business Profile account, within what deadline a new review gets a reply (say, 48 hours), and who — the treating dentist or the front-desk manager — approves the wording before it goes public.
One person responsible for a given month prevents two different staff members from answering the same patients in contradictory tones. A short log helps too: review date, who replied, whether the case needed a phone call to the patient. When agreements get lost between shifts, a plain Tasks list helps: every new review gets a person and a deadline, so it never stays a wish without an owner.
Do it yourself: templates and a "never write this" list
- Copy the three reply skeletons above into a document shared across the front desk.
- Decide who has access to the Google profile and within what deadline they answer new reviews.
- Write a "never write publicly" list: procedure type, visit date, treatment course, complications, the patient's contact details, any judgment about whether pain was justified.
- For every new negative review, check first whether it's ordinary dissatisfaction (reply) or a policy violation (report) before writing anything.
- Once a month, review the reply log together with the treating dentist — especially any reply that came close to disclosing a detail. If you'd rather have someone write these templates and the rest of the site copy in one consistent voice, that's what Copywriting does.
What it looks like when a system handles the replies
- 01New review
- →02draft reply
- →03checked by a person
- →04published
- →05callback task
The system doesn't assess how the treatment went or the patient's health, and it makes no promise about a higher Google rating — it only makes sure no review goes without a reaction past the agreed deadline. The same one-queue mechanism for requests, regardless of channel, is covered in more depth in query handling automation.
In Aura this comes together from a few pieces that are useful on their own anyway. Reviews and reputation replies to every comment using an agreed template and tracks the deadline, without buying reviews or deleting genuine criticism. Google Business Profile keeps categories, photos, and contact details current, so an invitation to "call us" actually leads somewhere. CRM and automations bring phone, form, and messengers into one place, so the callback task never gets lost between inboxes.
Frequently asked questions
Can I state in a reply that a patient didn't pay for their visit?
No. That discloses both that this person was your patient and billing details about them — both are covered by confidentiality. Handle payment matters only by phone or email.
The patient gave their full name in the review — does that change the rules?
No. That's the patient's own choice to disclose their identity and treatment. You still don't confirm or expand on that information in your reply.
Can I delete a negative review I think is unfair?
You can't delete someone else's review yourself — you can only report it to Google if it violates the platform's policies (insults, fake content, someone else's personal data). Ordinary customer dissatisfaction isn't grounds for a report.
Who in the clinic should reply to reviews?
Ideally one designated person for a given period, familiar with the "never write this" policy, with the option to check the wording with the treating dentist before it's published.
Does a reply without medical details even work on readers?
Yes — the next patient reads the tone and professionalism of the reply, not clinical detail. A factual, polite reply without details builds trust more effectively than trying to argue the point publicly.
What should I do if a patient demands a refund in the comments?
Thank them for the feedback, don't confirm any visit details, and ask them to contact you by phone or email — refund decisions are made individually, away from the public review.