The worst reply to a bad review is the one that wins the argument. Because winning it means telling what you know about your patient.

Picture this: a Saturday at 11:10 p.m., and a cosmetic clinic in Zurich receives a one-star review. “They charged me more than we agreed and the result is worse than before.” The medical director, stung, starts typing a reply: “Madam, at your appointment on 12 March we explained that the treatment required two sessions, and you chose not to return for the second.” It is accurate. And in a single sentence it confirms that this person is a patient, when she came, what was done and what she decided.

Bad reviews hurt because they feel unfair, and sometimes they are. But I think the reply is not written for the person who left the review. It is written for whoever reads it later, who does not know who is right and only sees how the clinic treats someone who complains.

What it cost one clinic.

In April 2022, a person filed a complaint with the Spanish Data Protection Agency. After they left a Google review of an eye clinic, the clinic’s reply had published their full name, national ID number, phone number, health data and data about alleged offences. The agency first closed the complaint, the person appealed, and the case went ahead. The decision fined the clinic 7,000 euros: 5,000 for breaching confidentiality and 2,000 for lacking appropriate security measures, and ordered it to stop publishing that data.

Two details in the file seem more useful to me than the amount. Months later, the reply no longer appeared on Google, but the person had kept the screenshot and the platform’s own email notification. And the agency treated two things as aggravating: the clinic published the data knowingly, and the data included health information.

What the law on secrecy says.

In Spain, the basic law on patient autonomy gives everyone the right to have the confidentiality of their health data respected. And the Criminal Code punishes professionals who breach their duty of confidentiality and disclose another person’s secrets with one to four years in prison, a fine and a ban from practice.

In Switzerland, Article 321 of the Criminal Code punishes, on complaint, doctors, dentists, pharmacists, psychologists, nurses, physiotherapists and other health professionals, as well as their auxiliary staff, who disclose a secret entrusted to them in their professional capacity or learned while practising. The penalty can reach three years in prison or a monetary penalty. Disclosure is only exempt if the person concerned consents or the supervisory authority authorises it in writing.

What I do not know.

I have found no published Swiss case about a reply to a review, and I do not know where a court would draw the line for a reply that only hints. Nor do I know what Google will do with a given review: its moderation is not in the clinic’s hands. I am not a lawyer. What I do know is that confirming someone has been to your clinic already says something about their health, and that the Spanish case is not about an ambiguous sentence but about a reply written in anger.

The blind spot: who replies on your behalf.

Many clinics hand reviews to an agency, to reception or to a tool that suggests replies. If that tool has access to the calendar or the medical record, it can write in full detail what should never have left the clinic. And if the person replying is the one who treated the patient, they will write with the case fresh in their memory and, often, with the wound still open.

A reply to a review is not written for the person who left it. It is written for whoever reads it next.

Where I stand.

I believe a clinic should have in writing how it replies to a review, before it needs to. The public reply does not confirm that the person is a patient, does not mention dates, treatments or results, and offers a direct channel to management to talk in private. It exists in every language the clinic works in. Someone designated writes it, and a second person reads it before it is published. Automation can flag every new review and prepare the draft, always without access to patient data. An unfair review can be survived. A reply that tells what you know about your patient, not always.

What I would check.

• The replies already published. On Google and every platform, look for names, dates, treatments and any detail that confirms a visit.
• Who replies. Whether there is a designated person and a second reader, or whoever has the phone to hand replies.
• The standard reply. Whether it exists in every language and confirms no relationship with the clinic.
• The tools. Whether an agency or an AI replies for you, with what access and what instructions.
• The private channel. Whether someone who wants to complain finds a direct route to management on your website, and whether anyone answers it.

Where to start.

1. Today

   Read your published replies

   Those from the last two years, on every platform, through the eyes of the person who wrote the review.

2. This month

   Write the standard reply

   In every language, reviewed by your legal counsel, with the private channel included.

3. This quarter

   Decide who replies

   One designated person, a second reader and an automatic alert for every new review.

4. Every month

   Review reviews and replies

   What was said, what was answered and which complaints moved to the private channel.

Read the last reply your clinic published to a bad review. Read it first as a patient who does not know you yet would, and then as the person who wrote the review would.

Did either of them learn something about that patient they should not know? And who wrote the reply: a doctor, the front desk or an agency? The worst reply is not the one that loses the argument. It is the one that wins it with what could not be said.

If you would like me to review how your clinic responds to reviews today, and what a patient sees on your website when they want to complain, start with the Strategic Diagnostic. What your clinic may say in each case, and before which authority, is for your legal advisers to decide, not a designer.