Spain’s medical code of ethics says not to use real patients to sell. And a testimonial can be withdrawn at any time.

Picture this: an aesthetic medicine clinic in Spain launches a campaign built on patient videos. Name, face, before and after. It works, and enquiries go up. Eight months later, one patient sends a two-line email: she has changed jobs and no longer wants her video on the website or on social media. It comes down. The following month, another patient asks the same. The clinic’s home page, built around those voices, slowly empties.

I start there because almost every conversation about testimonials in healthcare revolves around one question: whether they are banned. I think it is the wrong question. The legal answer is less simple than people tend to say, and it depends on what is being advertised and where. The useful question for a private clinic that wants to charge what it is worth is a different one: what does it build the trust of people who do not know it yet on?

What the rules say.

Spain’s Royal Decree 1907/1996, on the advertising of products, activities or services with a purported health purpose, prohibits in article 4.7 advertising that seeks to present testimonials from health professionals, from famous or well-known people, or from real or supposed patients, as a means of inducing consumption. It is the sentence quoted in almost every industry guide. Article 6 adds that the advertising of healthcare centres must match the content of their health authorisation, and that any other kind of advertising requires prior, express authorisation from the health authorities.

The Code of Medical Ethics approved by Spain’s General Council of Medical Associations in December 2022 puts it more directly in article 89.3: medical advertising should not use public figures or real patients as a means of inducing healthcare consumption. Article 90 asks that a doctor’s advertisements be informative and state their identity, their medical association registration number and the specialty registered with it. And article 87.3 asks that the advertising message be clearly distinguished from the scientific one.

What that sentence does not say.

The 1996 decree speaks of a purported health purpose. According to the legal press that reported the ruling in March 2020, Spain’s Supreme Court held that the decree did not apply to a dental chain’s campaign featuring two celebrities, because the health purpose of its services was undeniable. It reached the same result, that the campaign could not run, by another route: the law on medicines and medical devices. In other words, the article everyone quotes may not be the one that applies to your clinic, and the outcome may still be the same.

On top of that, control is exercised by each of Spain’s autonomous communities. In Cantabria, for example, Decree 4/2020 requires prior administrative authorisation for every form of health advertising, including advertising online. It must be requested at least three months in advance, it lasts five years, and the message must comply with articles 4 to 7 of the 1996 decree. Other regions have their own rules. I am not a lawyer, and which rules apply to your clinic, in your region and for what you advertise, is for your legal adviser or the regional health authority to confirm.

The blind spot: a testimonial can be withdrawn.

There is a detail almost no guide mentions. A patient testimonial reveals something about that person’s health: that they were treated, for what and sometimes with what result. The General Data Protection Regulation treats health data as a special category, and its article 9 only allows it to be processed in specific cases, explicit consent among them. Its article 7.3 adds that the data subject can withdraw consent at any time, and that withdrawing it must be as easy as giving it.

So even if your clinic has everything in order, the piece doing the most work on your website is the one you control least. It depends on someone else’s will, today and five years from now. And when it has to come down, that must happen quickly and everywhere: the website, social media, the ads and the printed material still sitting in the waiting room.

A testimonial borrows someone else’s trust. A clinic that charges what it is worth needs its own.

Where I stand.

I would not build a private clinic’s trust on what its patients say. I would build it on what the clinic can prove for itself, under its own name and those of its doctors. Interestingly, that is exactly what the code of ethics asks for. A doctor shown with name, registration number and specialty, a process explained step by step, and a page that says frankly when the clinic advises against a treatment will persuade a demanding patient more than a gallery of smiles. Trust that can be withdrawn with one email is not an asset of the clinic.

What I would check.

• What depends on patients. How many pages, ads and posts use testimonials, names, reproduced reviews or before-and-after photos, and what consent sits behind each one.
• Withdrawal. If a patient asks today for their testimonial to be removed, who receives the request, how long it takes and whether it disappears everywhere.
• Who signs. That every doctor appears with name, registration number and registered specialty. It is an ethical obligation, and also the best proof the clinic has.
• The process. What happens from the first message to the last check-up, with timings, so the patient can picture the treatment without needing to see someone else’s.
• Your doctors’ answers. The questions patients really ask, answered by the people who treat them, with information kept separate from advertising.

Where to start.

1. This week

   Take stock

   Every published testimonial, name, photo or before-and-after, where it appears and what consent backs it.

2. This month

   Confirm the framework

   With your legal adviser or the regional health authority: which rules apply, whether you need prior authorisation and what to do with what is already published.

3. This quarter

   Replace

   Doctor pages with registration number and specialty, the process explained step by step and answers signed by the people who treat.

4. Always

   Have withdrawal ready

   A written procedure to remove any patient content within days, not weeks, when someone asks.

Imagine that tomorrow the patient behind the nicest testimonial on your website asks you to take it down. She is entirely within her rights. What is left on that page once it is gone?

If little is left, the question is no longer legal. It is fundamental: what does your website say about your clinic that does not depend on what someone else says? That is the only thing no patient can take back.

If you would like me to review which part of your website depends on testimonials today and how to replace it with information your clinic controls, start with the Strategic Diagnostic. What your clinic may publish is for your legal advisers and the health authority to decide, not a designer.