FFP Guides

AHPRA advertising

AHPRA rules for review widgets on a clinic website

A widget that automatically pulls reviews onto your website republishes them as your advertising, so a clinical review it displays breaches section 133(1)(c) of the National Law the moment it appears, even though the platform hosting the original review is not your responsibility. The only compliant automated setup shows a rating and count with no review text, sourced from Ahpra's testimonial guidance.

Last checked 25 Sep 2026 against the sources listed at the end of this page.

"A person must not advertise a regulated health service, or a business that provides a regulated health service, in a way that ... (c) uses testimonials or purported testimonials about the service or business;" (Health Practitioner Regulation National Law, section 133(1)(c)). Ahpra's Testimonial tool describes a testimonial as "a recommendation or positive statement about the clinical aspects of a regulated health service" and notes that a rating or award symbol is unlikely to breach the ban unless it republishes the testimonials behind it.

Source

Allowed

  • A widget or plugin configured to show only your Google Business Profile star rating and review count, with no review text pulled through, whatever platform it draws from.
  • A static badge or embed that links out to your reviews on the source platform (Google, Facebook, ProductReview, Trustpilot) rather than rendering the review content on your own page.
  • A widget set to draft or pending mode, where new reviews sit unpublished until a staff member reads each one and approves only the non clinical reviews for display.
  • A small, hand picked set of full reviews that a person has actually read and confirmed contain nothing about a symptom, diagnosis, treatment or outcome, refreshed manually rather than by an automatic feed.
  • Turning the widget off altogether and replacing it with a link to your review profile. This removes the vetting problem completely.

Not allowed

  • Any plugin or embed set to auto publish new reviews from Google, Facebook, Yelp, ProductReview, RateMDs or a similar platform straight to your website without a person checking each one first.
  • A widget filtered to five star reviews only, or to a minimum star rating. Ahpra's testimonial guidance treats selectively including or excluding whole reviews as capable of being misleading, and a star filter is exactly that kind of selection.
  • An RSS or JSON feed embed that refreshes on a schedule with no moderation step, since a clinical review can appear on your site for days before anyone notices it.
  • A widget that also imports the reviewer's name and photo alongside a clinical comment. Ahpra does not treat anonymising a review as fixing a testimonial breach; the clinical content itself is the problem.
  • Leaving a review platform's own embeddable widget on a template site (a stock Squarespace, Wix or WordPress theme) without checking its settings, since most ship with auto publish switched on by default.

What a compliant clinic website does

A compliant clinic site shows a small badge in the footer reading the Google star rating and review count with a Read our reviews link out to Google, and nothing else pulled from the review platform automatically. If the practice wants review text on the page, a staff member reads new reviews weekly in the widget's moderation queue and manually approves only the ones about booking, communication or the front desk before they go live.

Penalty: Breaching section 133 is a criminal offence, with a maximum penalty of $60,000 per offence for an individual and $120,000 per offence for a body corporate, so a clinic company running an unmoderated widget carries the same exposure whether the breach was noticed by staff or not.

This is general information, not legal advice. Check the current guideline before you publish.

Why an automated feed is a different risk to a hand picked review

A review you copy onto your site by hand is a decision: you read it, and you chose to publish it. A widget that polls Google or Facebook every hour and renders whatever comes back is not a decision at all, it is a standing instruction to publish anything a stranger writes about your clinic, unread. Ahpra's advertising guidelines put the responsibility for what your website shows on you, the practitioner or the business, regardless of whether a plugin or a developer set it up. An automated feed does not reduce that responsibility, it just removes the moment where someone could have caught the problem.

Physiotherapy, podiatry and other allied health reviews are disproportionately about the thing that brought the patient in: their knee, their back, their gait. A feed with no filter for clinical content will surface exactly the reviews Ahpra is most concerned about, at a rate most clinics do not notice until a competitor, a patient complaint, or an audit points it out.

The settings that actually change your exposure

Most review widget products (embeddable Google review sliders, Facebook Recommendations feeds, Trustpilot and ProductReview badges) offer three configurations: rating only, auto publish full reviews, or a moderation queue that holds new reviews until approved. Rating only removes the testimonial risk almost entirely, since a number and a star icon are not a positive statement about a clinical aspect. Auto publish is the setup to avoid. A moderation queue is workable but only if someone actually checks it; an unread queue behaves exactly like auto publish, just with an extra click no one is making.

Filtering by star rating is not a safe middle ground. A five star review is just as likely to describe a clinical outcome as a three star one, and Ahpra's guidance on selective publishing treats choosing which whole reviews to show, star based or otherwise, as capable of being misleading in its own right.

Template sites and default settings

Clinics that build their website from a Squarespace, Wix or WordPress theme often inherit a reviews block that came pre-wired to a Google or Facebook feed, switched to auto publish by default, because that setting looks best in a demo. Nobody at the clinic chose it, but Ahpra does not distinguish between content a developer configured and content a staff member typed in; the clinic is the advertiser either way. Checking what a review widget actually pulls in, and switching it to rating only or a moderated queue, is a five minute settings change worth doing on any site that has one installed.

Sources

  1. Testimonials are recommendations or positive statements about the clinical aspects of a regulated health service used in advertising; comments about customer service or communication style are not testimonials. Ahpra, checked 25 Sep 2026.
  2. Publishing an award symbol or rating on a website advertising a regulated health service is not likely to breach the testimonial ban unless it republishes the testimonials the rating is based on. Ahpra, checked 25 Sep 2026.
  3. Selectively editing reviews, or selectively including or excluding whole reviews, has the potential to be misleading and breach the National Law. Ahpra, checked 25 Sep 2026.
  4. Section 133(1)(c) of the National Law prohibits advertising a regulated health service in a way that uses testimonials or purported testimonials about the service or business. Ahpra and the National Boards, checked 25 Sep 2026.
  5. The maximum penalty for an advertising offence is $60,000 per offence for an individual and $120,000 per offence for a body corporate. Ahpra and the National Boards, checked 25 Sep 2026.