Healthcare advertising online: what a clinic can and cannot say

Which rules apply

In Spain there is no single healthcare advertising law, but several layers that add up:

• National rules: the General Health Act, the General Advertising Act and Royal Decree 1277/2003, which governs the authorisation of healthcare centres and also how they may advertise.
• Medicines and medical devices: they have their own, stricter rules under the medicines legislation.
• Regional rules: centre authorisation depends on each region, and some also require prior authorisation for healthcare advertising.
• Professional codes: the Code of Medical Ethics, the Code of Dental Ethics and each professional association’s rules.

Like any business, clinics must also comply with rules on misleading advertising, consumer protection and data protection. Other countries have equivalents: in Germany, for example, the Heilmittelwerbegesetz (HWG) and the medical professional code. The common thread is simple: healthcare advertising must be truthful, prudent and must not exploit people’s concern for their health.

Official text (Spanish): Royal Decree 1277/2003 on the authorisation of healthcare centres (BOE).

First: be authorised and say so

Only authorised healthcare centres may advertise, and only for the services they are authorised to provide. Advertising must not mislead about what the centre is or what it can do.

In practice, a Spanish clinic’s website should show the healthcare registration number assigned by the regional authority, usually in the footer and the legal notice. Many clinic websites forget it, and it also builds trust.

If your region requires prior authorisation for healthcare advertising, get it before launching the website or a campaign. Check with your regional health department what applies to you.

Before and after photos

They are the most requested content in dental and aesthetic clinics, and one of the most sensitive.

• Consent: they are health data. You need the patient’s express written consent to use them for advertising, and they must be able to withdraw it.
• Anonymity: crop the image so the person can’t be recognised unless it is essential. The Spanish Code of Dental Ethics accepts photographed clinical cases with permission or anonymity, but considers the “advertising exploitation” of a clinical success unethical.
• No retouching, comparable conditions: same lighting, same angle and no editing that changes the result. Otherwise it is misleading advertising.
• Context: state that results vary from patient to patient and don’t present an exceptional case as the norm.

In Germany the rules are stricter: before and after images of cosmetic surgery without medical necessity may not be used in advertising at all, and courts have applied this to injectables too.

An alternative that works very well: explain the treatment process step by step, with images of the clinic and the team, instead of basing the website on results.

Testimonials, reviews and celebrities

The Spanish Code of Medical Ethics is clear: doctors should not use public figures or real patients to encourage the consumption of healthcare services (art. 89.3). In 2020 the Spanish Supreme Court upheld the withdrawal of a dental chain’s campaign featuring celebrities.

• Google reviews: asking patients to leave a review is fine. Making them up, buying them or selecting them misleadingly is not.
• Replying to reviews: don’t even confirm that the person is a patient. Reply in general terms and invite them to talk privately. Confidentiality and data protection apply here too.
• Testimonials on the website: best avoided as a hook for specific treatments. If you use them to talk about how patients were treated, get written permission and leave out clinical details.
• Influencers: a free treatment in exchange for posts is advertising, must be labelled as such and is subject to the same limits.

Promises, guarantees and “the best”

Healthcare advertising must be objective, prudent and truthful, and must not raise false hopes (Spanish Code of Medical Ethics, art. 88.2). The Code of Dental Ethics also asks dentists to avoid “promising and guaranteeing results”.

• No “guaranteed results”, “pain-free”, “for life” or “100% success”.
• No superlatives you can’t prove: “the best clinic in Palma”, “the best specialists”.
• Don’t use endorsements from authorities or scientific societies as a hook if you don’t have them, or in a way that looks like an official recommendation.
• When advertising a specialty, it must be one the professional holds officially (for doctors, the one registered with the medical association). A course or a master’s degree is not a specialty.

What does work: explain clearly what each treatment involves, who it is for, how long it takes and what aftercare it requires. That information builds more trust than a promise.

Prices, offers and financing

Publishing guide prices can help patients decide, but commercial hooks are something else. The Spanish Code of Medical Ethics considers it unethical to offer medical services as competition prizes or commercial promotions (art. 89.2), and also rejects attracting patients with price-based hooks.

• Avoid “2 for 1”, “free first visit” as bait, countdowns or seasonal discounts on medical treatments.
• If you publish prices, make them clear: what is included, what isn’t and whether they may change after assessment.
• If you offer financing, explain the terms transparently. After cases like iDental in Spain, patients are wary, and rightly so.

Each professional association may apply its own criteria. If in doubt about a specific campaign, check with them first.

Botox, fillers and medicines

Botulinum toxin and other prescription-only medicines may not be advertised to the public. Nor indirectly, by advertising the treatment with the medicine’s brand name.

This isn’t theoretical: in 2025 the High Court of Justice of Madrid upheld a €90,000 fine on an aesthetic clinic for promoting botulinum toxin treatments on its website and Facebook, naming the medicine brands, with discounts and without warning of risks.

You can explain that you offer aesthetic medicine treatments, who performs them and what the prior assessment involves. What you must avoid is promoting the medicine: brands, offers on it or messages that present it as a cosmetic product.

Health data on your website

A healthcare website handles specially protected information from the very first contact:

• Contact form: ask for the minimum (name, contact details and a general reason). Medical history and clinical details are better left for the appointment.
• A privacy policy that covers health data, and a clear consent checkbox.
• Analytics and advertising pixels: be careful what you send to Google or Meta from pages about specific treatments. Visiting an “erectile dysfunction treatment” page already says a lot about someone.
• Security: a hacked clinic website is a reputational problem and a data protection problem.

Quick check of your website

Go through your website, social media and ads with these questions:

• Is the centre’s healthcare registration number shown?
• Do you only advertise services the centre is authorised for?
• Do you have written consent for every patient photo, without unnecessary identification?
• Are there promised results, guarantees or superlatives?
• Are patients or celebrities used as a hook?
• Are there offers, discounts or gifts on medical treatments?
• Do brands of prescription medicines, such as botulinum toxin, appear?
• Does the form ask only for the data you need?

If you also want to review your website’s message, the guide the four pillars of copywriting will help you explain your treatments clearly.

This guide is for information only and is not legal advice or a substitute for your professional association’s guidance. Regional rules and professional criteria vary: check them before a specific campaign.

Frequently asked questions about healthcare advertising