How Doctors and Clinics Should Reply to Online Reviews Under the NMC Guidelines (2026)

By Raman Soni · Head of Performance Marketing

LinkedIn

TL;DR

• The NMC's Guidelines on Ethical Advertising and Public Communication (6 October 2026), read with the IMC (Professional Conduct, Etiquette and Ethics) Regulations 2002, govern what an Indian doctor or hospital says in public online spaces, including short replies on Google Business Profile, health directories and social posts.
• Disclosing anything about a patient in a public reply, claiming superiority, promising outcomes or turning a reply into a sales pitch each carries real risk (paras 6.1-6.4, 7.4, 8.1(ii), 8.1(iii)).
• A compliant reply does three things: acknowledges the feedback, refers to process (never clinical detail), and moves the conversation offline through a listed contact.
• Replies should come from the hospital or clinic's account, written to a written SOP, not case by case from the treating doctor's phone.

This guide was first written around Chapter 6 of the 2002 Regulations; it now reflects the October 2026 guidelines. It covers replies. For whether and how to ask patients for reviews in the first place, see Google reviews for doctors under the NMC guidelines, and for the full rulebook, our complete guide to the NMC advertising guidelines 2026.

Updated 8 October 2026 to the National Medical Commission's Guidelines on Ethical Advertising and Public Communication by Hospitals/Medical Institutions and Registered Medical Practitioners (public notice No. R-13014/01/2024-Ethics, dated 6 October 2026, in force immediately). Paragraph numbers in this article refer to those guidelines. General information, not legal advice.

Table of contents

• Why this matters for Indian doctors and clinics now
• What do the NMC guidelines say that applies to review replies?
• Can doctors ask patients for Google reviews?
• How should a clinic reply to a negative online review?
• What language is safe (and unsafe) in a review reply?
• How do Indian hospitals handle review disputes internally?
• What can happen if a reply breaches the guidelines?
• How ICG supports review replies for clinics

Why this matters for Indian doctors and clinics now

It is common to see a doctor reply to a Google review with the patient's name, condition and a warm line about how the treatment "actually saved" them. It reads friendly. It also discloses patient information in public, turns the review into a testimonial, and is hard to defend before a State Medical Council.

Google Business Profile is the first stop for most people searching for a doctor in Delhi, Bengaluru, Kochi or Guwahati. A visible reply often carries more weight than the review itself, and it stays in Google's index for years. One badly worded response can shape how a practice is perceived long after the patient has moved on.

The October 2026 guidelines remove any doubt that this is regulated. Para 3.2 defines "advertisement" to include digital, social-media, search-engine and platform-based communication that directly or indirectly promotes. A review reply that promotes falls inside that definition; a neutral acknowledgement given in the normal course does not (para 3.2, Explanation I).

What do the NMC guidelines say that applies to review replies?

Four boundaries matter directly for a review reply:

• No solicitation or self-promotion (para 8.1(ii)). A reply that ends with "book your consultation on..." turns an acknowledgement into solicitation.
• No testimonials or patient information (para 3.2, Explanation V; paras 6.1-6.4, 7.4). An RMP may not request or share patient reviews for professional promotion on social media, and identifiable patient data may not be published. "Thank you Mrs. Iyer, glad your knee surgery worked out" confirms the patient, the procedure and the outcome, and republishes the testimonial under the doctor's name.
• No superiority claims (paras 8.1(iii) and 8.1(ix)). No "we are the only clinic in Pune with this technique" or "best IVF success rate in South India". Para 8.1(ix) bars "best", "No.1", "leading" and similar claims unless objectively verifiable with a disclosed methodology, and it binds hospitals too.
• No guaranteed outcomes (paras 8.1(iii) and 8.1(vi)). "We will fix your back pain" or "you will see full recovery" cannot appear in a public reply.

Every review SOP for an Indian clinic should print those four boundaries and keep them where replies are drafted.

Can doctors ask patients for Google reviews?

A hospital or clinic may ask all of its patients for genuine feedback. What is barred is soliciting, buying, procuring or manipulating fake, paid or misleading reviews (para 3.2, Explanation V), manipulating reviews and ratings (para 8.1(xii)), and an individual doctor requesting or sharing reviews for professional promotion on social media (Explanation V).

What fits the guidelines:

• One neutral feedback request sent by the clinic, from its operational number or email, to every patient, with the Google link and a private feedback option in the same message.
• QR codes at the front desk with wording like "share your experience", shown to everyone. No 5-star imagery, no incentive, no doctor's photograph.

What does not:

• Templates that read "Dr. X would appreciate your 5-star Google review."
• Any discount, free consultation or gift in exchange for a review (Explanation V; para 8.1(x)).
• Sending the link only to patients who seemed happy.
• Staff handing patients a phone with the review page already open.

The full request model, with scripts, is in our Google review strategy for Indian clinics.

How should a clinic reply to a negative online review?

A reply to a negative review should acknowledge the feedback without disputing clinical facts in public, must never reveal the person's identity, condition or treatment, and should move the conversation to a private channel, usually the medical superintendent's office or a listed grievance contact. The reply is a public act, not a defence.

The instinct, especially for busy consultants, is to correct the record: "The patient came in at 11 pm with an already advanced infection, refused admission, and left against advice." Every one of those clauses discloses patient information even without a name, because the patient (and people who know them) can recognise themselves. Paras 6.1-6.4 and 7.4 of the guidelines restrict that, and the DPDP Act 2023 applies as well (para 7.6).

A safe three-line template that works for most Indian clinics:

• Line 1: acknowledgement without agreement or disagreement. "We are sorry to read that this did not meet your expectations."
• Line 2: process reference, not clinical detail. "We take every concern seriously and review feedback through our internal quality process."
• Line 3: offline routing. "Please write to feedback@[clinic].in or call our patient relations desk at [number] so we can look into this."

That structure avoids both the patient-information and the promotion problem at once. It also reads better to prospective patients than a defensive reply. More wording, by specialty, is in our review response templates.

What language is safe (and unsafe) in a review reply?

Safe language is generic, process-oriented and free of clinical or promotional detail. Unsafe language names the patient, refers to diagnoses or procedures, claims outcomes or superiority, or asks the reader to book.

Note that "we appreciate you choosing our clinic" also confirms a patient relationship; keep even thank-you replies neutral.

How do Indian hospitals handle review disputes internally?

Well-run hospitals separate review handling from individual doctors. A patient experience or grievance cell drafts replies from the hospital's account, escalates disputed reviews for medico-legal review, and involves the treating doctor only if an internal investigation needs their account of events. The doctor does not type the public reply personally.

The workflow we see scale across healthcare clients:

• Intake, within 24 hours. Marketing or the front desk logs every review across Google, health directories, Facebook and WhatsApp Business into one tracker.
• Triage, within 48 hours. Reviews split into three buckets: operational (parking, waiting time, billing), clinical (perceived misdiagnosis, unexpected outcomes), and potentially defamatory. Operational reviews get a prompt neutral reply.
• Clinical review escalation. Clinical complaints go to the medical superintendent or a designated compliance officer. The doctor's version of events is recorded in writing but never published.
• Legal review for the defamatory bucket. These sit with the hospital's legal counsel, and public replies wait for counsel's sign-off.
• Offline resolution log. Every private conversation with the patient (call, WhatsApp, email) is documented for medico-legal purposes.

In our experience, moving to this workflow mostly changes what gets published: far fewer defensive replies, and complaints resolved privately instead of argued in public.

What can happen if a reply breaches the guidelines?

Action usually begins with a complaint from a patient, another practitioner or a member of the public. The State Medical Council issues a show-cause notice first and must pass a reasoned order (paras 10.2-10.3). Para 10.1 sets out graded action that "may be contemplated" against an RMP:

• First violation: warning plus mandatory ethics training.
• Second violation: censure plus a monetary penalty.
• Third violation: suspension for 3-6 months.
• Serious violations (misleading cure claims, inducements, digital mass solicitation): suspension for 6-12 months.
• Repeated violations: removal from the register for 1-3 years.

An appeal lies to the Ethics and Medical Registration Board within 60 days, with a further second appeal (paras 10.3 and 11). Hospitals and medical institutions are dealt with under the Clinical Establishments Act or the relevant State Act (para 10.1, Explanation). A reply that discloses patient information can also raise separate questions under the DPDP Act 2023, so the same reply can create exposure on two fronts.

How ICG supports review replies for clinics

For hospital and clinic clients, ICG runs review replies from the institution's account, not the doctor's. Angryturtle, our Google Business Profile OS, holds the approved reply wording and posting cadence, and every AI-drafted reply is checked by a person before it goes live. AtomCRM logs each offline resolution against the review it belongs to, so the trail is available for medico-legal purposes. For hospitals on a full EHR, HealthPro 360 surfaces operational triggers (delayed billing, long waits, discharge friction) into the same tracker before they become public complaints.

The aim is that a clinic rarely needs to reply defensively at all. Public reply is a last line, not a strategy.

ICG's 70-30 fixed-variable engagement model

ORM sits inside our broader retainer structure. Three tiers, each with a fixed 70% component and a variable 30% tied to outcomes we agree upfront with the practice — usually consultation volume, positive review growth, or search visibility on branded terms. Retainers start from Rs 20,000 per month and are custom-scoped, Goals-Driven, with Performance-Linked Payout Models available.

• Foundation. Suits solo clinics and single-specialty practices in Tier 2/3 cities. Covers GBP hygiene, review workflow SOP, and a monthly compliance audit.
• Growth. For multi-doctor clinics and single-location hospitals. Adds paid Meta amplification, competitor intelligence, and a video content cadence.
• Scale. For hospital chains and pan-India specialty groups. Includes full CRM integration, medico-legal review support, and cross-city ORM dashboards.

The 30% variable ties the retainer to what actually moved, which — for compliance-sensitive practices — usually means fewer defensive replies published, not more.