Four bodies have a view on how a UK consultant markets: the GMC, the CQC, the ASA, and the ICO. The single most enforced rule catches aesthetic clinics constantly — and it is not the one most people expect.
A UK consultant building private practice sits under four separate regimes at once, none of which reference the others. The General Medical Council governs professional conduct. The Care Quality Commission governs the regulated activity. The Advertising Standards Authority, through the CAP Code, governs what your marketing says. The Information Commissioner's Office, through UK GDPR and PECR, governs the data behind it.
Most practices know about the first two and get caught by the third.
This is a practitioner's summary written by marketers, not legal advice. Regulations change, and enforcement varies. Confirm the current text with your regulator or your own counsel before you publish.
Advertising prescription-only medicines to the public is prohibited under UK medicines legislation. It is not a guidance point or a professional courtesy — it is the single most frequently enforced rule in UK healthcare advertising, and it is why the aesthetics sector generates a steady stream of ASA rulings.
In practice this means botulinum toxin products cannot be advertised to the public, by brand name or in any way that promotes the prescription medicine itself. Clinics work around it by referring to the treatment category rather than the product — but the workaround only holds if the copy genuinely does not promote the medicine. Naming the brand, using its logo, offering it at a price, or building a landing page around it are all promotional.
The enforcement surface is wider than a website. The ASA treats a clinic's own social media posts as advertising. So a compliant website plus an Instagram grid full of product names is not a compliant marketing programme, and social is where most of the rulings originate.
Beyond medicines, the CAP Code requires that claims be capable of substantiation, that health claims not discourage essential treatment, and that marketing not exploit anxiety about appearance or health. Practical consequences:
Good Medical Practice requires that information you publish about your services is factual, verifiable, and does not exploit patients' vulnerability or lack of medical knowledge. In private practice this bites hardest on two things: fee transparency and the framing of elective work.
Publish your fees, or at least the structure and what drives variation. Patients expect it, the competition regulator's work on private healthcare pushed the sector toward it, and the practices that do it consistently report better-qualified enquiries. Separately, consultants practising privately are expected to submit activity and outcome data to the sector's information programme; being visible and accurate there is both an obligation and, quietly, a marketing asset.
If you carry out a regulated activity you must be registered, and your rating is public. Displaying it is a requirement, not a choice, and the ratings page is frequently the second thing a prospective private patient looks at after your profile. A practice that presents its rating clearly, with context about what has changed since the inspection, controls that narrative rather than letting a directory site frame it.
UK GDPR governs your lawful basis for processing enquiry data; PECR governs electronic marketing. The two interact in a way that is routinely misapplied.
The soft opt-in permits marketing similar services to people who gave you their details in the course of a sale or negotiation, provided you offered a refusal at the point of collection and in every message. Whether it applies cleanly to a healthcare context is arguable, and health data carries special category status under UK GDPR regardless. The defensible position for a clinic is straightforward opt-in consent for marketing, recorded, with the wording the patient saw.
Cookies and similar technologies need consent before they are set, which means marketing and analytics tags must be gated. A banner that loads after the tags is not compliance. And as elsewhere, condition-specific browsing behaviour flowing to advertising platforms is a risk worth designing out rather than arguing about.
Our compliance hub covers the landscape in summary form, and our market notes cover London and Manchester. If your marketing was built before you read any of this, we will audit it.
Writing on healthcare growth, AI-powered patient acquisition, and the operational reality of marketing inside hospitals and clinics.
The exact 90-day patient-acquisition system, step by step.
The ethics code says do not solicit patients. The market is full of doctors advertising heavily. Both things are true, a…
Three regulators, one free-zone authority with its own rulebook, and a permit requirement before anything goes live. A p…
HIPAA gets discussed as a rule about paperwork. For a practice website it is mostly a rule about JavaScript. Here is wha…
Six reasons hospitals, clinics, and doctors pick a healthcare-only firm over a generalist agency.
It's all we do. No retail, no fintech — the whole team thinks in patient journeys, clinical trust, and the way people actually choose a doctor.
Receptionists, WhatsApp triage, and attribution built in-house — we answer patients in seconds and tie every click to a booked appointment.
HIPAA, ASCI, NABH and GDPR sign-off baked into every campaign — our standard, not an upcharge or an afterthought.
The senior who pitched you stays on the engagement. No bait-and-switch to juniors learning on your budget.
Patient-level attribution across calls, forms, and walk-ins. Monthly reports show booked patients — not just clicks and impressions.
We name our clients and show the work. Quarterly reviews with the numbers attached, every cycle.
Adjacent practices, the relevant tools, and the case files where we shipped this thinking against real patient-acquisition targets.
