Compliant web design for New Zealand medical and dental practices

No. The Medical Council of New Zealand's Statement on Advertising prohibits patient testimonials in any form of medical advertising, including websites, social media, and Google reviews. The reasoning is that testimonials can mislead the public about typical clinical outcomes and undermine the dignity of the profession. This is one of the most common breaches we find when we audit existing GP and specialist sites, often because the practice used a generic template that came with a testimonials section enabled by default. For medical practices we remove all patient quotes and review widgets at build time. Practitioner qualifications, vocational scope, and years in practice can be stated factually and are not testimonials.

The Health Information Privacy Code 2020 sits on top of the Privacy Act 2020 and applies the moment your website collects any information about an identifiable individual that relates to their health. A contact form that asks "how can we help" and gets back "I think I have shingles" is collecting health information, and HIPC Rule 3 requires you to tell the patient what you are collecting, why, who will see it, where it goes, and how long you will keep it. We build every clinic form with a visible collection statement, encryption in transit, a defined retention window, and a documented destruction process. We also recommend keeping free-text symptom fields off the public site and pushing those conversations into a secure messaging channel inside your practice management system.

Yes, with care. Google has a Healthcare and Medicines policy that restricts certain advertisers and certifies others, and on top of that the Medical Council rules apply to every word of your ad copy. The combination means no superlatives, no comparative claims, no implied typical outcomes, no testimonials in the copy, and no targeting that singles out individuals based on inferred health conditions. We run Google Ads for clinics around symptom-driven and service-driven keywords, with copy that points to a compliant landing page and a HIPC-compliant intake form. For prescription medicines, regulated procedures, and certain conditions, additional Google certification or local restrictions apply, and we work that out per practice during the compliance audit.

Yes. The Dental Council of New Zealand regulates dental advertising under the Health Practitioners Competence Assurance Act 2003 and has its own standards, which are lighter than the Medical Council's. Dental practices can use patient reviews and before-and-after photography with proper context, where medical practices generally cannot. The shared rules still apply: claims must be truthful and substantiated, qualifications stated honestly, no superlatives, no comparisons that disparage other practitioners, and patient privacy respected at every step. For multi-discipline clinics that combine dental, medical, and allied health, we treat each section under the rules that apply to it rather than running one blanket policy across the whole site.

For medical and specialist practices, no. The Medical Council treats Google reviews as a form of patient testimonial, so embedding a live review feed on a GP or specialist site is the same compliance problem as putting a quote block on the homepage. For dental, physio, chiro, and most allied health practices, reviews are allowed but they need to be handled carefully. We configure widgets to filter out reviews that contain comparative claims or imply typical clinical outcomes, and we make sure the practice has a documented response policy for negative reviews that respects patient privacy. We never paste raw Google Reviews onto a medical site without that review step.

Yes. We have worked across the systems New Zealand clinics actually run and we integrate booking, recall, and intake into the website rather than relying on a generic popup widget. The integration depends on what your practice management system exposes, and not every New Zealand PMS has a clean public API. Where the official integration is locked down we use a request-and-confirm flow on the website that posts a HIPC-compliant intake into your inbox or secure messaging, and your front desk confirms the booking inside the PMS. The patient experience stays smooth on mobile, and you do not end up with a parallel booking system that contradicts what is in the practice management system.

They look the same because most practices use the same handful of templates from the same handful of overseas vendors, and most of those templates are not compliant with New Zealand rules. The job is not really design, it is the layer underneath: the compliance review, the form architecture, the booking integration, the local SEO, and the practice management hookup. A patient choosing between two GP clinics in their suburb is not picking the prettier site, they are picking the one that loads quickly on their phone, shows them how to book in under thirty seconds, and answers the question they actually came to ask. That is the work that wins, and it is what most healthcare sites get wrong.