The standard advice for handling a bad review is to respond publicly, address the specifics, and show other readers the business took it seriously. For a clinic, that playbook breaks down at the first sentence, because addressing the specifics of someone's visit in public means confirming, in public, that they were a patient at all — and that confirmation is the disclosure the law is built to prevent, regardless of whether the reviewer brought it up first.
Why the usual playbook is off the table
This is not a US HIPAA-style framework applied to a different country; it is a current, UAE-specific statutory and professional duty, and the clearest statement of it is also the newest. The Dubai Health Authority's 2025 Standards for Code of Ethics and Professional Conduct for Health Professionals (DHA/HRS/HPSD/ST-66) states plainly that healthcare professionals must not share confidential patient information on social media or public platforms "under any circumstances, even if anonymized or de-identified" — a line that forecloses not just naming a patient in a reply, but describing their case at all, even without a name attached. That current standard sits alongside the older statutory duty it reinforces: Federal Decree-Law No. 4 of 2016 Concerning Medical Liability, Article 5, prohibits a doctor from disclosing a patient's secret learned during or because of practicing the profession — whether the patient told the doctor directly or the doctor found it out independently. A separate instrument, Federal Law No. 2 of 2019 Concerning the Use of ICT in Health Fields, sets confidentiality and security obligations for health data specifically and requires consent before it is shared with other parties.
Article 5's exceptions are narrow and named: disclosure at the patient's own request or consent, disclosure to a spouse in specific circumstances, disclosure to a competent official authority to prevent or report a crime, and disclosure necessary for the doctor's own legal defence before an investigative or judicial body. Responding to a public review does not fall into any of these. It is not a request from the patient, not a report to an authority, and not a legal defence — it is a communications choice, and the law does not carve out an exception for one.
What this means in practice
A compliant reply cannot reference a diagnosis, a treatment, a date of visit, or even confirm that the reviewer is or was a patient — doing any of these, even without naming the person, is treated as identifying and disclosing. This holds even if the reviewer has already stated they were a patient; the clinic confirming it publicly is still the clinic's own disclosure, made under its own confidentiality duty, and that duty does not lift just because the other party spoke first.
What a compliant response looks like
The approach most healthcare marketers use, as common industry practice rather than a specific legal script, is to never confirm or deny a patient relationship even implicitly, respond with a short, generic acknowledgement — something like inviting the person to contact the patient relations team directly — and move the actual conversation to a private channel. Documenting who approved the response and what was said, so there's an internal record if the response itself is ever questioned, is also standard practice, not a cited requirement.
None of this is HEYA's invention or a shortcut around the confidentiality duty — it is simply what fits inside it. The generic, private-channel approach works because it never requires disclosing anything the law protects, not because it is a clever workaround.
Where HEYA's view differs from a legal rule
Our own recommendation is to build the review-response process before the first negative review arrives, with a pre-approved template and a named person responsible for sign-off, so nobody is drafting a reply under pressure and deciding in the moment what is and isn't safe to say. That is our editorial opinion about good practice, not a citation of any regulation — the regulation only tells you what you cannot say, not how to organise your team around saying it well.
The confidentiality obligations that apply to a specific facility, and how they interact with the platform a review sits on, are worth confirming directly with your legal or compliance advisor before adopting a formal review-response policy — this article is an orientation to the boundary, not a substitute for that review, and the underlying law does not change how it should be handled just because a review moved from a clinical setting to a public app.
Getting the response right is part of a wider patient acquisition strategy that treats trust as something built over many small, honest interactions rather than a single clever reply.
