| Who sets advertising rules | The ASA (CAP Code), plus your professional regulator such as the GMC, GDC, GOC or HCPC | AHPRA and the National Boards (National Law, section 133), plus the TGA for medicines and devices | The FTC and your state licensing board |
| Testimonials and reviews | Allowed if genuine and not misleading, but they must not make medical claims | Not allowed in advertising a regulated health service where they relate to clinical care, including on your own website and social pages | Often allowed if genuine and not misleading (FTC rules), but state boards can add limits and patient privacy rules apply |
| Health data and privacy | UK GDPR treats health data as special category data | The Privacy Act 1988 treats health information as sensitive information | HIPAA for covered entities, plus state privacy laws |
| Email and text marketing | Consent is needed (PECR and UK GDPR) | Spam Act 2003: consent, sender details and an unsubscribe option | CAN-SPAM for email and the TCPA for texts |
| Registration for online care | CQC registration may be needed in England, so check first | AHPRA registration, plus Medicare rules if you bill Medicare | A licence in each state where the patient is. Compacts such as PSYPACT and IMLC can help |
| Google Ads for telemedicine | Telemedicine advertisers need LegitScript certification (check the current policy and apply early) | Telemedicine advertisers need LegitScript certification (check the current policy and apply early) | Telemedicine advertisers need LegitScript certification (check the current policy and apply early) |
| How patients are usually referred | NHS or private GP referral, self-pay, or private medical insurance | GP referral for Medicare rebates on specialist care. Many allied health and telehealth services take direct bookings | Insurance networks, primary care referral, or cash pay |