A clinic's publication risk often begins with a small change. A qualified statement becomes an absolute headline. A patient image approved for one purpose is reused elsewhere. An edited caption goes live after its reviewer approved an earlier version.
These problems are easier to prevent when the team can answer four questions: what is being claimed, what supports it, who has checked the final version, and where it will appear.
Governance cannot make healthcare marketing risk-free. It can give the clinic a repeatable way to identify concerns, route decisions, and correct mistakes. This guide focuses on that operating process, using Germany and EU rules as reference points.
Brief
A practical publication standard
Evidence, permission, and advertising legality are separate checks. Passing one does not settle the others.
Approval belongs to a specific version, audience, and channel, not to a topic forever.
Every published asset needs an owner who can retrieve its record and coordinate a correction.
1. Separate the Checks That Often Get Confused
A medically reasonable statement may still be unsuitable for an advertisement. A patient may permit an image while the proposed advertising use remains restricted. A device supplier may provide attractive copy without evidence that supports your exact use.
In Germany, §3 HWG prohibits misleading healthcare advertising within its scope. §11 includes a prohibition on public before-and-after advertising for the specified non-medically necessary plastic-surgical procedures. Consent alone does not remove that prohibition; the proposed treatment and presentation need assessment. §3 HWG, §11 HWG.
For devices, Article 7 MDR prohibits misleading claims about intended purpose, safety, and performance. Check the precise device and intended use rather than borrowing a claim from a different product. EU Medical Device Regulation, Article 7.
These are selected rules, not an exhaustive clearance checklist. Professional requirements, other advertising rules, platform policies, and the specific facts may also matter. Have uncertain or higher-risk uses reviewed by qualified advisers.
2. Create a Claim Record Before Writing the Headline
A claim record does not need to be elaborate. Capture the proposed wording, what it implies, the supporting source, the population or context it applies to, its limitations, and the person responsible for checking it.
A study about one intervention is not evidence for another. A selected patient story does not establish a typical result. A supplier slide should not silently become the clinic's independent claim.
Questions for the claim record
| Draft wording | What to investigate | Publication decision |
|---|---|---|
| No downtime | What definition, intervention, population, and evidence support this? | Remove the absolute if it cannot be supported; explain relevant variation. |
| Clinically proven | Which study supports which exact claim, and what are its limitations? | Use only a defensible, appropriately qualified statement. |
| Before-and-after result | Is this use permitted, and are context, permissions, and image integrity established? | Do not publish while legal or permission questions remain. |
| Our most advanced treatment | Compared with what, using which objective criterion? | Replace vague superiority with specific, verifiable information. |
Strategy
Changing one word is not a clearance
Adding “may” to an unsupported outcome claim does not supply evidence. Review the overall impression created by the headline, image, caption, and call to action.
3. Keep Patient Permissions Separate From Care Decisions
Do not treat agreement to clinical photography or treatment as automatic permission for promotion. Define what material is involved, the intended use, channels, access, and the process for later requests.
The GDPR distinguishes the general basis for processing from the additional conditions for health data. Where consent is the basis, it must be demonstrable and withdrawal must be as easy as giving it. Clinical care and optional promotion require separate analysis. GDPR Articles 6, 7 and 9.
Keep permission records in a controlled location rather than attaching patient documents to a widely shared marketing board. The board can hold a restricted reference and review status. Refusal of optional promotional use should not become an obstacle in the patient's care experience.
Ask the privacy lead how withdrawal, deletion, retention duties, and already distributed material should be handled in the particular case. Do not promise that every third-party copy can always be retrieved.
4. Approve the Exact Asset That Will Be Published
A version-specific approval workflow
Brief
Record topic, audience, channel, owner, proposed claims, and supporting materials.
Review
Route clinical accuracy, advertising concerns, and data or image permissions to the relevant reviewers.
Resolve
Document edits and open questions. An unresolved material issue prevents approval.
Approve
A named person approves the final copy, visual, destination, and version for the specified use.
Publish and retain
Check the live result and retain a controlled record of the approved version, date, sources, and decision.
Material changes return to review. This includes a stronger headline, a different image, a new audience, a translation that changes meaning, or a new channel with different constraints. A reusable paragraph can save drafting time, but its previous approval is not unlimited permission.
For a small team, a workable division is: content owner prepares the record, clinical reviewer checks the medical statement, the relevant adviser resolves legal or privacy concerns, and the publisher confirms the final version. If people combine roles, keep the responsibilities visible.
5. Use Risk Triage to Route Work
Triage helps decide who should review an asset. It is not a finding that something is legally permitted.
Example routing categories
| Content | Initial route | Escalate when |
|---|---|---|
| Opening hours or location update | Operational accuracy check | The asset introduces an offer, medical claim, or personal data. |
| General service explanation | Clinical and content review | Suitability, outcome, safety, or comparative claims need clarification. |
| Patient image, testimonial, or case story | Clinical, permission, and advertising review | The intended use, identifiability, or legal position is uncertain. |
| New device claim, novel treatment, or disputed wording | Relevant specialist review before scheduling | Evidence or lawful use cannot be established. |
Insight
A fictional version-control failure
A reviewer approves “A consultation helps determine whether treatment is appropriate.” A later social caption promises “The solution for every skin type.” The topic has not changed, but the claim has. The final caption must return to review.
When planning repeated formats, connect this process to the patient content workflow. Review effort becomes more predictable when the source explanation and its adaptations are tracked together.
6. Plan for Corrections Before You Need One
Give the team a clear route to report a questionable asset. Identify who can pause scheduled content, assess whether live material should be removed, and contact the relevant clinical, legal, or privacy specialist.
Preserve the necessary record of what was published and why, with controlled access. Track related posts, translations, landing pages, and scheduled variants so a correction does not leave the same problem elsewhere.
If a concern involves personal data, route it promptly to the responsible privacy function to assess any required response. Not every content error is a reportable breach, and the marketing team should not make that determination by guesswork.
Takeaways
A useful first month
Inventory active service pages, paid ads, patient imagery, and reusable claims.
Choose a small set of higher-risk assets and establish their evidence, permissions, and approval status.
Introduce a version-specific approval board with a named publisher and escalation route.
Test whether someone outside the original project can retrieve a record and identify all live variants.
Evidence
Sources and scope
Editorial review: 13 September 2026. The linked HWG, GDPR, and MDR texts support the specific legal points. This article is operational guidance, not legal clearance or a substitute for advice on a particular campaign. The workflow and examples are illustrative, and a completed checklist does not guarantee compliance.
A more reliable publishing process
Make review part of the work, not the last-minute obstacle
MEDILUX helps organize claim records, responsibilities, and publication workflows, with specialist legal or clinical review where required.