What an Indian clinic may and may not advertise

If you search for what a doctor in India is allowed to post online, you will find a great deal of confident writing about the National Medical Commission's Registered Medical Practitioner (Professional Conduct) Regulations, 2023 — the ones with the widely reported social media rules, the ban on buying followers, the prohibition on patient success stories.

Almost all of it omits what happened next.

The rulebook most articles cite is not in force

The 2023 regulations were notified, drew immediate and substantial objection, and were placed in abeyance with effect from August 2023 — held back, not operative, and not effective until a further gazette notification is issued. No such notification has followed.

When the NMC held the 2023 code back, it made the Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002 effective again. Those 2002 regulations are the operative code today.

This matters practically, not academically. A clinic building its marketing policy from a summary of the 2023 rules is working from a document that has never taken effect. Some of what it would restrict is in fact permitted; some of what it would permit is restricted. And the professional conduct proceedings that actually happen are brought under the 2002 code, by state medical councils.

Before you take advice on this — including the paragraphs below — check whether the writer knows which code they are citing. It is a fast way to sort useful sources from content farms.

What the 2002 regulations restrict

The 2002 code is considerably shorter and blunter than the 2023 draft, and its core position on advertising is a general prohibition on soliciting patients, directly or indirectly.

In practice the settled positions are:

Soliciting patients is out. Anything whose purpose is to induce a patient to choose you over another practitioner, rather than to inform, sits on the wrong side.

Announcements are in. A new clinic opening, a change of address, a change in timings, a doctor joining or returning from leave — factual announcements of that kind have long been accepted.

Your credentials, stated plainly, are in. Qualifications you actually hold, registered with a council, stated without embellishment.

Comparative and superlative claims are out. "Best", "leading", "number one", "most experienced in the district" — these are claims about other practitioners as much as about you.

Guarantees of outcome are out, and are separately actionable under consumer law.

Testimonials, before-and-after, and the grey zone

This is where most clinic marketing goes wrong, and where the two codes are often conflated.

Patient testimonials and success stories are the clearest risk. Even setting the conduct regulations aside, a testimonial published without genuine, specific, written consent is a patient-confidentiality problem, and health data in India is treated as sensitive personal data under the DPDP Act. A recognisable face, a diagnosis and a clinic name together is disclosure, whatever the patient said on the phone.

Before-and-after imagery carries the same consent problem plus an outcome-claim problem: an image implies a result, and results vary.

If you take one operational rule from this, take that one — do not publish identifiable patients. It survives whichever code is in force, and it is the version of this that lands you in front of a council rather than merely in an argument.

What you can safely build a practice on

The restriction is on solicitation, not on being findable or useful. Almost everything that works for a clinic online is unaffected:

Being accurate where patients look. A complete, correct Google Business Profile — address, hours, phone, services, directions. This is information, not solicitation, and for most clinics it is the highest-return marketing work available.

Health education that does not sell. Explaining a condition, a procedure, or what to expect at a first visit. This is the safest and most durable content a clinic can publish, and it is what actually earns links and repeat visitors.

Operational facts. Booking links, teleconsultation availability, languages spoken, whether you are wheelchair accessible, insurance and payment options.

Your own patients' experience, unpublished. Ask for feedback, act on it, and do not turn it into a campaign.

Reviews, which you do not control

Patients will review you regardless. That is not advertising by you and is not your conduct.

What is your conduct is the response. Replying to a review in a way that confirms someone was your patient, or discusses their treatment, discloses information you should not — even where the patient disclosed it first, and even to correct something unfair. The safe reply acknowledges the feedback generically and moves the conversation off the public page.

Soliciting reviews in exchange for anything, or buying them, fails both the conduct code and the platform's own rules.

The practical position

Write down what your clinic will and will not publish, and make it simple enough that whoever runs your social media can apply it without a legal question every time. A workable default:

Publish factual information about the clinic and educational material about conditions. Never publish an identifiable patient. Never make comparative or superlative claims. Never promise an outcome. Never pay for a review or a follower.

That policy is stricter than the 2002 code requires in places, and it has the advantage of remaining correct if the 2023 regulations are ever notified into force. Which is the other reason to write it down: the rules here have already changed once and been un-changed, and the clinics that got caught out were the ones with no position of their own.