Privacy on a pharmacy's public pages: reviews, replies, photos, posts

Why a pharmacy's public words carry more than a shop's

Any sentence a pharmacy publishes, on its site, in a post or under a review, can be read by anyone. With web search on, an AI assistant can fetch it too and repeat it in an answer the pharmacy never sees. For a bakery, a reply that says "glad you liked the rye" gives nothing away. For a pharmacy, a sentence that confirms a person is a customer can say something about their health: that they fill prescriptions there, that they came in for a particular service, that they take a medicine at all.

So the public side of a pharmacy keeps a stricter habit than a bakery needs: its words never confirm who its customers are, even when a customer has said it themselves. Which privacy rules apply to a pharmacy's public words, and what they require, differs by jurisdiction. This page is about habits, and your counsel is the one to say what the rules add to them.

The platforms point the same way. Google's Business Profile guidelines, read on the day of writing, bar content that contains "private or confidential information", with sensitive records among their examples, and they allow a business to post its own contact details in response to reviews. That allowance is the tool this page leans on.

What never appears on the public side

• A customer's name, initials or photo beside anything about their visit, their order or their care.
• Any confirmation that a person is, or was, a customer, including in a reply to that person.
• The prescriptions, medicines, conditions, test results or vaccinations of anyone who could be identified, however the pharmacy came to know them.
• Delivery addresses, and photos of bags, labels, screens, prescription forms or anything else with a customer's name on it.
• Stories that begin "a customer came in with", even with the name left out, when the details could point to one person.
• Screenshots of messages, emails or chats with customers.

The last two catch careful people. A story with no name in it can still be recognized by the people who live on the same street, and a screenshot carries details its sender never meant to publish. One question settles a draft: could anyone who knows this person tell that it is them? If the answer is yes, or maybe, the draft does not go out.

Replying to a review without confirming anything

A pharmacy's reply does not follow the reviewer's lead. Even when a reviewer writes about their own prescription, the reply leaves it out: no "your prescription", no "your visit", no "your medicine", no date and no detail. It thanks them, states a fact about the pharmacy if one helps, and gives the pharmacy's own contact for anything more, which is what Google's guidelines allow a business to post in a review reply.

Handle what happened in private, under the pharmacy's own procedures, and ask counsel whether anything about it has to be reported or recorded elsewhere. None of that belongs in the reply. A reply that argued the facts in public would have to state them, and stating them is the one thing the reply is there to avoid.

Testimonials: written consent, and never an outcome

A testimonial is a customer's words the pharmacy chooses to publish, so it goes up only with the customer's written consent, recorded with the date, the exact words, where they will appear and how to withdraw them. It speaks about the service, never about a result: the delivery came when the pharmacy said it would, the pharmacist explained the pickup times, someone at the counter spoke the customer's language. Nothing about how a medicine worked, how someone feels, or what a treatment did.

The name appears only as the customer agreed, and a withdrawal takes the words down everywhere they were used, posts and newsletters included. Whether consent needs a particular form where you operate, and whether anything touching health can appear in a testimonial at all, are questions for your counsel before the first one goes up.

Reviews quoted from a platform onto your own site follow the same line. Quote only reviews that say nothing about the reviewer's health, medicines or conditions, and ask counsel whether you need the reviewer's permission. Keep ratings out of your review schema and the rest of your structured data: under Google's review snippet rules, a business that controls the reviews about itself is ineligible for review stars, and ratings from other websites are not to be aggregated.

Photos, posts and questions asked in public

A photo of the pharmacy goes up once nothing in the frame belongs to a customer: no faces in the queue without consent, no bags or labels on the shelves behind the counter, no screen, no prescription lying on the counter. Staff appear with their own consent, named as they agree. The same check applies to every post, including the ones that feel harmless, such as a busy morning or a delivery on its way.

Questions asked in public need the same care. When someone asks on your Business Profile or a social page about their own prescription or order, the public reply stays general and the rest moves to a private channel: "We don't discuss anyone's order here, but we'd be glad to help: call [number] or come to the counter, [hours]." Never ask for details in public; the Business Profile guidelines rule out soliciting personal or confidential information in the first place.

Each of these posts and replies is also a brand mention the pharmacy wrote about itself, public for as long as it stays up. Before one goes out, it passes the check in the list above, and anything in it about a service goes through the pharmacist's review routine as well.

What the public pages state instead

The pages have a great deal to say without a word about any customer. Facts about the pharmacy give an answer something true to repeat, and none of them involves anyone's health.

Link the pharmacy's privacy notice from the footer of every page, and say how a customer reaches the pharmacy privately: the phone line, a contact form that goes to the pharmacist in charge, the counter's hours. That is the only place the public pages speak about customers at all, and they speak about all of them the same way. The facts to state, from hours to the delivery area, languages and access, are laid out in the overview for pharmacies and in the facts that belong to one address.