Aesthetic-medicine and med-spa advertising on social media is legal across the European Union, but it is tightly framed: communication about medical services must be informational, not promotional. You can state who your practitioners are, their qualifications, the treatments you offer and what they cost — but suggestive before/after transformations, patient testimonials used as endorsements, and identifiable patient images published without explicit consent all sit outside that line and expose the clinic to sanctions.
This guide covers the informational-not-promotional principle, the specific risk of before/after content and testimonials, how GDPR governs patient images as health data, the outer limit EU law places on advertising bans, and how to run user-generated and messaging content without crossing into prohibited promotion.
Informational, not promotional
Across the EU, medical advertising is regulated at member-state level, but a shared logic runs through it: a clinic may inform the public, not entice it. Generally permitted: factual descriptions of qualifications and specialisations, the nature of a treatment, the team, and transparent pricing. Generally restricted or prohibited: claims that guarantee a result, language that creates illusory expectations, discount- and offer-led framing that pushes people toward a procedure they may not need, and anything that trades on fear or vanity rather than fact. The exact wording differs by country, so validate your specific market before you publish.
Before/after images are the highest-risk format
Before/after content is the single most common way med-spas drift from information into promotion. A transformation image implies a guaranteed outcome, which no clinician can promise, and it feeds unrealistic expectations in a viewer who has not been examined. In several jurisdictions such imagery is treated as misleading or suggestive advertising unless it carries genuine clinical context. The safe operational rule for a clinic marketing across markets is simple: avoid suggestive before/after in paid and public content, and never present an individual result as a typical one.
Testimonials turn a patient into a marketing tool
Patient testimonials used as endorsements are treated as promotional, not informational, in most European frameworks — and consent does not cure the problem. A testimonial instrumentalises the patient, converting a care relationship into a sales asset, and it invites the same guaranteed-result inference as before/after imagery. Endorsements of products or treatments by identifiable patients are among the first things a regulator or professional body will flag.
Patient images are health data under GDPR
This is the one rule that is genuinely uniform across the EU. Any image or video from which a patient is identifiable, tied to a treatment, is special-category health data under Article 9 GDPR. Three consents are distinct and must not be conflated: consent to the treatment itself; the lawful basis for processing data to deliver care; and — separately — explicit consent to publish or diffuse the image, which must be free, specific, informed, unequivocal and documented. Treatment consent is never enough to post someone's face. Publishing identifiable patient content without that separate diffusion consent is the most frequently enforced failure on social, and Article 9 makes it high-exposure: GDPR's statutory ceiling is 20 million euro or 4% of global turnover — a maximum, not a routine fine, but a measure of how the law rates the risk.
EU law: you cannot be banned from advertising outright
Clinics sometimes over-correct into silence. EU law does not require that. In Vanderborght (C-339/15, 2017) the Court of Justice held that a general and absolute ban on advertising healthcare services is contrary to EU law — while confirming that member states may legitimately regulate the content and form of that advertising on public-health and dignity grounds. The takeaway: you are entitled to advertise; you are not entitled to advertise promotionally. Build on that boundary rather than avoiding the channel.
Running compliant UGC and messaging content
The following is best practice grounded in the rules above, not a regulator-issued checklist — confirm specifics with counsel and your data protection officer. Prefer content with no clinical-result claim and no recognisable patient: the team, the space, how a consultation works, factual explanations of a treatment. Gate any identifiable patient footage behind separate, written, revocable diffusion consent that names the exact channels. Drop the promotional triggers: no before/after, no discounts or promo codes, no guaranteed-result language, no testimonials as endorsements. Keep claims factual: who you are, your qualifications, what the service is, and transparent pricing. Treat private messaging as lower-exposure but not exempt — a one-to-one channel reduces public reach, but any patient photo or message you re-use for marketing still needs diffusion consent, and health data in chat needs a lawful basis and adequate security.
For clinics that want creators making that kind of factual, patient-free content — and a compliant way to run patient conversations at scale — TikJoy keeps UGC on the creator's own profile and operates messaging through the official WhatsApp Business API; the constraints for regulated verticals are set out in the compliance hub.
When social advertising is the wrong choice
For some practices, the honest answer is that paid social is not worth it. If your best-performing content historically relied on dramatic before/after reveals or patient stories, a compliant feed will convert worse, and forcing it can push a team back toward risky creative. Highly regulated or complex procedures, small local practices whose growth comes from referral and reputation, and clinics without the internal capacity to manage consent documentation are often better served by informational search content, a strong reputation footprint and in-person consultation than by chasing reach on social.
This is general information, not legal advice
Medical advertising and GDPR compliance are fact-specific and vary by country. Validate any specific creative, consent form or campaign with a lawyer specialised in healthcare law and a data protection officer before publishing.