Testimonial Compliance: How To Ask Safely
Your clients have already said the words. You just haven't asked permission to use them yet.
Your clients have already said the words. You just haven't asked permission to use them yet.
Sitting on earned social proof is a choice practices often make by accident, and the paperwork standing between you and your clients' words fits in a single short email.
Your inbox is doing a filing job it was never meant to do. Between appointment confirmations and a promotional email from a supplement brand sits a message from a client who told you, in plain English, your work changed something for them.
You read it. You felt good. You left it there.
Practices holding those messages in private threads are making an active decision about their own visibility - they're just not aware they're making it. The words exist. The sentiment is real. The only thing between that message and your website is a single consent request you haven't sent.
Practices often accumulate a small, private archive of unpublished praise across email, WhatsApp, and voicemail.
Every single one of those is a candidate. The quote is fine. The request is the problem. And the request is the part you can fix this week.
"The words are already there. The practice just hasn't moved them yet."
Those unasked permissions are stamped letters on the hall table.
Wellness marketing guides: practical guidance on this topic:
Resonant issues: challenges nearby to this:
A client sends a warm message on a Monday. You think: lovely, I should follow that up properly. By the next session block you're buried. A week later the moment has cooled to room temperature and asking feels slightly odd, like bringing up a compliment paid to you three weeks ago at a dinner party.
A written consent request sent within 48 hours of a client expressing gratitude converts at a significantly higher rate than one sent cold, weeks after the moment has passed. Human warmth works on a timer. The feeling is fresh. The willingness is present. You're meeting a situation already in progress.
The follow-up doesn't need to be elaborate. A short reply to the original message, or a brief standalone email, is enough. Something along the lines of: "What you shared meant a great deal - would you be comfortable with me using your words on my website? I'll send a simple consent form." That's it. That's the whole ask.
Practices waiting for the perfect moment tend to find it never quite arrives. The right moment is usually the one you're already standing in.
A timely ask is a kettle already at the boil - the conditions did the work.
Here is what GDPR says about client testimonials: document your consent. Full stop.
The regulation carries a reputation for complexity it has done nothing to earn. Practices across therapy, coaching, and complementary health have decided it means "keep a solicitor on speed dial before touching anything client-related." A more precise reading of the law is considerably less dramatic.
GDPR asks you to record your client's agreement - their words, the form, the purpose. A short, clearly worded email template satisfies this completely. You send it. They reply yes. You keep the reply. Done.
"Documented consent is a short email and a saved thread."
Your consent request should cover three things:
A practice templating this once and saving it to the drafts folder has completed its testimonial compliance work in full. One afternoon. One document. Used indefinitely.
The folder is called something like "Client Comms - Consent" and cost twenty minutes to build. A single drawer in the kitchen - and this one actually makes sense.
Some practices decide - quite reasonably, at first - they'd like professional legal guidance before collecting testimonials. Sensible instinct. The trouble is "professional legal guidance" has a way of becoming a prerequisite in permanent pencil, and the testimonials stay unasked for while the to-do item ages in the notebook.
Practices going directly to the ICO guidance - free, plain English, online right now - tend to send their first consent request within a week. Practices routing through a solicitor tend to wait considerably longer. Sometimes indefinitely. The clinic fills with a kind of ambient compliance anxiety achieving nothing in particular.
The ICO publishes clear guidance on consent and legitimate interest for small organisations. Reading it takes about twenty minutes. It answers the questions most practices are sitting with.
The guidance is public. The barrier is invented. The anxiety around client confidentiality is real and worth respecting - the solution, however, is already published and waiting.
Reading the ICO guidance is checking the thermostat - the answer was always there.
Many practices hold back from publishing testimonials over uncertainty about how much identifying information they can include. The position most land on: include nothing, publish nothing, wait for clarity.
Clarity is already here. A testimonial published with no client name, location, or identifying detail carries the same social proof weight as a named one. Prospective clients reading your website read the words. They decide whether those words sound like something a real person felt.
"First session in, I finally felt heard." - Client, London
"I came in burnt out and left with a plan." - Client, online session
Both of those carry weight. The consent threshold for an anonymous quote runs lower, too - because the client has less to weigh before saying yes.
Most clients who've had a good experience want their words to help the next client through the door. Anonymity removes the last small hesitation. You ask, they say yes, the quote goes up.
An anonymous testimonial on your website is a well-placed lamp in a dark hallway.
Front of mind: some of our thinking on this topic:
Here is where the theory becomes an afternoon.
A compliant testimonial consent request takes under thirty minutes to draft. The first eligible client can receive it before you close your laptop. A written consent record can be on file before the next session block ends. A new system, a new tool, and a new subscription play no part in this whatsoever.
Here's the structure of the email:
Five elements. One email. Sent once, templated forever.
The reply - "yes, happy for you to use it, anonymous is fine" - is your consent record. Save it. Keep it in a folder. The folder is your testimonial compliance system, complete.
Practices treating this as a project to be planned find it stays a project. Practices treating it as an errand find it done.
A drafted email in your outbox is a packed bag by the front door.
Practices running a single testimonial push - collect what comes in, move on - usually end up with a small clutch of quotes ageing visibly on the website. The language starts to feel slightly historical. The clients have long since finished working with the practice. New visitors read the praise and wonder when exactly it was written.
Practices treating testimonial collection as a rolling process accumulate five to eight usable quotes per year from an average caseload. A habit, not a campaign. Ask when the gratitude arrives. File the consent. Refresh the website twice a year. The process runs on the work already being done.
A sustainable rhythm looks something like this:
A campaign, a spreadsheet with seventeen columns, and a quarterly review meeting with yourself over a sad desk sandwich - all optional, all unnecessary.
The ongoing model keeps social proof current on the energy the work itself generates - the only kind of marketing engine a practice can actually sustain for the long run.
A rolling testimonial habit is a well-stocked record shelf - always something current, always something worth putting on.
Explore other disptahces in this area further:
Your clients' words are already earned. A short email - written faster than a session note - is the whole distance between those words and your website. Book a discovery call and we'll walk you through a compliant consent process you can use this week.
≡