Dental clinic website rules in Spain: two decrees, and the one everyone miscites

If you run a dental clinic in Spain, your website is not just marketing. Legally it is health advertising, and it is governed by rules that most web providers cite incorrectly, including one obligation that almost the entire sector attributes to the wrong decree.

I write websites for dental clinics, so I have read the actual texts on the BOE rather than the summaries that circulate between agency blogs. Here is what the rules genuinely say and what that means for how your pages are written.

Two decrees, not one

Two state regulations apply to your website at the same time, and confusing them is the source of nearly every mistake:

RD 1907/1996 governs what you may claim: no promised results, no patient testimonials as inducement, no unproven therapeutic effects.

RD 1277/2003 governs identification: it requires your registry number in your advertising and limits your advertising to your authorised services.

Both are still in force. Both are basic state legislation. And, as a small trap that catches people out, both have an article 6.2 saying different things. Always name the decree.

What you cannot say: RD 1907/1996

Article 4 lists the prohibitions. Four hit dental websites directly:

• No guarantees of relief or certain cure (article 4.4). Any wording promising an outcome is a problem, however softly phrased.
• No testimonials as an inducement to consume (article 4.7). This covers testimonials from health professionals, from famous or publicly known people, and from real or supposed patients. That last limb is the one most clinic sites get wrong.
• No claimed preventive or therapeutic effects not backed by evidence expressly recognised by the state health administration (article 4.16).
• Article 5 prohibits health professionals from lending their name, profession or position to back the promotions covered by articles 2 and 4.

Its article 6.1 adds that a health centre's advertising must conform to the content of its health authorisation, and 6.2 that any other advertising requires prior express authorisation from the health authorities. Breaching articles 4, 5 or 6 is a serious infringement under article 8.2.

Testimonials and reviews are not the same thing

A testimonial is content you publish as advertising: a patient quote you selected, edited and placed on a treatment page to persuade someone to book. That is what article 4.7 restricts.

A review is something a patient writes on their own account on a third-party platform, on their own initiative. That is not you advertising, and it is governed by that platform's rules. If you work on reviews, the constraints to know are Google's 2026 review policy, which bans incentives and selective solicitation for everyone.

Displaying genuine reviews is reasonable. Lifting patient quotes into your own advertising copy to induce bookings is what to avoid.

The registry number: a national obligation that almost everyone miscites

This is the point the sector gets wrong most often, and I include myself: I accepted the wrong version of it before going to the source text.

What you read everywhere is that the obligation to display your health registry code comes from RD 1907/1996. It does not. I read that decree's consolidated text article by article and it never mentions registry codes or colegiado numbers.

The obligation is real, it is national, and it lives in article 6.2 of RD 1277/2003, which states that only authorised health centres, services and establishments may use terms in their advertising suggesting any kind of health activity, without misleading, limiting that advertising to the services and activities they are authorised for, and must state in that advertising the registry number granted by the health authority of the relevant comunidad autónoma when it issued their operating authorisation or their specific health advertising authorisation.

Three things make this inarguable for a dental clinic:

• RD 1277/2003 is basic state legislation under article 149.1.16 of the Constitution (first final provision), so it applies across Spain.
• It applies to all health centres, public and private, of any class or nature (article 1.2).
• Its Annex I lists C.2.5.1 Clínicas dentales explicitly as a category of health centre.

So where does the regional confusion come from? From the number itself. As the article says, it is granted by your own comunidad autónoma's health authority. A Barcelona clinic and a Madrid clinic display different codes from different registers, which makes the obligation look regional when it is not. Regions then restate and develop it in their own rules: in Catalunya, article 4.3 of Decreto 151/2017 repeats the requirement and adds that any other advertising must be authorised in advance.

The accurate version, then: the obligation is national, the number is regional. And if a provider tells you this comes from RD 1907/1996, they have not read either decree.

Article 6.1 of the same decree also requires authorised centres to display a visible distintivo on the premises showing they hold authorisation and what type of centre they are.

Before and after galleries

A frequent question, and my answer is that I avoid them.

A before and after gallery sits very close to promising a result, which is what article 4.4 prohibits. The gap between showing a past outcome and implying a future one is thin, and an inspection reads it unfavourably. There are better ways to show competence: explain the process honestly, give real durations, show the clinic and the team.

If you do use clinical images, you need documented, express and informed patient consent, and they must not suggest an expected result. Patient images are also health data, which brings the next point.

Health data is not an ordinary contact form

Patient data is a special category under article 9 of the RGPD. A booking form or first-visit questionnaire capturing a reason for consultation is collecting health data, and that carries obligations well above a normal contact form: a lawful basis under article 9, minimisation, encryption, access control and a processor contract with anyone handling it for you.

The practical consequence is a design decision. A clinic website should collect the minimum needed to book an appointment, and clinical history belongs in your practice management software, not your website's database. A small studio should not be custodian of clinical records, and I do not build sites that are.

What this means for your pages

A compliant dental site tends to look like this: your registry number stated in your advertising, website included; one page per treatment describing the process, real duration and what is included, without promising outcomes; prices, if shown, complete and genuinely applicable rather than a hook; services limited to what your authorisation covers; and a booking flow collecting the minimum.

None of that weakens the site commercially. Explaining a treatment properly is what ranks and what reassures, and it happens to be what the rules ask for.

If you want the detail on how I apply this to a clinic, it is on the web design for dental clinics page. The same tension between professional rules and marketing appears in other regulated sectors: I covered the equivalent for law firms in website and SEO for lawyers, and general investment ranges are in how much a website costs in Spain.

Sources

• BOE, Real Decreto 1277/2003, de 10 de octubre, consolidated text (BOE-A-2003-19572), article 6.2 on stating the registry number in advertising, article 6.1 on the visible distintivo, article 1.2 on scope, article 5.4 on the public register, first final provision on its basic character, and Annex I (C.2.5.1 Clínicas dentales), checked September 2026 [T1]
• BOE, Real Decreto 1907/1996, de 2 de agosto, consolidated text (BOE-A-1996-18085), articles 4, 5, 6 and 8, checked September 2026 [T1]
• DOGC, Decreto 151/2017, de 17 de octubre, article 4.3, on health centres in Catalunya including their registration code in their advertising, checked September 2026 [T1]
• Reglamento (UE) 2016/679 (RGPD), article 9 on special categories of personal data, checked September 2026 [T1]
• Google, Prohibited & Restricted Content, reviews policy (support.google.com/contributionpolicy/answer/7400114), checked September 2026 [T1]