Your Agency Wrote It. Your Name Is On the Notice.
Who actually carries a clinic's advertising when a contractor wrote it — in Australia and in New Zealand. The answer is not what most operators assume, and in one of those countries it is close to the opposite.
Most clinic owners have not read their own website in about two years. They approved a draft once, the agency shipped it, and it has been quietly selling ever since. Somewhere on it is a sentence they did not write, cannot remember approving, and would not defend if asked to.
That sentence is the one that matters, because when a regulator looks at a clinic's advertising, it does not ask who typed it.
The assumption almost everyone makes
The reasoning feels sound. You are not a copywriter. You hired professionals precisely because they know this better than you do. You paid them. They wrote it. If it is wrong, that is on them — that is what you were buying.
It is a completely reasonable assumption and it is wrong in both countries, for two different reasons. Australia is the blunter of the two.
Australia — hiring the agency is part of what makes you the advertiser
Ahpra publishes Guidelines for advertising a regulated health service. They define the advertiser, and the definition does the work:
“The person or entity who controls part or all of the advertising (i.e. who authorises the content) is the advertiser. An advertiser has control of the advertising if: they publish or authorise content or direct someone to publish or draft content (including a third party, staff member or marketing agency)…”
Read that twice. Directing someone else to draft your content is not a way out of being the advertiser. It is listed as one of the things that makes you the advertiser. The next sentence closes the door:
“Advertisers are responsible for their advertising, so they need to check any content produced by others on their behalf.”
And on a clinic's own website specifically, the guidelines do not leave it to inference:
“The clinic business owner or practitioner (that is, whoever has control over the website) is responsible for compliance.”
The guidelines note that a court or tribunal may consider them when hearing advertising offences against section 133 of the National Law. And the obligation is not limited to registered practitioners — the guidelines state that anyone advertising a regulated health service must comply, including individuals who are not registered and body corporates.
What it carries
Ahpra states the financial penalties as a maximum of $60,000 per offence for an individual and $120,000 per offence for a body corporate. Where a breach involves unlawful use of a protected title, the maximum is a financial penalty of up to $60,000 per offence, imprisonment for up to three years per offence, or both.
Note the four words doing the most work: per offence. This is not one penalty for one website.
And note when it changed. Ahpra records that the National Law was amended in 2022 to increase the maximum penalty for advertising offences, and that as of July 2024 the increased penalties apply in all jurisdictions. The previous maximums were $5,000 and $10,000. The market's instinct about the stakes is calibrated to a number that was replaced four years ago.
Source: Ahpra, Guidelines for advertising a regulated health service, and Advertising and the law (page reviewed 2 September 2025). Quotations verified against the published guidance on 11 August 2026.
New Zealand — the agency is caught too, and it changes nothing for you
New Zealand takes a different route and arrives somewhere more uncomfortable. Section 57(1) of the Medicines Act 1981 reads:
“No person shall publish or cause to be published, either on that person’s own account or as the agent or employee of the person seeking to promote the sale, any medical advertisement that—”
So the agency is not outside the provision. “As the agent… of the person seeking to promote the sale” reaches them directly, and section 58 is broader again — it catches a person who publishes, or causes or permits to be published.
Which sounds, for a moment, like good news for the clinic. It is not. The words reach both of you. Only one of you holds the registration, signed the lease, and answers the phone when someone asks who is responsible.
Shared exposure is not halved exposure. It is the same exposure, arriving at two addresses, and only one of those addresses is your business.
What it carries
If you were hoping the number would do the persuading, it will not. The Act's general penalty is imprisonment for a term not exceeding three months or a fine not exceeding $500, with a further fine not exceeding $50 for each day a continuing offence continues.
The fine is not the exposure. Section 79 is. It is headed Liability of principal for acts of agents, and it says:
“Where an offence is committed against this Act… by any person acting as the agent or employee of another person, that other person shall, without prejudice to the liability of the first-mentioned person, be liable under this Act in the same manner and to the same extent as if he had personally committed the offence.”
Your agency writes it. You are liable as if you wrote it yourself. That has been the law in New Zealand since 1981.
Section 79(2) gives the way out, and it is worth reading closely, because it is the whole argument for doing something today: it is a defence if the defendant proves the offence was committed without his knowledge and that he took all reasonable steps to prevent it. Not knowing is half a defence. The other half is what you did about it before anyone asked.
Source: Medicines Act 1981 (NZ), ss 57(1), 58(1), 78 and 79. Quotations taken from the current version on the New Zealand Legislation website, 11 August 2026.
“Liability may be shared. Consequence isn't. The agency's exposure is a line item. Yours is the business.”
Five things most operators believe aren't on them
This next part is Australian, because Australia is where the misunderstanding is deepest and the vocabulary rules are hardest. Each of these is a sentence we have heard from operators who were being careful, not careless.
“We stopped naming the brand. We say ‘wrinkle reducing injections’ now.”
That switch is the most common fix in the industry, and the TGA has addressed it directly. Its guidance states that it no longer expressly permitsreferences to terms such as ‘wrinkle reducing injections’ or ‘dermal fillers’ where those terms would result in a reasonable consumer understanding that the intention of the content is to promote the use or supply of a prescription-only medicine. The euphemism is not automatically safe. What matters is what a reasonable consumer takes it to mean.
“We only use the nickname. Everyone does.”
The TGA names this too, and the list is broader than most people expect. The restriction covers references made “through acronyms, nicknames, abbreviations and hashtags, which may be taken by a consumer as a reference to a specific prescription-only medicine or substance.” A hashtag is a reference. So is the three-letter version everyone in the clinic uses.
“Those posts are from 2019. Nobody sees them.”
The TGA's answer is short: “Due to the nature of social media posts and their ready accessibility to consumers regardless of the date posted, all social media posts, historical and new, are required to comply with the requirements.” The archive is not the past. It is a live shelf, and it is still selling.
“A patient wrote that review. I didn't say it.”
This one has a genuine split in it, and almost everyone gets the wrong half. Ahpra's position on a review platform you do not control is that advertisers “are not responsible for removing (or trying to have removed) testimonials published on platforms they do not control” — the owner of that platform is. So no, you are not expected to police what a stranger typed into Google.
But two things sit the other way. A review republished on your own website is yours: “The clinic business owner or practitioner (that is, whoever has control over the website) is responsible for compliance.” And on that third-party profile, Ahpra notes the clinic “may have control over other content on the third-party site and would be responsible for ensuring that content complies”. The reviews aren't yours. The profile they sit on is.
“If it were really a problem, someone would have told us.”
Somebody may be about to. But the more useful test is one you can run yourself in about a minute, and it does not require anyone's permission.
Search for your clinic and a brand name together. If you rank, the word is on a surface you control — your site, your profile, your posts — because that is the only way a search engine could have associated the two. Ranking for a term you are not permitted to use in advertising is not a marketing win. It is a receipt.
“Ranking for a word you're not allowed to advertise isn't a marketing win. It's evidence, indexed and timestamped, that the word is on a surface you control.”
There is one more thing worth knowing, because it explains why so many careful operators are still wrong. Asked for a list of acceptable substitute terms, the TGA declines to give one — its guidance says it cannot advise in specific terms what can be done by industry or provide a list of ‘acceptable’ terms. There is no safe-list to copy. Which means the clinics passing this around between themselves are passing around guesses.
Why the page explaining this is so hard to find
Search for a plain answer to any of this and you will find regulator guidance, law firm articles pitched at other lawyers, and very little written for the person who actually has to act on it. There is a structural reason for that, and it is worth understanding because it explains the whole information gap.
The New Zealand Act defines an advertisement as words “used or appearing to be used to promote the sale of medicines or medical devices or the use of any method of treatment”. The restriction turns on purpose, not vocabulary. A clinic's services page naming a prescription medicine is promoting the sale of something that clinic sells. An article naming the same medicine in the course of explaining what the rules require is not doing that at all.
The consequence is a strange market. The operators who most need this explained plainly are the operators least able to publish the explanation — because the moment they write it on their own site, in among the treatments they sell, its purpose changes. So the guidance that exists is written by regulators for compliance officers, and by lawyers for other lawyers, and almost nobody writes it for the owner.
Two different problems that look identical from the outside
When a clinic finds a problem in its own advertising, it is almost always one of two things, and telling them apart decides everything about the fix.
Execution problems live in the words. A claim that overstates. A testimonial that should not be there. A medicine named without what has to sit alongside it. Somebody wrote a sentence that should have been written differently, and rewriting the sentence genuinely fixes it.
Foundation problems live in the arrangement. Who administers, under whose authority, on what documented basis. Whether the person injecting on Thursdays is operating under a prescriber who has actually seen the patient. Whether the contractor model that looked like flexibility has quietly parked an obligation on one person who never priced it.
From outside, both show up as words on a page. That is the trap. A rewrite makes an execution problem disappear and makes a foundation problem invisible — the sentence goes away, the arrangement underneath it does not, and the clinic now believes it has dealt with something it has only stopped mentioning.
“You can't market your way out of a business problem. Rewriting the page is not the same as fixing what the page was describing.”
What a careful operator does about it
Read your own site as a stranger. Not the homepage — the treatment pages, the booking flow, the about page where staff are described, the footer that has not been touched since launch. Most of what causes trouble is not on the page anyone looks at.
Find out who actually controls each surface. Your site, your Google Business Profile, your ads, the booking platform, the social accounts an ex-employee still has the password to. Control is the test that decides who the advertiser is, and most owners have never mapped it.
Put review in the contract, not in good intentions. If someone drafts on your behalf, the obligation to check what they produced is yours in Australia by definition. That is a process, and it either exists or it does not.
Separate the two problems before you pay anyone to fix either. A copywriter cannot resolve a question about authority to prescribe. An operating-model conversation will not rewrite your treatment page. Buying the wrong one is how clinics spend money and stay exposed.
Test it rather than assume it
Everything above is checkable, and you do not need to take anyone's word for what is on your own site. There is a free automated check for Australian clinics that reads your public pages against published regulator guidance and shows you the areas worth reviewing — including whether prescription-medicine vocabulary is sitting somewhere you had forgotten about.
It returns indicators, not verdicts, and it separates the findings a rewrite can move from the ones it cannot. Ahpra's guidance says advertisers need to check content produced by others on their behalf. In New Zealand, the defence under section 79(2) turns on having taken reasonable steps. Both of those are describing the same act, and it is the one nobody schedules.
Run the clinic advertising check →This article describes what published regulator guidance and primary legislation say, and names the regulators involved. It is not legal advice, it does not assess any particular business's position, and it is not a substitute for advice from a qualified lawyer. Quotations were verified against their primary sources on 11 August 2026; legislation and guidance change, and the version in force when you read this may differ.