Picture this: your assistant writes to a patient on WhatsApp to confirm tomorrow’s appointment. A kind gesture, good customer service, right?
Now imagine that patient never gave you written authorization to contact them through that channel. And that someone —an upset former employee, a competitor, a dissatisfied patient— files a complaint with the Superintendence of Industry and Commerce. The penalty for processing sensitive data without consent in Colombia can reach COP $2.8 billion.
This is no exaggeration. It’s in Law 1581 of 2012, Article 5: health data is “sensitive data” and requires explicit, informed and prior consent. Most clinics and medical practices in Colombia are one WhatsApp message away from a fine that could end their business.
But here is the paradox: the Colombian patient of 2026 looks for a doctor online. According to the Ministry of Health, there are more than 50,000 providers registered in the REPS. Of those, only 15% have a professional digital presence. The rest have —with luck— an outdated Google profile with an old phone number and a pixelated logo.
If you know you need patients from the internet but don’t know where to start without getting into legal trouble, this guide is for you.
Regulation first: why medical marketing in Colombia isn’t like any other
Selling shoes on Instagram is one thing. Promoting a clinic is something completely different.
In Colombia, medical marketing has two overlapping legal layers that 90% of digital marketing agencies blithely ignore. The first is Law 1581 of 2012, the Personal Data Protection Law, which classifies health data as sensitive and requires explicit consent for any processing —including storing a mobile number to send reminders.
The second is Law 23 of 1981, the Code of Medical Ethics, which in articles 29 and 30 expressly prohibits three things that are the bread and butter of conventional marketing: promising results, comparing yourself with other colleagues or institutions, and mentioning prices in advertising.
This means phrases like “we are the best urologists in Medellín”, “we guarantee results from your surgery” or “consultations from COP $80,000” can trigger anything from an investigation by the Medical Ethics Tribunal to the suspension of a professional license. This isn’t theory: in 2023, the National Medical Ethics Tribunal reported a 40% increase in complaints related to medical advertising.
What few people understand is that this regulation doesn’t prohibit digital marketing. What it does is set the playing field. You can have an online presence, attract patients and even scale your clinic. You just need to know which channels to use, how to communicate without promising and where the red lines are. That is exactly what we do at Gulupa Digital for clients such as the Arquidiócesis de Medellín —organizations that handle sensitive data for 21 schools and 35,000 people without a single regulatory incident.
Google Business Profile: your real first impression
If you have a clinic or medical practice in Colombia and haven’t optimized your Google Business Profile (formerly Google My Business), you have a more urgent problem than not having a website.
Nine out of ten patients in Colombia look for health services like this: they open Google, type “dentist near me”, “urologist Medellín” or “pediatrician in Bogotá”, and call one of the first three results that appear. They don’t go to page 2. They don’t compare 15 options. They look at photos, read one or two reviews and call.
What appears in that profile is your first impression. And if it’s outdated —an old phone number, a wrong address, no photos of the practice or, worse, a negative review with no reply— that potential patient has already gone to the competitor whose profile is up to date.
Optimizing a Google Business Profile for a clinic involves four concrete things:
First, fill in absolutely every field: the main category (e.g. “Dental clinic”), secondary categories (“Teeth whitening”, “Orthodontist”), exact hours including Saturdays if applicable, services with descriptions, and a link to book an appointment.
Second, real photos of the practice. Not stock photos of smiling doctors who don’t work there. Patients can smell fake. Photos of the waiting room, the consulting room, the team (with their permission) and the building front so people can find you easily.
Third, answer every frequently asked question in Google’s Q&A. “Do you accept Sura?”, “How long is a consultation?”, “Do you see children?” If you don’t answer that in your profile, someone else will —and not necessarily with the right information.
Fourth, post weekly. Google Business allows posts as if it were a mini social network. An article on dental hygiene, the announcement of new equipment, special December hours. This tells Google your profile is active and improves your position in the “local pack” —the three listings with a map that appear before the organic results.
If all this sounds like a lot of work, we have a solution: at Gulupa Digital we optimize and manage Google Business Profiles for clinics. See how it works at gulupadigital.com/en/seo-positioning/.
Local SEO by specialty and city: what actually works in healthcare
The searches that bring in patients aren’t “best clinic in Colombia”. They are searches like “ENT that accepts Sura in Envigado”, “maxillofacial surgeon Bogotá prices” or “at-home obstetric ultrasound Cali”.
That is local SEO applied to healthcare, and it works differently from conventional SEO. Here you don’t compete for traffic volume. You compete for the intent to book an appointment.
68% of patients who run a local search on Google end up contacting the provider within 24 hours, according to Think with Google data. If your clinic isn’t optimized for those searches, the patient simply doesn’t know you exist.
A local SEO strategy for medical practices is built on three pillars:
Service pages by specialty and city. A single “Services” page isn’t enough. You need a specific page for each specialty with the city in the title: “Endodontics in Medellín”, “Smile design in Envigado”, “Dental implants in El Poblado”. Each with real content written or reviewed by the specialist —Google rewards real experience (the first pillar of E-E-A-T: Experience, Expertise, Authoritativeness, Trustworthiness).
Medical schema markup. It’s the language that talks to Google in its own terms. With a correctly implemented MedicalOrganization or Physician schema, Google understands that you are a real healthcare entity: your specialty, your medical registration, your location, your hours. This is especially relevant now that LLMs such as ChatGPT, Perplexity and Google AI Overviews are recommending healthcare providers based on structured data.
Educational content that demonstrates authority. An article on “how to know if you need orthodontics” or “what to expect after a tooth extraction” attracts patients who are researching before deciding. You don’t promise results. You don’t compare yourself. You simply educate. And when that person decides to book, they already trust you.
The difference between doing this well and doing it halfway can mean going from 3 new patients a month from the internet to 30. If you want us to review your specific case and show you where the opportunities are, book a free strategy call at gulupadigital.com/en/seo-positioning/.
Meta Ads with geographic targeting: what you can and can’t do
Meta (Facebook and Instagram) can be a gold mine for a clinic or medical practice in Colombia. It can also be the channel that gets you into trouble with the Medical Ethics Tribunal. The difference lies in how you set up the campaigns and, above all, in what your ads say.
What you CAN do in Meta Ads for a clinic:
- Target by geographic location with a precision of 1 km around your practice
- Create audiences based on health-related interests: “interested in dental health”, “interested in aesthetic medicine”
- Show your facilities, your team, your technology
- Educate with content: “5 signs you need a dermatology check-up”
- Promote health days or preventive services
- Use video so the patient gets to know the doctor before the visit
What you CAN’T do:
- Use testimonials from real patients without their explicit written consent (and even with it, avoid cases where medical results can be inferred)
- Show before-and-after photos without authorization — and be careful, because even with authorization these images can be interpreted as a “promise of results”
- Claim “we are the best”, “the only ones”, “we guarantee”
- Include prices in the ad (Law 23 prohibits it)
- Retarget based on health conditions (Meta has specific restrictions for health)
The campaign structure that works best for clinics in Colombia is simple: an awareness campaign (local reach, educational content), a consideration campaign (a video of the specialist, a tour of the facilities) and a conversion campaign (a direct message to WhatsApp or a booking form).
The message that converts isn’t “book your appointment today”. It’s “have you been putting off that appointment for months? Write to us on WhatsApp and we’ll help you sort it out in 15 minutes”.
At Gulupa Digital we handle full digital marketing for clinics and medical practices —from the website to paid media, with regulatory compliance included. If you want to see how we would do it in your case, write to us and we’ll share examples of campaigns that comply with Colombian regulations.
WhatsApp Business: confirmations, reminders and the thin legal line
WhatsApp is by far the most effective channel for clinics and medical practices in Colombia. 94% of Colombians with a smartphone use WhatsApp. It’s where your patients already are. But it is also the most dangerous channel from a legal standpoint.
The difference between a clinic that uses WhatsApp well and one at risk of a penalty comes down to consent. If a patient gives you their number on a contact form with a checkbox that says “I authorize the processing of my personal data and agree to be contacted via WhatsApp”, you are covered. If you took the number from the medical record and wrote to them without asking, you are in trouble.
With proper consent, the WhatsApp Business API lets you automate three flows that transform a clinic’s operations:
Automatic appointment confirmation. The patient books through your website or by phone and immediately receives a WhatsApp message confirming the date, time, specialist and location. You attach a map. You ask whether they need anything else. You reduce no-shows by 40% or more.
A reminder 24 hours before. An automatic message that arrives the day before. “Tomorrow you have an appointment with Dr. Martínez at 3 pm. Can you confirm you’ll attend?” Simple, useful, human.
Post-visit follow-up. “How did the treatment go? If you have any questions, write to us.” You aren’t asking for a review. You are taking care of your patient. And a patient who feels cared for comes back and recommends you.
The operational key: all these messages must include a visible data protection disclaimer and a clear option such as “If you no longer wish to receive messages, reply STOP”.
Reviews and reputation: where a patient is won or lost
If there is one channel where the healthcare sector can’t afford to improvise, it’s review management.
Think about it this way: a patient searches for “gynecologist in Medellín”. Google shows them the local pack with three clinics. Two have 4.8 stars with 50+ answered reviews. One has 3.2 stars with a review from eight months ago that says “terrible service, they didn’t see me on time” —with no reply from the clinic.
Guess which one doesn’t get the call.
An unanswered negative review is, literally, the only thing that patient finds about your clinic. They won’t look any further. They won’t give you the benefit of the doubt. They’ll move on to the next one.
A reputation strategy for clinics has three moves:
First, actively ask for reviews. Not from every patient. Only from those with whom you had a verifiably good experience. Give them the direct Google link. Tell them their opinion helps others find a good professional. Most satisfied patients don’t leave a review because nobody asks them to.
Second, reply to EVERYTHING. Good reviews with genuine gratitude. Bad ones with empathy, without getting defensive, offering to resolve the case privately. “We are truly sorry about your experience. We would like to understand what happened so we can fix it. Could you write to us at 3001234567?” That not only retains the dissatisfied patient —it shows everyone else that you take responsibility.
Third, never buy reviews. It sounds obvious, but there are “agencies” that offer fake reviews for clinics. Google detects them with surgical precision and penalizes the entire profile. And the Superintendence may consider fake reviews misleading advertising —legal trouble, once again.
Frequently asked questions about digital marketing for clinics
Is it legal to advertise medical services in Colombia?
Yes. What is not legal is promising results, comparing yourself with other professionals, mentioning prices in advertising or using patient data without explicit consent. Medical advertising in Colombia must be informative, truthful and focused on prevention and education, according to articles 29 and 30 of Law 23 of 1981. As long as you communicate your specialty, your training, your facilities and educational content, you are within the legal framework. When you cross the line into “we guarantee your pain will disappear”, you enter sanctionable territory. That’s why it pays to work with an agency that understands the regulatory framework, not with the first one that promises “lots of patients fast”.
How much does digital marketing cost for a small clinic in Colombia?
It depends on how many channels you activate and how competitive your area is, but a realistic budget for a clinic or practice with 1–3 specialists starts at COP $1.5 to $3 million a month, including local SEO, Google Business Profile management, a modest Meta Ads campaign and an optimized website. If you only do one thing —say, only Meta Ads with no website or SEO— you are building on sand. Patients search, research, compare and then call. If you are only present in one of those steps, you lose the rest. The investment pays off when each new patient who arrives from the internet is worth, on average, 3 to 10 times the cost of acquiring them, depending on the specialty.
Which social network works best for medical practices?
Instagram works better than Facebook for visual specialties such as dentistry, dermatology and aesthetic medicine. Facebook is still better for reaching healthcare decision-makers aged 40+. But the #1 network for any clinic in Colombia isn’t Meta: it’s Google. An optimized Google Business Profile brings in more new patients than Instagram, Facebook and TikTok combined. The priority is Google → Instagram → Facebook → TikTok, in that order. And TikTok only if you have a specialist who is charismatic on camera and educational content suited to the short format (such as “myths about teeth whitening in 60 seconds”).
How long does it take to see SEO results for a clinic?
Local SEO for clinics has two speeds. The first is fast: optimizing your Google Business Profile and publishing content weekly can move your position in the local pack in 4 to 8 weeks. The second is gradual: ranking service pages by specialty and city takes 3 to 6 months to reach the first page of Google in competitive cities such as Bogotá or Medellín, and 6 to 12 months to stay stable in the top three results. The good news is that, unlike paid media, SEO builds authority over time: what you build this month keeps bringing you patients two years from now without paying for each click. If you start today, by December 2026 patients will find you on their own.
Can I use photos of real patients in my marketing?
Only with explicit written authorization that specifies exactly where and for what purpose those images will be used. A generic “I agree to the use of my data” does not cover publishing a patient’s photo on Instagram or on your website. Also, even with signed authorization, avoid publishing images of procedures or medical results that could be interpreted as an implicit promise of results —that exposes you to an investigation by the Medical Ethics Tribunal. The safest option is to use photos of your facilities, your professional team (with their consent) and educational content that doesn’t involve real patients. If you need to show clinical cases, do so in an academic context, with anonymized data and always backed by the corresponding informed consent.
Your clinic can’t afford to be invisible
There are two types of clinics in Colombia in 2026: those that understand patients search online and have built a professional digital presence, and those that depend on word of mouth and cross their fingers every month hoping the numbers add up.
The difference between them isn’t how much they invest in ads. It’s who sets up their strategy.
Generic marketing agencies don’t know that publishing consultation prices in a Facebook ad violates Law 23. They don’t know what explicit consent for health data means. They set up a pretty campaign with stock photos and phrases like “the best results guaranteed” that could cost you a suspension from the Medical Ethics Tribunal.
At Gulupa Digital we have spent more than a decade working with institutions that handle sensitive data and operate under strict regulatory frameworks —from the Arquidiócesis de Medellín to the Universidad de Antioquia. We know exactly where the red lines are and how to build a digital presence within them.
If your clinic or medical practice needs patients from the internet without putting its professional license at risk, let’s talk today. No commitment, no pressure and with a strategy that follows Colombian regulations to the letter.
