What a Regulated Practice Must Not Publish Online
Very few practices get into trouble by ignoring what practices must not publish. They get there by accident.
They start with a marketing intern writing enthusiastic copy, a partner uploading a document without checking its properties, or a photograph taken in a waiting room on a busy afternoon.
Understanding what practices must not publish is therefore less about restraint and more about knowing where the accidents happen. Six categories cover almost all of them.
What Practices Must Not Publish, One: Identifying Information
The obvious version is a name. The dangerous version is everything else.
A description specific enough to identify somebody is identification, even without a name. Photographs taken inside your premises may capture a person in the background. Meanwhile a case study naming the sector, the town, the year and the outcome can leave exactly one candidate.
In health, patient information is sensitive personal data under Kenya’s Data Protection Act 2019. In law, the confidentiality obligation exists independently of any data protection duty.
Consent helps, though it must be specific, written, informed, and withdrawable. Blanket consent buried in an intake form does not meet that standard.
Two: Outcome Claims
High on any list of what practices must not publish sits the outcome claim. The Advocates marketing rules specifically prohibit promising a particular result, or offering that failure to achieve it waives fees. Health regulators apply equivalent restrictions to clinical claims.
The trap is that outcome language creeps in without anybody noticing.
Risky: proven results, success rate, we win, guaranteed, fastest recovery, no win no fee framing.
Safe: what you do, who you do it for, where, and how.
Read every page asking one question. Does this promise anything? Where the answer is yes, rewrite it descriptively.
Three: Comparative and Denigrating Claims
Kenyan professional rules generally require advertising to be dignified, which places comparison firmly among the things practices must not publish.
That rules out naming competitors unfavourably, and it also rules out the softer version. Unlike other firms and where others fail both denigrate by implication.
Unverifiable superlatives sit in the same category. Leading, best, top ranked, and number one cannot be evidenced, which is precisely why the dignity requirement targets them.
Four: Status You Do Not Formally Hold
Claimed status belongs on any list of what practices must not publish without evidence. Several Kenyan regulators maintain registers of recognised specialists, and the rules generally permit claiming specialisation only where it has been recorded.
The same applies to memberships you have left, awards without a named awarding body and year, accreditations that have lapsed, and any implication that a foreign qualification confers Kenyan practising status.
Our post on publishing practitioner credentials covers the safe alternatives.
Five: The Accidental Publications
This category of what practices must not publish causes the most damage and receives the least attention.
Document metadata. A PDF or Word file uploaded to your site carries properties, and those properties frequently include the author’s name, the file path, revision history, and sometimes the original client the template was built from. Strip metadata before uploading anything.
Tracked changes and comments left inside a document that was converted to PDF without being cleaned.
Image location data. Photographs taken on phones often embed GPS coordinates. Remove them before upload.
Faces in the background. A photograph of your reception or waiting area may capture identifiable people who never consented.
Documents in an unlinked folder. A file uploaded but not linked from any page is still publicly reachable, and search engines find these routinely.
Old pages that were never removed. A practitioner who left three years ago, a fee schedule long superseded, an announcement about a matter that settled.
Cached versions. Removing a page from your site does not remove it from every index immediately, which is an argument for checking before publishing rather than relying on deletion afterwards.
Six: Material Belonging to Somebody Else
Client logos without written permission, and never where the relationship is confidential.
Photographs pulled from search results, which create genuine exposure. Our guide to using images on your website legally covers the licensing question.
Court documents, pleadings or reports that are not yours to publish.
Text lifted from another firm’s site, which happens more often than anybody admits and is both a copyright issue and an embarrassment when noticed.
Your Staff Publish Too
What practices must not publish extends beyond the website.
A practitioner posting about an interesting day, a receptionist sharing a photograph of the office, a partner commenting on a live matter. Regulators have signalled that social channels now receive the same attention as formal advertising, and in some cases more.
Give your team a short, plain written policy. What may never be posted, who approves practice communications, and what to do if something goes up in error. One page is enough.
If Something Is Already Live
Act rather than deliberating, because what practices must not publish becomes harder to remove with every day it stays live.
Remove the content immediately. Check whether it also appears in a PDF, an old page, a social post, or a cached copy. Where a client or patient is identifiable, take advice promptly, since data protection obligations may include notification duties within a short window. Document what happened and what you did.
Our post on data protection for websites in Kenya covers the seventy two hour breach notification duty.
Auditing What Practices Must Not Publish
Once a year, work through the site properly.
Read every page asking whether anything promises an outcome. Check every practitioner profile against the current register. Open every uploaded document and inspect its properties. Review every photograph for identifiable people. Search your own domain for files that are live but unlinked. Remove anybody who has left.
An afternoon annually costs considerably less than a complaint.
Frequently Asked Questions
What practices must not publish above everything else? Anything identifying a client or patient, and anything promising an outcome. Those two cause the most serious problems.
Can we publish anonymised case studies? With care. Anonymised means genuinely unidentifiable, which is harder than removing the name.
Is a testimonial safe if the client consented? Consent addresses confidentiality. It does not make an outcome claim permissible.
Do these rules apply to our social media? Yes, and regulators are paying increasing attention there.
How do we remove metadata from a PDF? Most PDF tools include a document properties or sanitise function. Check the file after saving rather than assuming.
Who should sign off on published content? A practitioner, not solely a marketing contact.
Know Where the Accidents Happen
What practices must not publish is rarely a mystery. The failures come from metadata nobody inspected, a photograph nobody reviewed, and a page nobody removed.
At Africa Web Experts we build sites for Kenyan practices with clean document handling, stripped image data, and copy written to sit inside your professional obligations. From KES 65,000, live in seventy two hours.
