For clinics and practices
Patient testimonials, with the authorization on the record
A patient writes you something generous and mentions the procedure, the date, and the name of the clinic they went to before. On a dental or medical site, that paragraph is protected health information published by the practice.
No password. You get a private dashboard link right after this — bookmark it, that's your login.
The rule you are working under
“A covered entity must obtain valid, written authorization from the patient before publishing a testimonial that uses their protected health information for marketing.”
The HIPAA Privacy Rule — hhs.gov
The authorization has required elements of its own — what may be used, where it may appear, when it expires, and how the patient may revoke it. If you are a psychologist or a counsellor, a second rule applies before any of that: APA Standard 5.05 says psychologists do not solicit testimonials from current therapy clients, and the ACA code says the same for counsellors.
What Kudobox does about it
It records the permission as a sentence, not a checkbox
Your patient reads exactly what they are agreeing to, ticks where you may show it, and that sentence, those places and the date are kept with their words.
It enforces the places they allowed
A patient who allowed your website but not your social media cannot be turned into a social media image: the request for one comes back empty. No other tool in this category refuses that.
It marks personal detail before you publish
A diagnosis, a phone number, an address, another practice named by the patient — each is flagged with the reason, and can be replaced with [removed] without a word of the rest being touched.
It warns you before you ask a current client
The invite screen says plainly that a therapist's or counsellor's code forbids soliciting a testimonial from a current client. The product will not help you walk into that.
What it gives you is the record and the refusal: written permission with its date, a machine that reads every testimonial for protected detail before you publish, and a widget that obeys what the patient allowed even when you forget.
What it does not do
- Kudobox is not a HIPAA authorization form. Its consent record has no expiry date and no revocation mechanism of its own — a compliant authorization needs both, and yours should come from your lawyer.
- Kudobox does not make your practice HIPAA compliant, and does not audit you.
- Nothing here is legal or clinical advice.
Your clients already wrote the words
Send one link and their words arrive here instead — with the date, with the permission, and read for risk before you publish.
See how the whole product works