If you run a GP, dental, TCM, physio or aesthetic clinic, you send patients messages all the time — reminders, results, the occasional promotion. Most of it is fine. But there's one trap almost every clinic falls into, and it's worth ten minutes to get right. Let's keep it plain.
The trap: one signature does not cover everything
A patient signs your form, ticks a box, agrees to treatment — and it's easy to assume that one "yes" covers everything you'll ever do with their data. It doesn't. Consent isn't one thing. The safest way to think about it is as three separate things, and mixing them up is exactly where clinics get caught. Here they are, one at a time.
1. Consent to treatment — this is not PDPA consent
When a patient agrees to a procedure, a jab, or a course of care, that's medical consent — a clinical decision about their own body. It's important, but it lives under medical practice, not the PDPA. Agreeing to be treated says nothing about whether you can text them a promotion next month. So the treatment form your patient signs does not, on its own, give you marketing permission. Keep this one in its own box in your head.
2. Using patient data to provide care — usually already covered
This is the everyday stuff: keeping their medical record, booking and confirming appointments, sending results, referring them on, following up on their care. The patient gave you their details for exactly this purpose — to be looked after — so using the data this way is generally covered without a separate form. It's the reason you don't need a fresh consent every time you pull up a file or ring to say the results are in.
The key word is purpose. Data a patient handed over to get care can be used to give that care. The moment you want to use it for something they didn't come to you for, you're into the third thing.
3. Using patient data for marketing — this needs its own consent
Promotions. Health tips. Package offers. Birthday vouchers. A "we miss you, come back for a cleaning" nudge. All of this is marketing — and marketing needs a separate, express consent that the patient actively gave. It is not implied by treatment, and it is not implied by them being your patient.
And there's a second layer for phone calls and SMS: on top of PDPA consent, Singapore has the Do Not Call (DNC) registry. Before you send a marketing call or text to a local number, you generally have to check that number against the DNC registry — unless you already have clear, signed consent from that patient to contact them for marketing. Skip that check and a single promotional blast to your patient list can breach the rules.
Appointment reminders vs marketing — where's the line?
This trips people up, so let's be clear. A reminder for an appointment they booked, or a follow-up for care they asked for, is part of providing the service — generally fine, no separate consent, not caught by DNC. A promotion is marketing, full stop.
- ✓Care (generally fine): "Reminder: your appointment is tomorrow at 3pm." / "Your test results are ready — please call to discuss." / "Time for your 6-month dental review."
- ✕Marketing (needs separate consent + DNC check): "20% off teeth whitening this month!" / "New aesthetic package — book now." / "Happy birthday! Here's a voucher for your next visit."
Watch the mixed message too: a genuine reminder that also slips in an offer becomes marketing for the offer part. If you're bundling a promo into a reminder, treat the whole thing as marketing.
How to collect marketing consent cleanly
The good news: getting this right is simple. You just need a clear, honest opt-in — not a trick.
- 1Make it a separate ask. A distinct line or checkbox for marketing — not buried inside the treatment consent, not bundled into "I agree to everything."
- 2Don't pre-tick it. The patient should actively opt in. A box that's already ticked, or consent hidden in fine print, doesn't count as a real yes.
- 3Say what they're agreeing to. "Send me clinic promotions and health tips by SMS/email" is clear. Vague "we may contact you" language isn't.
- 4Record it. Note when and how each patient opted in, so you can show it later and so your reception team knows who can be messaged.
Patients can withdraw — and you must stop
Consent isn't forever. A patient can withdraw marketing consent at any time, for any reason — and once they do, you have to stop sending marketing within a reasonable time. Make it easy: an unsubscribe link, or a simple "reply STOP." Then actually record the withdrawal so nobody messages them again by accident. Importantly, pulling out of marketing doesn't affect their care — you still keep their records and still send appointment reminders. It only switches off the promotions.
Why this is the DPO's job
Keeping these three lanes straight — treatment, care, marketing — plus running the opt-in, honouring withdrawals, and checking the DNC registry, is exactly the kind of thing that quietly slips when everyone's busy at the front desk. That's what a Data Protection Officer is for: someone who owns the consent flow, writes it into your forms and your clinic system, and keeps you on the right side of it. Every clinic in Singapore is required to appoint one — see our guide on whether your clinic needs a DPO for the full picture.
Common questions
No. Consenting to treatment is a medical decision, not PDPA consent to use personal data for marketing. To send promotions, health tips or birthday offers you need a separate, express marketing consent, collected as a clear opt-in and kept apart from the treatment form.
Generally no. A reminder for an appointment the patient booked, or for follow-up care they asked for, is part of providing the service they came to you for, so it's usually covered. The line is crossed when the message also promotes a package, product or offer — that part is marketing and needs separate consent.
The Do Not Call registry lets people opt out of marketing calls, texts and faxes. Yes, it applies to clinics. Before you send a marketing call or SMS to a Singapore number you must check that number against the DNC registry, unless you have clear signed consent from that patient to contact them. Appointment reminders for care they asked for aren't marketing and aren't caught by DNC.
Yes, at any time. A patient can withdraw marketing consent whenever they like, and once they do you must stop sending marketing within a reasonable time. Make it easy — an unsubscribe link or a simple reply — and record the withdrawal so nobody messages them again by mistake. Withdrawing marketing consent doesn't affect their care.
Sources
- Personal Data Protection Commission (PDPC) — pdpc.gov.sg (consent obligation; the Do Not Call registry; Healthcare Sector Advisory Guidelines)
- Ministry of Health (MOH) — record-keeping requirements & the Healthcare Services Act (HCSA)
I build websites and help Singapore businesses run them well. HeyAda is my Singapore web studio — design, SEO, and the practical side of running a business online, including the patient data your clinic collects. I write these guides in plain English, and I can be your clinic's outsourced DPO. Getting your clinic PDPA-ready? Say hi.
Want your clinic's consent set up properly?
We help Singapore clinics get the consent flow right — clean opt-ins, DNC checks, withdrawals honoured — and stand in as your outsourced DPO. Let's talk.