If you run a GP, dental, TCM, physio or aesthetic clinic, sending a quick promo blast feels harmless — a birthday discount, a health-screening package, a new-service announcement. But marketing to patients is exactly where clinics trip over the PDPA. So this is worth ten minutes. Let's keep it plain.
Rule one: marketing consent is separate from treatment consent
When a patient hands over their phone number and NRIC to be treated, they've consented to you using that data for their care — booking, results, follow-up. They have not consented to receiving your promotions. Under the PDPA, marketing needs its own, express consent — a clear, specific yes to being contacted with offers. Bundling it into the treatment form, or assuming "they're my patient, so it's fine," is the single most common clinic mistake. Get a separate tick-box or a plainly worded opt-in, and keep the record of it.
Rule two: the Do Not Call (DNC) Registry
The Do Not Call Registry is a national list under the PDPA. People register their Singapore phone numbers to say "no marketing" — and it covers marketing sent by call, SMS and fax. Before you send a marketing message to a Singapore number, the rule is simple: check the relevant DNC list first, unless you have clear consent or a valid exemption.
In practice that means one of these has to be true before a promo SMS goes out:
- 1You have clear consent — the patient expressly agreed to marketing by SMS. If so, you generally don't need to check the DNC list for that number.
- 2You've checked the DNC Registry — and the number isn't listed. Checks are done through the PDPC's DNC system, and a clear result is valid for a limited window, so you can't check once and rely on it forever.
- 3An exemption applies — the narrow ongoing-relationship exemption can allow certain related messages to existing patients, but it's limited and conditions apply. Don't lean on it as your default.
Email is different: marketing email doesn't go through the DNC Registry — it sits under the PDPA's consent rules instead. But the practical bar is the same, and in some ways stricter (more below).
Rule three: email marketing needs consent + an easy unsubscribe
To email promotions to patients you need their consent, and every marketing email must include an easy way to unsubscribe — one that actually works and that you honour promptly. Someone who opts out should stop hearing from you fast. Keep your list clean, log the opt-ins and opt-outs, and don't quietly move an unsubscribed patient back onto the list at the next campaign.
The line that trips clinics up: reminder vs promotion
Here's the distinction that matters day to day. Messages about a patient's own care are generally fine — they're service messages, not marketing:
- ✓Appointment reminders — "Your appointment is tomorrow at 3pm."
- ✓Results and follow-up — "Your report is ready," or a recall for a due review.
- ✓Operational notices — a clinic closure, a change of location.
But the moment a message is selling something, it's marketing — and the consent and DNC rules kick in:
- ✕Promotions and packages — "20% off health screening this month."
- ✕New-service announcements — "We now offer aesthetic treatments — book now."
- ✕Cross-sells dressed as a reminder — a recall message that's really an upsell. If it's promoting, treat it as marketing.
When you're not sure which side a message sits on, assume it's marketing and get consent. It's the cheaper mistake.
The stakes: DNC breaches carry real penalties
This isn't a technicality. Sending marketing to numbers on the DNC Registry without consent or a valid exemption is a breach the PDPC actively enforces, and it carries real financial penalties. For a neighbourhood clinic the bigger cost is often the patient trust you burn when someone gets a promo they never asked for — but the fines are real, and "we didn't know" isn't a defence.
So — what should your clinic actually do?
Keep it simple and you'll stay well clear of trouble:
- 1Ask for marketing consent separately — a distinct opt-in, not buried in the treatment form. Record it.
- 2Keep reminders and promotions apart — one channel/template for care messages, another for marketing.
- 3Check the DNC list before promo SMS — unless you're relying on clear consent, and keep proof of your checks.
- 4Put an easy unsubscribe on every marketing email — and honour opt-outs quickly.
This is exactly the everyday stuff a clinic's Data Protection Officer is meant to own. If you're not sure whether your clinic even needs one — or who it should be — start with our pillar guide: does my clinic need a DPO? A good DPO sets up your consent flow, your reminder-vs-marketing templates, and your DNC process so nobody has to think about it each time.
Common questions
Only with the right consent. Marketing SMS to Singapore numbers falls under the Do Not Call rules, so you must either have clear consent to send marketing, or check the number against the DNC Registry first (unless an ongoing-relationship exemption applies). A patient consenting to treatment has not consented to promotions.
The Do Not Call Registry is a national list under the PDPA where people register their Singapore phone numbers to opt out of marketing calls, texts and faxes. Before sending marketing to a number, an organisation must check the relevant DNC list unless it has clear consent or a valid exemption.
Often not, if you rely on clear prior consent to marketing or on the ongoing-relationship exemption for certain messages — but the exemption is narrow and conditions apply. The safe habit is to get express marketing consent and keep the record, so you don't have to rely on interpreting an exemption.
Yes. Marketing email needs the patient's consent and every message must include an easy way to unsubscribe, which you must honour promptly. Email marketing sits under the PDPA consent rules rather than the DNC Registry, but the principle is the same: consent first, easy opt-out always.
Sources
- Personal Data Protection Commission (PDPC) — pdpc.gov.sg (Do Not Call Registry; consent obligation; guidelines on the DNC provisions)
- Personal Data Protection Act (PDPA) — Do Not Call provisions & the ongoing-relationship exemption
I build websites and help Singapore businesses run them well. HeyAda is my Singapore web studio — design, SEO, and the practical side of running a business online, including the patient data your clinic collects. I write these guides in plain English, and I can be your clinic's outsourced DPO. Getting your clinic PDPA-ready? Say hi.
Want your clinic's marketing done PDPA-safe?
We set up Singapore clinics with clean consent, DNC-safe SMS, and easy-unsubscribe email — and stand in as your outsourced DPO. Let's talk.