SMS appointment reminders for clinics without breaching the GDPR
· 3 min read
Every empty chair is lost money and a slot another patient needed. SMS reminders reduce no-shows measurably — and they are among the few messages patients are grateful for. But in healthcare there is a line an SMS must not cross, and it is worth having it written down before automating anything.
The golden rule: the SMS does not reveal health
Health data is a special category (art. 9 GDPR). An SMS can be seen on the lock screen, anyone holding the phone can read it, and the operator carries it as text. Therefore:
- Yes: “We remind you of your appointment on Thursday the 12th at 10:30. Reply CANCEL to cancel. Clinic X.”
- No: the speciality when it gives away a diagnosis (oncology, mental health, HIV), the reason for the visit, results, medication.
The reminder of an appointment the patient asked for is not advertising: it is the performance of the care relationship. Marketing —annual check-ups, campaigns— is something else and requires consent.
Documenting consents, the second piece
Where a clinic does need evidential value is in consents and authorisations: the informed consent for a procedure, a guardian's authorisation, the acceptance of a treatment quote. With certified messaging the document is read in full on a secure portal —never inside the SMS— and signed with a one-time code bound to the patient's phone, leaving an evidence file with the document's fingerprint.
It is a simple electronic signature with a file to prove it (art. 326.3 of the Civil Procedure Act); it is not a qualified service and we do not pretend it is. For the medical record, your practice management software remains the archive; this is the proof that the patient was informed and accepted.
In practice
Sending through the API from your appointment software or from the dashboard; the CANCEL reply can be handled by webhook; and the patient's phone verified with an OTP when they register on the portal.
Published rates, no lock-in and with test mode.
Three questions clinics keep asking us
Do I need consent for the reminder? A notice about an appointment the patient asked for rests on the care relationship they started themselves; it is not advertising. Record in your register of processing activities that the phone is used to manage appointments, and do not mix it with campaigns: to promote check-ups or services, separate consent.
Which sender will the patient see? Your clinic's name, if it is registered as an alias in the CNMC Registry — since September 2026 it is a requirement for branded senders. A recognisable sender reduces last-minute cancellations more than any text.
Can I schedule the sendings? Yes: campaigns can be scheduled, and through the API you can trigger the reminder from your calendar with whatever notice you decide — 48 and 24 hours is the pattern that works best. The cost is estimated before you confirm, with the published price per destination.