Dental marketingHome / Guides / dental patient data privacy
Guide · Compliance
Marketing to patients is health data. The rules are stricter.
A dental enquiry reveals something about a person’s health, which puts it in a more sensitive category than an ordinary marketing list. Most practices are broadly fine, but the details that catch people out are consistent.
Dental marketing must satisfy UK GDPR and the applicable PECR rules. Email and text marketing require valid consent or every condition of the products-and-services soft opt-in. Health-data processing also needs an Article 9 condition; ICO guidance generally requires explicit consent for special-category data used in direct marketing. Both practices and agencies have legal responsibilities.
- Who is responsible
- The practice, as controller
- Two rule sets
- UK GDPR and PECR
- Opt outs
- Immediate and permanent
- Keep out of marketing
- Clinical detail
Controller and processor, and why it matters
The practice is the data controller. It decides what happens to patient data and carries the responsibility. A marketing agency acting on your instructions is a processor, and there should be a written data processing agreement between you setting out what we may do, for how long, and what happens at the end. If an agency cannot produce one, that tells you something.
Lawful basis for marketing to existing patients
The products-and-services soft opt-in requires details obtained during a sale or negotiations, marketing of your own similar services, and a simple opt-out at collection and in each message. Existing patient status alone is insufficient. Health data also requires a separate Article 9 condition.
Consent, and why channels are separate
Where you are relying on consent, it must be specific, informed and freely given, and it must be recorded. Consent for email does not automatically cover text or WhatsApp. A patient agreeing to appointment reminders has not agreed to marketing. Collecting these separately at the form, and recording which was given, is the practical fix and it takes very little effort at the point of capture.
Health data, and keeping clinical detail out
Treatment information and some patient segmentation can reveal health data. Minimising fields does not remove every health inference. Assess an Article 6 basis and Article 9 condition before processing, and keep inappropriate health information out of advertising tools.
Opt outs
Every marketing message needs a clear, working way to stop receiving them, and an opt out must be honoured immediately and permanently, including across a change of system or agency. Keep a suppression record so somebody who opted out three years ago is not contacted again by a new platform that never knew about them. This is the most common cause of complaints and it is entirely preventable.
Call recording
Assess a lawful basis and provide clear notice before recording. If recordings contain health data, an Article 9 condition is also needed. Limit access and retention and consider an unrecorded alternative.
Retention
Agree how long enquiry data is kept and stick to it. Enquiries that never became patients do not need holding indefinitely. A defined period, applied consistently, is both good practice and easier to defend than keeping everything forever because nobody decided.
Working with an agency safely
A processing agreement in place before any data moves. Access limited to named people. A patient list export deleted at the end of a campaign rather than sitting in a shared drive. Consent wording reviewed by your compliance lead before it goes live. None of this is onerous, and an agency that resists any of it is telling you how it handles other clients’ data.
Where it usually goes wrong
The mistakes we see most often, in roughly the order they cost the most.
- Assuming consent for reminders covers marketing
- Using one opt in to cover email, text and WhatsApp
- Putting treatment or diagnosis detail into a marketing platform
- Opt outs honoured in one system but not carried across to a new one
- Recording calls with no announcement and nothing in the privacy notice
- Keeping every enquiry indefinitely because nobody set a retention period
- Sending a patient list to an agency with no processing agreement in place
Questions and answers
Common questions.
Can we send marketing texts to our dental patients?
Only with valid consent or where every applicable soft opt-in condition is met. Existing patient status does not automatically permit marketing. Assess any health data or inference separately and respect objections.
Do we need separate consent for email and WhatsApp?
Yes, in practice. Consent must be specific, and agreeing to receive email does not imply agreement to messaging. Collect them separately at the form and record which was given.
Is a dental enquiry classed as health data?
It reveals information about a person’s health, which places it in a more sensitive category than an ordinary marketing contact. The practical consequence is keeping clinical detail out of marketing platforms entirely.
Is it legal to record patient enquiry calls?
Recording needs clear notice, a lawful basis, appropriate access and retention controls, and an Article 9 condition where health data is involved. Assess the actual purpose and recording arrangements.
Who is responsible if a marketing campaign breaches data rules?
The practice normally controls patient marketing. An agency is a processor only while following documented instructions; its own purposes may change that role. Both controllers and processors have legal duties.
How long can we keep enquiry data?
As long as you have defined and can justify, applied consistently. Enquiries that never became patients do not need keeping indefinitely. Set a period and stick to it.
What should we ask a marketing agency about data?
For a data processing agreement, for confirmation of who has access, for what happens to an exported list at the end of a campaign, and for how opt outs are carried across systems. Reluctance on any of these is informative.
Related
Where this connects.
Next step
Want to talk it through?
Thirty minutes, no obligation, and we will tell you honestly which parts of this apply to your practice and which do not. If the answer is that you do not need us, we will say so.