Sending a patient a text to remind them of their appointment feels like the most ordinary thing in the world. Legally, it is not quite that simple. The moment a clinic uses a patient's name and phone number to send a health-related message, it is processing personal data, and in a healthcare setting that engages some of the more careful parts of UK GDPR.

This guide explains, in plain terms, how data protection applies to patient SMS reminders: why this category of processing needs thought, what lawful basis clinics typically rely on, what a reminder should and should not say, and the questions to ask any vendor. It is written as a resource for your own clinic's decision-making, not as legal advice. For anything specific to your circumstances, take advice from a suitably qualified data protection professional.

Why SMS reminders touch health-adjacent data

The instinct is to think a reminder text contains nothing sensitive: no diagnosis, no notes, just a time and a date. But data protection does not only look at the words in the message. It looks at what the data reveals.

The fact that a named individual has an appointment at a physiotherapy clinic, an aesthetics practice, or a private GP is itself information about their health, or at least strongly implies it. Under UK GDPR, information about someone's health is "special category data," which attracts stronger protection than ordinary personal data. You do not have to state a condition for the processing to be health-adjacent: the association between the person and the type of clinic can be enough.

This does not mean SMS reminders are risky or discouraged. They are entirely legitimate and extremely common. It simply means they sit in a category where a clinic should be able to explain why it is allowed to send them, what the message contains, how long the data is kept, and who else handles it. The rest of this guide walks through each of those in turn.

Lawful basis for appointment reminders

Under UK GDPR, every act of processing personal data needs a lawful basis, and processing special category data needs an additional condition on top. This sounds daunting but is well-trodden ground for appointment reminders.

Two points are worth understanding clearly.

Consent is not the only option, and often not the best one. Many clinic owners assume they need explicit consent to text a patient. In practice, organisations frequently rely on other lawful bases for administrative communications that are part of providing the service the patient has asked for. A reminder about an appointment the patient themselves booked is very different from a marketing message. Which basis fits your clinic is a decision to make deliberately, ideally with professional input, rather than defaulting to consent because it feels safest. Relying on consent has its own burdens, including having to honour a withdrawal cleanly.

The reminder must stay within its purpose. Whatever basis you rely on covers reminding the patient about their care. It does not stretch to using the same phone number for marketing, offers, or newsletters. Those are separate purposes that generally need their own basis and, for marketing by text, usually consent. Keeping reminder data and marketing data clearly separated in your own mind, and in your systems, is one of the simplest ways to stay on the right side of the line.

The practical takeaway is not "get consent for everything." It is: be able to say, in a sentence, why your clinic is entitled to send appointment reminders, and make sure that reason does not quietly get used to justify sending other things.

What a compliant reminder should and should not include

This is the most practical part, and the easiest to get right once you have seen it laid out. The guiding principle is data minimisation: include what the patient needs to attend, and nothing that would expose sensitive detail if the message were seen by someone else.

A text can sit on a lock screen, be read by a family member, or be left on an unattended phone. Write every reminder as though someone other than the patient might glance at it.

Generally safe to include:

The clinic name
The appointment date and time
The practitioner's name, where helpful
A way to confirm, cancel, or rearrange
A brief, friendly note

Better to leave out:

Any statement of diagnosis, condition, or symptom
The specific treatment or procedure ("your Botox appointment," "your STI screening")
Clinical detail of any kind
Anything that would embarrass or expose the patient if seen by someone else

The difference is easy to see in practice. "Reminder: your appointment at Bridge Clinic is tomorrow at 2:30pm. Reply YES to confirm or call 0115 xxx xxxx to rearrange" tells the patient everything they need without revealing anything sensitive. "Reminder: your knee injection with Dr Adeyemi is tomorrow" leaks clinical detail that does not need to be in a text at all. The clinic name and time do the job. The condition does not belong in the message.

This principle sits naturally alongside good reminder design generally. Our guide on how automated appointment reminders work and what to look for in a system covers the wording and personalisation choices that make reminders effective, and the same restraint that keeps a message compliant also keeps it clear.

Data retention and processor agreements

Two behind-the-scenes areas matter as much as the message itself, and both come up the moment you use a third-party tool to send reminders.

Retention

Personal data should not be kept longer than you need it for the purpose you collected it. For reminders, that means a clinic should have at least a rough answer to "how long do we hold the phone numbers and appointment details used to send texts, and when are they removed or archived." You do not need an elaborate policy, but you should not be keeping reminder data indefinitely with no thought given to it. When choosing a system, it is fair to ask how long it retains data and whether you can delete a patient's information when it is no longer needed.

Data processing agreements

This is the one that most often gets missed. When you use an external service to send reminders on your behalf, that vendor is a "data processor" acting on your instructions, and UK GDPR requires a written contract between you, the "data controller," and them. This is commonly called a data processing agreement, or DPA.

A DPA is not paperwork for its own sake. It sets out that the vendor will only use the data to provide the service, will keep it secure, will help you meet your obligations, and will not do their own thing with your patients' information. If a reminder provider cannot give you a DPA, that is a genuine red flag, because it means the basic contractual foundation for handing them patient data is missing.

Alongside the DPA, it is reasonable to ask where the data is stored and processed, particularly whether it stays within the UK or a region with equivalent protection, and what security measures protect it. A provider built for UK healthcare should be able to answer these questions readily rather than treating them as unusual.

A practical checklist for clinic owners

If you are evaluating a reminder system, or reviewing one you already use, these questions cover most of what matters. They are a starting point for your own due diligence, not a substitute for tailored advice.

Can we articulate our lawful basis for sending appointment reminders, and is it kept separate from any marketing?
Do our messages avoid clinical detail, naming only the clinic, time, and practitioner rather than the condition or treatment?
Will the vendor provide a data processing agreement (DPA)? If not, why are we handing them patient data at all?
Where is the data stored and processed, and does it stay within the UK or an equivalently protected region?
How long is data retained, and can we delete a patient's details when they are no longer needed?
What security measures protect the data in transit and at rest?
Can patients opt out of reminders easily, and is that handled cleanly?
Is reminder data walled off from marketing use by default?

A provider genuinely built for UK private clinics should make most of these easy to answer, because the answers are designed in rather than bolted on.

The bottom line

GDPR is not a reason to avoid SMS reminders. Done properly, reminders are a legitimate, valuable part of running a clinic, and the same evidence that makes them effective at reducing no-shows, set out in our guide comparing SMS, phone calls, and email reminders, makes them well worth doing. Compliance is simply the discipline of doing them thoughtfully: knowing why you are allowed to send them, keeping the message minimal, holding the right agreement with your vendor, and not letting reminder data drift into other uses.

Get those basics right and you can send reminders with confidence, knowing you are protecting your patients' data as carefully as you protect their care. For decisions specific to your clinic, a qualified data protection professional can confirm exactly how these principles apply to your circumstances.

How ShowUp helps

ShowUp is software for UK private healthcare clinics that fills cancelled slots from a waiting list by SMS and sends automated appointment reminders, working alongside Cliniko. It is designed so that compliant use is the default: reminders carry the clinic name, date, and time and no clinical detail, patients can opt out at any time by replying STOP, patient data is handled with UK healthcare in mind, and the contractual and security groundwork a clinic needs when working with a processor is in place.

ShowUp is a flat monthly subscription sized to your clinic, with SMS included and no per-message charges. Slot recovery is an add-on with a free trial. Current plan prices are shown when you sign up.

If ShowUp sounds like a fit for your clinic, send us an email.

About the author

Will Kirk is the founder of ShowUp Software Ltd, a UK company that makes ShowUp: software that helps private healthcare clinics recover revenue from cancelled and missed appointments by offering freed slots to a waiting list by SMS, with automated appointment reminders included. ShowUp works alongside Cliniko. Based in Nottingham. ICO Registered: ZC159538. Company Number: 17228859.

This article is general information about how data protection principles apply to appointment reminders. It is not legal advice. For guidance specific to your clinic, consult a qualified data protection professional.

Do UK Clinics Need Consent for Patient SMS Reminders?