PDPA for Clinic Marketing: WhatsApp, SMS, Email and the DNC Registry

When we take over a clinic's marketing, one of the first questions I ask is: who is on your WhatsApp broadcast list, and how did they get there? The answer is usually some mix of current patients, people who enquired years ago, a list exported from the old clinic system, and contacts a staff member added from their own phone.

That list is often the clinic's biggest privacy risk. Sending promotions by WhatsApp, SMS or email touches four sets of rules at once, and most clinics only know about one of them.

From this guide, you will learn:

• what consent the PDPA requires before you send marketing messages
• how the Do Not Call (DNC) provisions apply to WhatsApp and SMS, and when you need to check the DNC Registry
• what the HCSA advertising regulations add for licensed clinics, and where the Spam Control Act comes in
• how to collect leads from website forms and click-to-WhatsApp ads properly
• what to do with old patient lists, plus a consent line and a broadcast checklist you can use

One caution. I'm a marketer, not a lawyer. This is how my team applies the rules for clinics, based on the Acts and PDPC's own guidelines, which I link throughout. For a specific situation, check with PDPC or a lawyer.

Four sets of rules, one message

A single WhatsApp promotion from a clinic can engage all of these:

• The PDPA's data protection provisions: consent, notification, protection and retention of personal data under the Personal Data Protection Act 2012.
• The PDPA's Do Not Call provisions: extra rules for marketing messages sent to Singapore telephone numbers.
• The Spam Control Act 2007: rules for unsolicited commercial messages sent in bulk by email, SMS or instant messaging.
• The Healthcare Services (Advertisement) Regulations 2021: for HCSA licensees, a separate consent requirement for push marketing, plus all the usual content rules.

They overlap, but they aren't the same. Satisfying one doesn't satisfy the others.

Consent for marketing messages

PDPC's Advisory Guidelines on Key Concepts in the PDPA (revised April 2026) are direct about marketing:

• Get express, opt-in consent. PDPC says organisations should generally obtain express consent to send direct marketing, using an opt-in method such as an unchecked box the person ticks. It does not consider pre-ticked boxes appropriate.
• Deemed consent by notification doesn't work for marketing. The Personal Data Protection Regulations 2021 exclude direct marketing from it, as the same guidelines explain.
• Neither does the legitimate interests exception. PDPC states that organisations cannot rely on it to send direct marketing messages.

Two more points matter for clinics. First, under section 14(2) of the PDPA, you can't make consent beyond what is reasonable a condition of providing a service. So marketing consent can't be bundled into the consent a patient needs to give for registration or treatment. Second, PDPC's Advisory Guidelines for the Healthcare Sector (revised September 2023) give the example of a hospital that wants to market health products unrelated to a patient's condition. PDPC's view is that the patient's consent can't be assumed, and the hospital should notify the patient and get express consent.

In practice: a separate, unticked marketing checkbox, a clear description of what you'll send and how, and a record of when and where the person ticked it.

The Do Not Call rules for WhatsApp and SMS

The DNC provisions are in Part 9 of the PDPA, and PDPC explains them in its Advisory Guidelines on the Do Not Call Provisions (revised 1 February 2021).

WhatsApp counts

The guidelines state that the DNC provisions apply to all means of sending a marketing message (a "specified message") to a Singapore telephone number, including voice calls, SMS and data applications such as WhatsApp, iMessage and Viber that use a Singapore number. So a WhatsApp broadcast to patients' mobile numbers is covered in the same way as an SMS blast.

Checking the register

There are three DNC registers: No Voice Call, No Text Message and No Fax Message. Under section 43, you must not send a specified message to a Singapore number unless you have valid confirmation that the number isn't on the relevant register. The guidelines set the window at 21 days: your check, made through the DNC Registry or a checker, must be no more than 21 days old when you send.

The exception is when the person has given clear and unambiguous consent to receive the messages at that number, evidenced in written or other form so it can be referred to later (section 43(4)). A ticked web form, a signed registration form or a recorded verbal consent can all work if you can retrieve the record later. PDPC is explicit that silence doesn't count: in its healthcare guidelines, a clinic that writes to former patients saying they'll be called unless they opt out has not obtained clear and unambiguous consent.

Messages that aren't covered

Some messages fall outside the DNC rules. The Eighth Schedule to the PDPA excludes certain messages from the definition of a specified message, and PDPC's guidelines explain a few more situations. The ones clinics use most:

• Transactional messages that facilitate, complete or confirm a transaction the patient agreed to. PDPC's healthcare guidelines give the example of a dental patient who opted in to reminder texts for follow-up visits; the clinic can send them without a DNC check.
• Messages within an ongoing relationship, where the sole purpose relates to the subject of that relationship. PDPC says repeated visits, a course of treatment with follow-ups, or annual check-ups and health screening can show an ongoing relationship, but a one-off visit does not. Its healthcare guidelines illustrate it: a message to a patient being treated for asthma about asthma treatment can fall within the exclusion, while a message to the same clinic's migraine patient about asthma does not.
• Replies to a request for information. If someone asks you about a service, responding to that request is generally not a specified message.

Even when the DNC provisions don't apply, the PDPA consent rules and HCSA rules still do.

Other DNC duties and penalties

Every specified message must identify the sender and how to contact them (section 44), and you must not send messages to numbers generated by dictionary attacks or address-harvesting software (section 48B). For intentional or negligent breaches, section 48J lets PDPC impose a financial penalty of up to $200,000 for an individual and up to $1 million in any other case, subject to the amounts prescribed.

HCSA regulation 6(4): push marketing needs written consent

Licensed clinics have an extra rule. Regulation 6(4) of the Healthcare Services (Advertisement) Regulations 2021 says a licensee must not advertise its licensable services by sending an advertisement to an individual through push technology, or by handing out free advertising material, unless it has the individual's prior written consent.

MOH's FAQs on the advertising regulations name SMS, MMS, WhatsApp, Facebook Messenger and other messaging platforms as push technology, and confirm a licensee may send updates to people who have given prior written consent. The FAQs also say search engine optimisation and search ads are not push technology, though their content must still comply.

Two practical consequences. The DNC exclusions don't help you here: an ongoing relationship may take a message outside the DNC provisions, but you still need written consent under HCSA to send an advertisement. And the content rules still apply to anything you send: no testimonials, inducements, superlatives or outcome promises. A "20% off for existing patients" broadcast fails on content even with perfect consent. Our HCSA advertising guide covers the content side.

The Spam Control Act for bulk email and messages

The Spam Control Act applies to unsolicited commercial electronic messages sent in bulk. Its definition of "electronic address" now covers email addresses, mobile numbers and instant messaging accounts. "In bulk" means more than 100 messages with similar content in 24 hours, more than 1,000 in 30 days, or more than 10,000 in a year (section 6). A message is unsolicited if the recipient didn't request it or consent to it.

If you send unsolicited bulk messages, the Second Schedule requires an unsubscribe facility with a clear statement in English, honoured within 10 business days. For email and SMS it also requires the label "<ADV>" at the start of the subject or message; that labelling requirement does not apply to messages sent to instant messaging accounts. The Act gives anyone who suffers loss from a breach the right to sue the sender.

For clinics, the simplest position is to send marketing only to people who opted in. Then the messages aren't unsolicited, and you should already be offering an easy opt-out.

Collecting leads from forms and click-to-WhatsApp ads

Most new marketing contacts come from two places: your website enquiry form and ads that open a WhatsApp chat. Both can be set up properly.

Website enquiry forms

• Ask only what you need to respond. Name, phone or email, preferred time, and the service of interest. A free-text box asking patients to describe symptoms invites health data you may not need.
• Separate the enquiry from marketing. Submitting the form covers replying to the enquiry. Marketing needs its own unticked box.
• Link your privacy notice and say how long you keep enquiries.
• Store the consent record: the wording shown, the timestamp, and the channel ticked.

Here is a consent line we use as a starting point:

[ ] I agree to receive updates about [Clinic name]'s services by WhatsApp, SMS and email at the contact details above. I can withdraw at any time by replying STOP or emailing [address]. See our [privacy notice].

Keep the box unticked and optional, and don't block form submission if it's left blank.

Click-to-WhatsApp ads

When someone taps your ad and messages you first, answering their question is a reply to a request, so it generally isn't a specified message under the DNC guidelines. Where clinics go wrong is what happens next: the number is saved and added to the promotional broadcast list. Before you do that, ask in the chat and keep the reply. A line like "Would you like to receive updates from us on WhatsApp? Reply YES to opt in" gives you a written, retrievable record. Make sure the question itself is neutral and that the chat history is kept.

Health data, tags and pixels

Patient health information needs particular care. PDPC's Key Concepts guidelines expect security arrangements to match the nature of the data and the harm a breach could cause. Some medical information, such as the assessment or treatment of HIV, sexually transmitted diseases or substance abuse, is prescribed data whose breach is deemed to result in significant harm, which means notifying PDPC and the affected individuals.

For marketing, that means:

• Don't segment broadcast lists by condition in shared tools, for example a WhatsApp label called "STD patients" or a mailing list named after a diagnosis.
• Don't put patient names or conditions into ad platform custom audiences.
• Make sure form fields, page URLs and conversion events don't send health details to Google or Meta.

I go through tracking setups in more detail in our guide to Google and Meta ads for clinics.

Retention and old patient lists

Section 25 of the PDPA says you must stop keeping personal data once its purpose is no longer served and there is no legal or business reason to keep it. PDPC's healthcare guidelines add that institutions should not keep data "just in case". Medical records are different: they have their own retention requirements under MOH rules, which the healthcare guidelines point to. Marketing lists don't get that cover.

What I'd do with an old list:

1. Sort it by source. For each contact, can you show when and how they agreed to marketing? If not, they go in the "no consent" pile.
2. Stop sending to the no-consent pile. Don't send a "reply STOP to opt out" message to assume consent. PDPC's guidelines say a message whose purpose is to obtain consent for marketing is itself a specified message.
3. Re-consent in the normal course of care. Add the marketing checkbox to your registration form and ask patients at their next visit.
4. Delete what you can't justify keeping. Old enquiry leads who never became patients are the obvious candidates.
5. Keep personal phones out of it. Move broadcasts to a clinic-owned account, so the list and consent records stay with the clinic.

A WhatsApp broadcast checklist

Before any promotional WhatsApp or SMS goes out:

1. Every recipient gave opt-in marketing consent, and you can retrieve the record.
2. Every recipient gave prior written consent for HCSA purposes. A ticked form or a "YES" reply covers both if the wording is clear.
3. For anyone without clear consent in evidential form, the number was checked against the DNC Registry within the last 21 days, or a specific exclusion applies.
4. The message names the clinic and how to contact it.
5. It explains how to stop receiving messages, and opt-outs are actioned promptly.
6. The content passes HCSA rules: no discounts, packages, free offers, testimonials, superlatives or outcome promises.
7. No health details in the list name, labels or message preview.
8. The list has been cleaned of anyone who opted out or no longer needs to be there.

Compliant messaging tends to perform better anyway, because people on the list actually want to hear from you. If you'd like help setting this up, it sits alongside our work on medical advertising and copywriting for clinics, for practices from GP clinics to dental practices and aesthetic clinics.