What the Data Privacy Act Means for Clinics Messaging Patients on Messenger and SMS

Your last receptionist left in March. It's October, and her personal Facebook account is still an admin on the clinic's Page. Nobody removed her because nobody thought to.

Everything patients have sent since then is still in that inbox, including the photo of a swollen cheek and the HMO card someone sent so the front desk could check her coverage. She can open all of it from her phone tonight.

Probably nothing's happened. But under the Data Privacy Act that inbox is the clinic's responsibility, and almost everything in it falls in the law's strictest category.

If you looked the law up, you probably wanted to know whether you're allowed to text a reminder. You are, and that's the easy part. Your time is better spent on the inbox, the staff phones and the group chats.

The short answer

• Almost everything a patient tells a clinic is health information. The Data Privacy Act of 2012 (RA 10173) treats that as sensitive personal information, which carries the higher penalties.
• Replying to a patient who messaged you first doesn't need a consent form. She asked, and you're answering.
• Appointment messages are part of treating the patient: confirmations, reminders, reschedules, a check-in after the visit. Tell patients at booking that you'll text, and you're on solid ground.
• Promos, birthday greetings and offers are a different purpose. They need the patient's own separate yes, a record of it, and a way to stop that actually works.
• Write every SMS as if someone else in the house will read it on the lock screen. Sometimes someone will.
• The bigger risk is usually your Facebook Page inbox: who can still open it, including staff who've left, and where patient photos and screenshots end up.
• Every clinic needs a named data protection officer, a plain-language privacy notice and a contract with each vendor that touches patient data. Hold records on 1,000 or more patients and the National Privacy Commission (NPC) expects you to register too.

None of this is legal advice. It's what the Act and the NPC's own rules say, applied to what a small Philippine clinic does all day. If your setup is unusual, talk to someone qualified.

Why clinic messages fall in the strictest category

The Act has two tiers. A name and a mobile number are ordinary personal information. Information "about an individual's health" is sensitive personal information under Section 3(l). So is a person's age, which matters when we get to birthday texts.

Now look at what clinic messages contain. "See you Thursday for your extraction." "Normal lang po ba yung swelling? Three days na po." A photo of an X-ray. Even "your cleaning is at 2:30" tells whoever reads it that this person is a dental patient. Very little in a clinic inbox is just a name and a number.

Sensitive personal information can't be processed at all unless one of the exceptions in Section 13 applies. Two of them cover nearly everything a clinic does:

• 13(a), consent, given "specific to the purpose prior to the processing".
• 13(e), medical treatment, where the processing "is necessary for purposes of medical treatment, is carried out by a medical practitioner or a medical treatment institution, and an adequate level of protection of personal information is ensured".

Read 13(e) to the end, because the last clause is the one people skip. The treatment exception holds only while you protect the information properly. That's why I'd spend as much time on your inbox as on consent.

The penalties are in the Act itself, and the sensitive tier gets the higher bracket:

What happened	Section	Prison	Fine
Processing sensitive personal information without consent or legal authority	25(b)	3 to 6 years	₱500,000 to ₱4,000,000
Giving someone access to it through negligence	26(b)	3 to 6 years	₱500,000 to ₱4,000,000
Disclosing it to a third party without consent	32(b)	3 to 5 years	₱500,000 to ₱2,000,000

Those are ceilings, written for serious cases. I'm not quoting them to scare you. I'm quoting them because leaving a former employee in your inbox is close to what Section 26 describes: giving access through negligence.

Three kinds of message, three different rules

There's no single answer to "do I need consent to message patients?" It depends on which of three kinds of message you're sending.

Message	Example	What the law leans on	What you need
Replying to an enquiry	"Magkano po cleaning?" answered at 9 PM	The patient asked. Section 12(b) covers steps taken "at the request of the data subject" before an agreement	Answer it. Ask only for what the booking needs. Point to your privacy notice once you start collecting details
Appointment messages	Confirmation, a reminder the day before, a reschedule link, a check-in after the visit	Medical treatment under Section 13(e), plus the booking itself	Tell the patient at booking that you'll text about the appointment
Marketing	A whitening promo, a "PHP 500 off" blast, a birthday greeting, a broadcast to everyone on file	Consent under Section 13(a)	A separate yes the patient gives herself, a record of it, and a working way to stop

Recalls sit between the last two. "You're due for your six-month cleaning" is about the patient's own care, set by her dentist, so it's closer to treatment. Add "and 20% off whitening this month!" and it's marketing. If you'd rather not argue about where the line falls, ask for recall consent at booking alongside the reminder notice.

Getting the consent part right

The NPC's Guidelines on Consent, Circular 2023-04, came out in November 2023. They're readable, and four rules from them do most of the work for a clinic:

1. Consent is granular. When data is used for several unrelated purposes, the patient chooses which ones she agrees to, rather than giving one all-inclusive yes (Section 8).
2. Promos can't be a condition of booking. Consent to anything the service doesn't need "should not be bundled with or made a condition for the provision of" that service (Section 8B).
3. Silence isn't a yes. "Consent can never be assumed. Non-response or implied consent does not constitute valid consent" (Section 10A). A pre-ticked box the patient never touched is non-response.
4. Stopping has to be as easy as starting. Withdrawing must be "as easy as, if not easier than, giving consent" (Section 13A).

On an intake form or booking page, that comes out as two separate lines, with the box left empty:

We'll text this number about your appointment: a confirmation, a reminder the day before, and a check-in after your visit.

☐ Also send me Smile & Skin Clinic promos and offers. I can stop these anytime by calling or messaging the clinic.

In a Messenger booking, it's one question before you confirm:

Isa pa po: we'll text this number about your appointment. Pwede rin po ba namin kayong i-text ng mga promo? Okay lang po kung ayaw ninyo, tuloy pa rin po ang booking.

Then keep the record. Section 12 of the circular says you must be able to show what the patient was told, that she was told it when she agreed, and what she did to agree. On paper, that's the signed form in her folder. On Messenger, it's the thread, so copy her answer into her patient record before anyone cleans that thread up.

Promos by SMS have two more rules

The NTC's Memorandum Circular No. 03-03-2005 bars broadcast texts between 9 PM and 7 AM and expects people to have a way to stop them. The best time to send dental recall messages goes through it. If your texts go out under a send-only sender name like SmileSkin, "Reply STOP" reaches nobody. The way out has to be a number they can call or a Page they can message.

And never send a promo as a group message where every recipient can see the others. That hands every patient's number to every other patient. It's what a Viber broadcast list is for.

The inbox is where the real exposure is

Anyone with a role on your Facebook Page can open its inbox from their own phone, at home, on a Sunday. So start with who those people are. Five things to check this week:

1. Who can open the Page. Pull up the Page's access list and read every name. Remove anyone who's left, on their last day. Section 20(e) says staff keep patient information confidential and that the duty continues "upon termination of employment". That's their obligation. Removing their access is yours.
2. Who's logged in as whom. Give each person their own access instead of sharing one Facebook login. When a reply goes wrong, you'll want to know who sent it.
3. Where the photos land. Patients send gum photos, X-rays, HMO cards and IDs. When a receptionist saves one to forward to the dentist, it goes into her personal camera roll and, if backup is on, into the cloud. It's better for the dentist to read it in the Page inbox directly, or for the photo to go into the patient's record and come off the phone the same day.
4. The staff group chat. "Doc, tingnan niyo po 'tong pasyente," with a screenshot of the thread, sent to a group that includes the weekend part-timer and the owner's cousin who helps with the books. Every screenshot is a copy of sensitive personal information somewhere you don't control. Send clinical questions only to the people who need them, in a group with only those people in it.
5. What you ask for. Section 11(d) says data must be "adequate and not excessive" for the purpose. Booking a cleaning takes a name, a mobile number and a time. It doesn't take a photo of a valid ID. If you need HMO details to check coverage before the visit, ask for the HMO and the card number, not a photo of the card.

Public comments

A patient comments on your promo post: "Magkano po root canal? Sobrang sakit na po ng ngipin ko." She's put her own symptom in public. Don't add to it. Reply with the price, say "Sent you a message po," and take everything else to Messenger. What to say when a patient asks for a price over Messenger has sample replies.

Complaints need the same care. When a patient complains on your Page, the reply never confirms that she's your patient or what was done. Describing her treatment publicly is the clinic disclosing sensitive personal information, which is Section 32 territory. "We're sorry to hear this. Please message us so we can look into it" is the whole reply.

How long to keep threads

Section 11(e) says personal information is kept only as long as the purpose needs it, or for legal claims, legitimate business purposes, or as the law requires. Messenger keeps every thread until someone deletes it, and that isn't a retention policy.

A workable rule: anything clinical goes into the patient's record, because the chat isn't the chart. Then decide how long you keep threads after that, write it down, and put the same period in your privacy notice.

Write every SMS for the wrong reader

In plenty of Filipino households a phone gets shared, or at least handled by someone other than its owner. Lola's texts get read by her daughter, and the number on a teenager's record may be his mother's. Previews light up on lock screens left on the dining table.

So test every template this way: if the wrong person in the house reads this, what have they learned? Here are two reminders for the same appointment.

Too much:

Smile & Skin Clinic: Hi Ms Reyes, reminder po for your root canal (2nd visit) tomorrow 2:30PM. Remaining balance PHP 8,500.

Enough:

Smile & Skin Clinic: Hi Ms Reyes, see you tomorrow, Thu, at 2:30 PM. To change or cancel, open the Manage link in your confirmation text.

The second tells a stranger there's an appointment. The first tells them what's wrong with her tooth and what she owes. Keep treatment names, tooth numbers, balances and results for the clinic or a conversation with the patient, not a lock screen. Dental appointment reminder SMS templates has more that pass this test.

Two habits keep it working. Confirm the mobile number at every visit, because people change numbers and an old one may now belong to a stranger who'll read every reminder you send. And note whose phone it is. If the number belongs to the daughter who handles her father's appointments, write that on his record and keep those messages to time and place.

When something goes wrong

Sooner or later a reminder goes to the wrong patient, or a staff phone gets left in a jeepney.

Section 20(f) requires you to notify the NPC and the affected patients when sensitive personal information is "reasonably believed to have been acquired by an unauthorized person" and that's "likely to give rise to a real risk of serious harm". NPC Circular 16-03 gives you 72 hours from the moment you know, or reasonably believe, that it happened.

Not every slip meets that bar. A reminder that says only a time, sent to the wrong number, is a long way from it. A lost phone holding months of patient photos and screenshots could meet it. That's one more reason the lock-screen test matters: the less a message says, the smaller the problem when it goes astray.

On the day:

1. Stop it. Remove the access, change the password, and log the lost phone out of Facebook from another device.
2. Write it down: what happened, when, what information was involved, and who could have seen it.
3. Decide inside the 72 hours whether it has to be reported. If you're unsure, ask someone qualified then, not on day four.
4. Keep the note even when you decide it isn't reportable. It's your evidence that you took it seriously.

The paperwork a small clinic actually needs

1. A named data protection officer. Section 21(b) requires every controller to designate someone accountable. The NPC's Advisory 2017-01 says the DPO should be a full-time or organic employee and that consultants shouldn't hold the role. In a group practice, that usually means the clinic manager or a partner. For a self-employed dentist practising alone, NPC Circular 2022-04 treats the dentist as the de facto DPO.
2. A privacy notice in plain language, linked from your Messenger greeting, your booking page and your intake form. Section 16(b) of the Act lists what patients are entitled to know. The consent circular wants it short up front with the detail one link away, "in a language or dialect that an average member of the target audience can understand."
3. NPC registration, if you hold sensitive personal information on 1,000 or more people. That's Section 5 of Circular 2022-04. Storage counts as processing under the Act, so this means every patient whose record you keep, not this month's list. A clinic that's been open a few years and kept every patient card can cross 1,000 without anyone noticing, so count. Under the line, the same circular asks for a sworn declaration unless you register voluntarily.
4. A written contract with every vendor that touches patient data. Under Section 21(a) you stay accountable for data a third party processes for you, and you must use "contractual or other reasonable means" to protect it. That covers your booking system, your SMS provider and your chatbot. Ask for the contract before you sign up, not after.
5. A one-page staff rule. Who opens the inbox, on which phones, no screenshots to group chats, and access removed on the last day.

Section 20(c) lets security measures scale with "the size of the organization and complexity of its operations" and "the cost of security implementation". The law doesn't expect a two-chair clinic to run like a hospital. It does expect the basics.

Common mistakes

• Treating the Page inbox as nobody's job. Section 21 makes it yours.
• One checkbox for everything. "I agree to the clinic's terms, reminders and promotions" is the bundled consent the NPC circular rules out.
• A pre-ticked promo box. Untouched isn't agreed.
• "Reply STOP to unsubscribe" on a send-only sender name. The reply goes nowhere, and the patient keeps getting promos she tried to stop.
• Texting promos to a regular who said no at booking, because "suki naman siya."
• Deleting a Messenger thread that was your only record of consent.
• Assuming the vendor handles it. A vendor processing for you is a processor. You're still the controller.

Where OtterFlow fits

OtterFlow sits between patient messages and your appointment book. In the Act's terms, the clinic is the personal information controller and OtterFlow is a processor acting on the clinic's instructions. Our privacy notice says so in those words.

Here's the flow. A patient writes at 9 PM. Flo, the assistant, answers from the information your clinic approved. When the question is clinical, it doesn't answer. It hands the conversation to your team. The patient books into a time that's actually open, and the version of the privacy notice she was shown is recorded with her booking. Her confirmation and reminders go out by SMS through Semaphore, a Philippine gateway. Marketing messages, and recurring reminders that aren't tied to a booking, sit on a separate consent, and saying no doesn't stop anyone booking. If she needs to move the appointment, the Manage link in her text is tied to the mobile number on the booking, so only the person who made it can change it.

The notice also names the outside processors: Semaphore for SMS, OpenAI for the assistant's replies if you switch it on, and Google Calendar if you connect it. It says plainly that OpenAI and Google process data outside the Philippines. That's the list you should get from any vendor before you sign.

What OtterFlow doesn't do is name your DPO, write your clinic's privacy notice, or decide who has access to your Facebook Page. Those stay with you. If you'd like to see the consent and reminder flow running on your own clinic's details, we can walk you through it in fifteen minutes.

Questions owners ask

Do I need consent before replying to a patient on Messenger?

No. She wrote to you, and Section 12(b) covers steps taken at the patient's request before an agreement. Once you start asking for her details to book, tell her where your privacy notice is.

Can we send birthday greetings?

Treat them like promos. A birthday text runs on the patient's date of birth, and age is itself sensitive personal information under Section 3(l). Ask at booking, on its own line, the same way you ask about promos. Recurring patient SMS reminders covers how birthday and recall texts get set up.

A patient asked us to delete her messages. Do we have to?

Section 16(e) lets her have data blocked or removed when it's outdated, unlawfully obtained or no longer needed, among other grounds. You can keep what the patient record needs, and what you'd need for a legal claim, because Section 11(e) allows retention for "the establishment, exercise or defense of legal claims". Her copy of the conversation in her own Messenger is hers, and you can't delete it anyway.

We're a one-dentist clinic. Does all of this really apply?

Yes, scaled down. The basics apply to everyone: a DPO, which in a solo practice is you; a notice; consent for promos; and an inbox you control. What scales with size is how elaborate the security measures need to be, and whether you have to register.

What to do this week

Open your Page's access list today and remove anyone who's gone. Then read your last twenty reminders as if you were the patient's mother picking up her phone. Neither takes long. After that, split your promo consent from your booking, name your DPO, and count your patient records. And if you'd rather see a booking flow that keeps reminders and promos on separate consent without your front desk tracking it, that's what the 15-minute call below is for.