A dental practice texts each patient the day before their appointment. The manager wants to add: "Book your next visit this month and save £20." The owner wants recall texts too.
So, are appointment reminders marketing? Not while they only remind. The Information Commission (the ICO) lists messages to "confirm or remind them about appointments" as service messages. Add that £20 line, and the whole text counts as marketing. Whether a recall counts as marketing is not settled for a private business.
Checked against the regulations and the ICO's guidance on 5 October 2026. WebAsk is a web and CRM agency, not a law firm. This is not legal advice.
TL;DR
A reminder about a booked appointment is a service message, but an offer or "reply YES for offers" makes it marketing. No source settles a private business's recall, so we build recalls as marketing. Clinic reminders can be health data, so our standard leaves the treatment out.
What the ICO counts as a service message
Can you send an automated text to confirm an appointment? Yes, as a service message. The ICO's direct marketing guidance says:
"Data protection law and PECR don’t stop you from telling your customers important information that they need to know as part of their relationship with you."
Service messages, it says, are sent "for administrative or customer services purposes". Its examples include appointment reminders and messages to "check their contact details are correct".
Under PECR, electronic mail "includes messages sent using a short message service" (regulation 2).
Then one rule decides the rest:
"If your service message has elements that are direct marketing, even if that is not the main purpose of your message, then it will count as direct marketing. However, if your service message contains general branding or logos, this doesn’t count as direct marketing."
The ICO also asks why you send it, and says "the phrasing, tone and context are likely to be a key factor".
What a reminder can say, line by line
The ICO's example is a data-limit text. Kept neutral, it "is likely to be a service message". Add "a special data offer just for you", and "this would be direct marketing".
"Our reading" below is our view where no source decides; "unsettled" means the sources leave it open.
| What the reminder says | Service message or marketing? | Why (sources read 5 October 2026) |
|---|---|---|
| The day, time, place and how to change it | Service message | ICO: messages to "confirm or remind them about appointments" |
| "Reply C to confirm" | Service message | The same ICO example |
| The business name and logo | Service message | ICO: "general branding or logos" do not count as direct marketing |
| One neutral line on how to update marketing preferences | The ICO says you "could" add it | ICO: a "minor addition to a message you were already sending", "as long as it does not encourage them to change their mind" |
| "Reply YES for offers" | Marketing | A consent request: the ICO lists "contacting people to ask them for consent to direct marketing" as a direct marketing purpose |
| An offer, a discount or a promotional banner | Marketing | ICO: a service message with "elements that are direct marketing" "will count as direct marketing" |
| "Book your next appointment" | Our reading: likely marketing | ICO: a message that "actively promotes or encourages people to make use of a particular service" is "likely to be direct marketing" |
| A recall or "you are due" text | Unsettled for a private business; we build it as marketing | The ICO calls a GP's "you are due" text a service message, in public-sector guidance that is under review (next section) |
| A review link | Unsettled; we keep it out of reminders | No ICO page we read mentions review requests. Its test asks whether content would "promote you or your interests" |
| "Check your details are correct" | Service message, unless it carries an offer or a consent request | ICO example: messages to "check their contact details are correct" |
| Aftercare instructions and who to call | Our reading: a service message while it only instructs | ICO example: "remind people how to contact you in case of a problem". Selling a product in it makes it marketing |
| The treatment, named | PECR: still a service message if nothing is promoted. UK GDPR: can be health data | ICO (under review): health data can include reminders, but they "must reveal something about a person’s health status". Our standard: leave it out |
| A prescription-only medicine, named | Never, by our standard | See "No prescription-only medicine in any message" below |
Consent requests, the soft opt-in and opt-out lists are in our database reactivation guide.
Reminders that ask for a new booking
Recalls, "you are due" texts, course follow-ups and MOT reminders ask for a booking that does not yet exist.
What the ICO's own example says
The only recall example we found is in the ICO's public-sector guidance, which is under review:
"Our records show you are due for x screening, please call the surgery on 12345678 to make an appointment."
"This message is a service message and does not constitute direct marketing," the ICO says. The sender is a GP.
Where no source decides it
No page we read applies that example to a private clinic, salon or garage. The ICO's general guidance says:
"If you want to send a message that actively promotes or encourages people to make use of a particular service, special offer, or upgrade, then it is likely to be direct marketing."
So a recall could fall on either side. NHS Wales leans towards marketing. Its guidance for GP practices (version 2, 25 November 2021) says consent "should be obtained" before call and recall texts. They "may be considered by the Information Commissioner (ICO) as marketing", it says, because "the Practice receives points for clinical indicators and subsequently payment". That is an NHS body's reading. The ICO's own example says the opposite.
How we build recall and due-date reminders
Our build position: a reminder about a booking already made is a service message. A due-date reminder that invites a new booking is built as marketing. It goes only to people who gave consent or fall within the soft opt-in (regulation 22(3)). It is our choice, not a ruling.
For dental recall, NICE guidance (CG19, 27 October 2004) says:
"The dentist should discuss the recommended recall interval with the patient and record this interval, and the patient's agreement or disagreement with it, in the current record-keeping system."
Our suggestion: then ask whether they want a text when it falls due, and record the answer with the date.
What every reminder should carry
No PECR rule we read says what a service message must contain. Regulation 23 covers "a communication for the purposes of direct marketing by means of electronic mail". Among other things, who it is from must not be "disguised or concealed". There must be "a valid address" to ask for the messages to stop. A service message is not bound by regulation 23.
Our standard goes further. Every reminder gives the business name, the date and time, how to change it and how to stop, plus the site if you have more than one.
Reminder templates and WhatsApp's rules
A reminder by text
A text in the GSM 7-bit alphabet "can consist of up to 160 characters" (ETSI TS 123 038, October 2025). In UCS2, it is "up to 70 UCS2 characters". Once split, each part holds 153, or 67 in UCS2 (ETSI TS 123 040). As we read the standard, an emoji, a curly apostrophe or a long dash is not in the 7-bit alphabet, so a text containing one needs UCS2.
Practice Name: Sam, your appointment is on Tuesday 1 December at 10:30. Reply C to confirm or call 0161 496 0123 to change it. Reply STOP to end reminders.
That is 155 characters in the 7-bit alphabet: one part. Swap in your practice name (and site, if you have more than one), allow for long first names, and recount. The number is in Ofcom's range for TV and radio drama, which "cannot be allocated to communications providers for their customers".
A reminder by email
Subject: "Your appointment on Tuesday 1 December at 10:30". Body: the business name; the date, time and address or video link; how to change or cancel; and how to stop reminders. A logo is fine. A promotional banner makes it a marketing email.
A reminder on WhatsApp
Meta's WhatsApp Business Messaging Policy (last updated 23 September 2026) says:
"You may only contact people on WhatsApp if: (a) they have given you their mobile phone number or username; and (b) you have received opt-in permission from the recipient confirming that they wish to receive subsequent messages or calls from you."
That asks more than PECR asks of a service message. Meta's template rules sort templates into three kinds: marketing, utility and authentication. A utility template "Must be non-promotional". Templates "with mixed content" count as marketing. We read a WhatsApp business message as one of the "in-app messages" the ICO's email guidance counts as electronic mail.
A recall text, built as marketing
Send it only to people with consent, or within the soft opt-in:
Hi Sam, Practice Name here. Your check-up is due in December, as agreed at your last visit. Call 0161 496 0123 to book. Reply STOP to opt out of these texts.
That is 157 characters; recount it with your names. It names the sender, so its source is not concealed (regulation 23). It offers a way to refuse "at the time of each subsequent communication", as the soft opt-in requires.
The lawful basis for sending reminders
Every reminder needs a lawful basis under UK GDPR. One is a contract, under Article 6(1)(b):
"processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;"
The ICO's contract guidance (under review) sets the bar:
"it must be more than just useful, and more than just part of your standard terms. It must be a targeted and proportionate step which is integral to delivering the contractual service or taking the requested action."
If it is not, the ICO says "you need to consider another lawful basis such as legitimate interests or consent". So Article 6(1)(b) may cover a reminder for a booked appointment; the ICO does not say. The ICO also says to "include information about your purposes and lawful basis in your privacy notice".
On the contract basis, the right to object "will not apply", the ICO says. Our standard: STOP still ends reminders. And reminders and marketing never share a template.
Clinic reminders and health data
The ICO's special category guidance (under review) says health data can include:
"appointment details, reminders and invoices which tell you something about the health of the individual. These fall under ‘the provision of health care services’ but must reveal something about a person’s health status. For example, a GP or hospital appointment in isolation will not tell you anything about a person’s health as it may be a check-up or screening appointment."
But, the ICO adds, you "could reasonably infer health data" from a list of appointments at an osteopath clinic. Our AI receptionist guide covers health data on calls.
If a reminder is health data, the ICO's guidance (under review) says:
"you must identify both a lawful basis under Article 6 and a condition for processing special category data under Article 9."
The condition for health care
Article 9(2)(h) covers processing needed for purposes that include "medical diagnosis, the provision of health or social care or treatment". The ICO's conditions page (under review) points to the Data Protection Act 2018, Schedule 1, paragraph 2:
"This condition is met if the processing is necessary for health or social care purposes."
Those purposes include "the provision of health care or treatment".
It applies only where the data is handled under an obligation of secrecy (Article 9(3)). Section 11(1) says that includes processing "by or under the responsibility of a health professional", or by someone who "in the circumstances owes a duty of confidentiality under an enactment or rule of law". Registered dentists are health professionals (section 204).
No source we read decides whether a cosmetic treatment is "health care or treatment". Explicit consent is another condition (Article 9(2)(a)). The choice is the clinic's to make and record.
Leave the treatment out of the text
Our build choice: name the business, the day and the time, and leave the treatment out. The ICO's rules page (under review) points the same way:
"The condition does not apply if you can reasonably achieve the same purpose by some other less intrusive means – and in particular if you could do so by using non-special category data."
Article 5(1)(c) says personal data "shall be" "limited to what is necessary". NHS Wales tells GP practices: "Never use text messages to convey personal or sensitive information".
Clinics and dental practices
No prescription-only medicine in any message
The CAP Code does not apply to:
"private correspondence, including correspondence between organisations and their customers about existing relationships or past purchases"
CAP's advice limits that to messages "not soliciting new business or advertising new products or services", though it does not bind the Advertising Standards Authority (ASA). So a recall may fall inside the Code, and under rule 12.12:
"Prescription-only medicines or prescription-only medical treatments may not be advertised to the public."
Our build standard: no reminder or recall names a prescription-only medicine, or hints at one. That goes beyond the Code, and keeping health data out points the same way. Our guide to clinic adverts covers the rest.
Dental recall and promotion as two flows
If recall and promotions share one flow, an offer can slip into a recall, and the recall becomes marketing. Our build standard: two flows, each with its own record of who may receive it. The GDC's advertising guidance says nothing about recalls or texts. Its website rules are in our GDC guide.
What to count
WebAsk has sent no reminders, so there is no figure here. Count your own weekly: reminders sent, confirmations, changes, no-shows and STOP replies. For recall, add bookings that follow and opt-outs. The government's NHS screening text principles (England, updated 5 April 2022) say to "Consider undertaking a baseline audit".
A checklist for reminders and recalls
- Reminders say who, when and how to change, and sell nothing.
- No offer or "reply YES"; no "book your next one" or review link (our standard).
- Recall goes only to people with consent or the soft opt-in (our build position).
- The lawful basis is recorded and in the privacy notice.
- Clinics: the Article 9 condition is recorded; no treatment or medicine named (our standard).
- Each text fits 160 characters in the 7-bit alphabet.
- On WhatsApp, the customer opted in first.
- STOP ends reminders (our standard); marketing opt-outs go on a suppression list.
Where to start
- Split reminders from marketing. Anything that sells, and recall as we build it, goes only to people you may market to. Our database reactivation guide sets out who.
- Check what your system sends against the table above. Our CRM and automation service includes "a booking calendar with SMS, email and inbound calling", and "each channel in the scope is tested end to end".
- Get in touch with what you run now and what you want it to do.