Cliniko practices that text patients about appointments, recalls, or waitlist openings need to prove those patients agreed to receive messages, and know exactly what to do when someone replies STOP. Under Australia's Privacy Act 1988 and the Spam Act 2003, health information sits in a more sensitive category than most business data, and an undocumented consent record or a missed opt-out can turn a useful reminder system into a compliance problem.
This guide covers what SMS consent actually means for a Cliniko-connected practice, why it carries more weight in healthcare than in most other industries, and how to build a consent workflow across Cliniko and DataFlows that captures opt-in, keeps it attached to the patient record, and handles opt-outs without manual follow-up. By the end, you will have a practical approach for keeping SMS reminders both effective and compliant, without adding extra admin work for reception staff.
This matters whether you run a single-practitioner physiotherapy clinic or a multi-site allied health group. A solo practitioner sending reminders from Cliniko still needs to be able to show, if asked, that a patient agreed to be texted. A larger group running recall campaigns across several clinics needs that same evidence multiplied across thousands of patient records, plus a reliable way to keep opt-outs in sync across every location.
What Is SMS Consent in Cliniko?
SMS consent is the recorded permission a patient gives a healthcare practice to contact them by text message, and it is the legal basis that makes every reminder, recall, or waitlist text sent through Cliniko and DataFlows compliant rather than unsolicited. In a clinical setting, consent usually happens at two points: when a patient completes a new-patient intake form, typically including a mobile number and a checkbox for SMS communication, and again implicitly whenever the practice sends a message directly tied to a booking the patient made themselves. Consent is not a single yes-or-no flag. It should record what kind of messages the patient agreed to, such as appointment reminders, recalls, or general updates, when that consent was given, and how the patient can withdraw it. A proper SMS consent workflow captures this in Cliniko's patient record, keeps it synced with your DataFlows contact list, and automatically suppresses messages to anyone who has opted out.
Why It Matters for Australian Healthcare Businesses
Health information is classified as sensitive information under the Australian Privacy Principles (APPs) in the Privacy Act 1988, which means practices are held to a higher standard when collecting and using patient contact details than a typical retail or hospitality business. APP 3 governs how you collect personal information, and APP 6 restricts how you use it once collected, including for follow-up SMS communication.
The Spam Act 2003 also applies to SMS. Purely transactional messages, such as a reminder for a booking the patient made themselves, generally fall under an existing business relationship exemption, but anything closer to marketing, such as a general health campaign or a recall promoting a paid service, needs documented consent to send lawfully.
Beyond the legal framework, patients hold healthcare providers to a different standard of trust than most businesses. A text message that feels intrusive, or a failure to honour an opt-out request, can damage a patient relationship in a way that is harder to repair than a lost retail customer. Getting SMS consent right protects the practice legally and protects the relationship with the patient.
There is also a practical reason to get this right early. The Office of the Australian Information Commissioner (OAIC) and the Australian Communications and Media Authority (ACMA) both have the power to investigate complaints about how personal information is collected and how electronic messages are sent. A practice that can point to a documented consent record and an automated opt-out process resolves those complaints quickly. A practice relying on memory or an outdated spreadsheet cannot.
Key Benefits of a Structured Consent Workflow
Reduced compliance risk: documented, timestamped consent records give the practice evidence it collected and used SMS numbers appropriately if a complaint or audit ever arises.
Higher deliverability and engagement: patients who have knowingly opted in are more likely to read reminders, confirm bookings, and respond to recalls rather than ignoring or blocking the number.
Cleaner contact lists: automatically syncing opt-outs between Cliniko and DataFlows Contact Lists keeps your SMS Campaigns free of patients who should no longer be messaged.
Stronger patient trust: clear, respected opt-out options signal that the practice takes patient preferences and privacy seriously.
Less manual admin: automated consent capture and opt-out handling means reception staff are not manually cross-checking spreadsheets before each SMS campaign.
Step-by-Step: Building a Compliant Cliniko SMS Consent Workflow
1. Capture consent at intake
Add an SMS consent field to your Cliniko new-patient intake form, separate from the general contact details, and phrase it clearly, for example: "I agree to receive appointment reminders and clinic updates by SMS." Store the date the form was submitted, since that timestamp becomes your consent record.
2. Connect Cliniko to DataFlows
Connect your Cliniko account to DataFlows through the Cliniko integration in your DataFlows dashboard. Once connected, patient contact details and consent status can flow into a DataFlows contact list, so your SMS Automation and Campaigns always reference an up-to-date, consented audience rather than a static export.
3. Register a recognisable Sender ID
Register your clinic's name as a Sender ID so patients see a recognisable sender rather than an unfamiliar number. This is a small detail, but it materially improves patient trust and reduces the chance a reminder is mistaken for spam or ignored.
4. Automate opt-out handling
Set up SMS Automation so that any reply containing STOP, UNSUBSCRIBE, or similar keywords automatically updates the patient's consent status and removes them from future SMS sends. This should happen without a staff member needing to manually process the reply.
5. Segment messages by consent type
Use Contact Lists to separate patients who have consented to transactional messages only, such as appointment reminders, from those who have also opted in to recalls or general clinic updates. This keeps every campaign aligned with what each patient actually agreed to.
6. Keep an audit trail
Maintain a record of when consent was given, what it covers, and when any opt-out occurred. Reviewing this periodically, particularly after importing new patient lists or running a bulk SMS campaign, helps catch consent records that have gone stale or were never properly captured.
Common Consent Scenarios in a Cliniko Practice
Not every SMS a practice sends carries the same consent requirement, and it helps to think through the common scenarios separately rather than applying one blanket rule.
New patient booking confirmation: this is transactional and directly tied to an action the patient just took, so it is generally covered as soon as the patient provides a mobile number for that booking.
Ongoing appointment reminders: still transactional in nature, but best practice is to confirm at intake that the patient is happy to receive these on an ongoing basis, not just for the current booking.
Recall campaigns for lapsed patients: a recall reminding a patient it has been six months since their last visit sits closer to a marketing message, particularly if it promotes a specific service, so explicit consent should be on file before sending.
Waitlist and cancellation-fill texts: these are typically sent to patients who have already asked to be notified of earlier openings, so the consent is captured at the point they join the waitlist.
General clinic updates: newsletters, service announcements, or promotions need their own consent category, separate from appointment-related messaging, since a patient may want reminders but not marketing.
How DataFlows Helps
DataFlows gives Cliniko practices the tools to run this workflow without building it from scratch. The Cliniko integration keeps patient contact details flowing into DataFlows automatically, Contact Lists let you segment patients by what they have consented to, and Sender IDs give your reminders a recognisable, registered identity in the patient's inbox.
SMS Automation handles opt-out keywords in real time, so a patient who replies STOP is removed from future messaging immediately rather than after a manual review. For practices sending recall campaigns or general updates alongside appointment reminders, SMS Campaigns lets you target only the contact list segment that has opted in to that type of message, keeping every send inside the boundaries of the consent that was actually given.
Best Practices for SMS Consent in Healthcare
Ask once, document always: capture consent clearly at intake and store the date and scope, rather than relying on an assumed or implied yes.
Make opt-out effortless: a patient should be able to stop messages by replying STOP, with no need to call reception or fill out a form.
Separate transactional from marketing: a booking confirmation and a promotional recall campaign are different categories of message and should be treated as such.
Review consent records regularly: especially after bulk imports, list migrations, or when reactivating lapsed patients.
Keep the language plain: patients should understand exactly what they are agreeing to without needing to interpret legal terminology.
Train reception staff: the people collecting consent at the front desk need to understand why the field matters, not just that it exists on the form.
Conclusion
A well-built SMS consent workflow protects your practice, respects your patients, and keeps your Cliniko reminders and recalls landing the way they are meant to. It does not need to be complicated: capture consent clearly, keep it synced between Cliniko and your SMS platform, and make opting out simple.
Ready to set up a compliant, automated SMS consent workflow for your Cliniko practice? Sign up at dataflows.com.au to connect your Cliniko account, register a Sender ID, and start sending reminders your patients have genuinely agreed to receive.
You May Also Like
Cliniko SMS Reminders with DataFlows
How to Send SMS from Cliniko
Cliniko Recall Reminders via SMS: Reactivate Lapsed Patients
Reduce No-Shows in Cliniko with SMS Confirmations
SMS Sender ID Registration in Australia