Guides
CRM for clinics: appointments, patients and follow-up
Published November 7, 2026 · 7 min read
A CRM helps a clinic manage contacts, appointments and follow-up, but it should not hold the clinical record. Health data is a special category under the GDPR, so the CRM should keep only what is needed to contact a person and remind them of an appointment. This guide covers what to store, what to leave out and how to automate reminders without recording anything clinical.
What the CRM can hold, and what it should not
| Data | In the CRM? | Note |
|---|---|---|
| Name, phone and email | Yes | What you need to make contact. |
| Appointment date and time | Yes | With no clinical reason attached. |
| Source of the contact (website, referral) | Yes | Useful to see where patients come from. |
| Consent for communications | Yes | With a date and source. |
| Diagnoses, treatments or reports | No | They belong in the clinical system, under its own rules. |
| Reason for visit | Better not | Even a generic reason can reveal health information. Decide with your DPO. |
Why health data has limits
The GDPR treats health data as a special category (Article 9), with stricter rules than ordinary personal data. The text is on EUR-Lex. Medical record rules also differ by country and sometimes by region, so your data protection officer should review what the CRM keeps.
Appointment reminders without anything clinical
A good reminder says when and where, and asks for a reply. Example (hypothetical):
Hi [name], this is a reminder of your appointment on [day] at [time] at [location].
Reply YES to confirm, or call us to change it.
The message does not name the service or the treatment. If the channel keeps a copy of the message, nothing clinical is stored. The guide to automated appointment reminders explains how to schedule them.
How to automate follow-up
A simple flow has four triggers:
- Appointment created: an immediate confirmation with date and location.
- Before the appointment: a reminder with the option to confirm or cancel. You decide the timing.
- No confirmation: an alert to the team to call or release the slot.
- After the appointment: a generic thank-you message that does not mention the treatment.
Flowgration has bookings, journeys with date and inactivity triggers, and sending by email, SMS and WhatsApp. It does not store clinical records. If your clinic uses a clinical management system, the CRM complements it rather than replacing it.
What not to do
- Do not use the patient list for marketing campaigns without separate consent for marketing.
- Do not send reports, test results or photos by email or WhatsApp from the CRM.
- Do not give every staff member the same access. Use roles and per-module permissions: reception does not need to see what management sees.
Frequently asked questions
Can a clinic use a CRM?
Yes, for contacts, appointments and administrative follow-up. It should not hold clinical information. Check the scope with your data protection officer.
Do I need consent to send appointment reminders?
It depends on the case and the type of message. A reminder for an appointment already booked often has a different basis from a marketing campaign. Confirm with your DPO.
Can I mention the treatment in an SMS?
It is not advisable. The message may reach a phone that is not only the patient's. Include only the date, time and location.
Who can see the data in the CRM?
You decide with roles and per-module permissions. Limit access to what each person needs for their job.
What if a patient asks me to delete their data?
Handle the request within the GDPR time limits and review any applicable exceptions with your DPO. The GDPR and CRM guide helps you organize it.
Build your WooCommerce CRM in 60 seconds
Flowgration turns your store's orders into a living CRM and runs email, SMS and WhatsApp on autopilot. Free up to 500 contacts.
Start free