Direct Marketing and Patient Communications Privacy Policy Template

What's in this template?

This Direct Marketing and Patient Communications Privacy Policy gives Australian healthcare practices one document covering the three laws that govern a promotional message: Australian Privacy Principle 7 (Privacy Act 1988), the Spam Act 2003 for email, SMS and instant messaging, and the Do Not Call Register Act 2006 for telemarketing. It is built from the OAIC's APP Guidelines (Chapter 7) and the OAIC's health-specific guidance on communications with patients.

The template includes:

1. The three laws mapped to channels so you can see which regulator governs email, SMS, phone, post and website tracking
2. The clinical, administrative or marketing test with 10 worked practice examples, the section most practices get wrong
3. Consent rules, including what does not count as consent and how to record it so it can be evidenced
4. A message compliance table: sender identification, unsubscribe, validity period and action times
5. An opt-out handling procedure with a 5-step workflow, owners and timeframes
6. Prohibited practices, including My Health Record data, health-attribute targeting and list sharing
7. Third parties, platforms and website tracking, covering pixels, custom audiences and consent tools
8. Website, social media, reviews and testimonials aligned to the AHPRA advertising restrictions
9. Appendix A: consent wording you can lift straight onto a registration form
10. Appendix B: an opt-out and consent register
11. Appendix C: a pre-send checklist to complete before every campaign

Editable placeholder fields

• {{practice_name}}, {{practice_address}}
• {{privacy_officer}}, {{privacy_officer_email}}
• {{communications_owner}} and {{clinical_lead}}
• {{clinical_software}} where consent status is recorded
• {{optout_action_days}} your internal opt-out action standard (the template defaults to 2 business days)
• {{effective_date}}, {{next_review_date}}, {{approved_by}}

Where this sits alongside your other privacy documents

This is a narrow APP 7 document. It does not replace the documents around it:

• Your Privacy Policy is the umbrella APP 1 statement covering everything the practice does with personal information.
• Your Patient Data Collection Notice is the short APP 5 notice given at the point of collection.
• Your Recall and Reminder System Policy governs clinical communications: recalls, reminders and results. Those are not marketing, and this policy deliberately excludes them.

That last distinction is the one that matters most in practice, so it has its own section below.

The clinical versus marketing test

The OAIC's position is straightforward once you see it stated plainly. A message about an individual patient's own clinical need is not direct marketing. A message promoting a service to a group is.

Two traps sit inside that table.

The first is the flu clinic. Practices treat it as a clinical reminder because vaccination is clinical, but a message sent to the whole database promotes a service rather than responding to an individual patient's clinical need. Where a patient's own history and a defined interval drive the message, it is a reminder. Where the trigger is that the practice has stock and a clinic date, it is marketing.

The second is bundling. A clinically indicated reminder with a promotion attached becomes a marketing message in full, and now needs consent it probably does not have. The policy's working rule is to send them separately.

What the law actually requires

APP 7.4 permits direct marketing that uses sensitive information only with the individual's consent. Nearly everything a practice holds about a patient is health information, which is sensitive information, so consent is the default position rather than the exception. Where consent cannot fairly be implied from the patient's own conduct, the OAIC expects express consent.

APP 7.8 means APP 7 stands aside where the Spam Act or the Do Not Call Register Act already covers the conduct. That carve-out is narrow: it displaces the APP 7 marketing rules only. Every other Australian Privacy Principle still applies to the same message, which is why an email can satisfy the Spam Act and still breach the Privacy Act.

The Spam Act requires three things in every commercial email, SMS, MMS or instant message: consent, accurate identification of the sender, and a functional unsubscribe. The unsubscribe must keep working for at least 30 days, must not require a login or extra personal information, and must be actioned within 5 business days. The ACMA's consistent position is that the sender must be able to produce evidence of consent for each recipient.

APP 7.6 gives patients the right to ask where you got their details. The practice must respond free of charge and within a reasonable period.

How to customise this template

1. Download the Word document and replace every {{placeholder}} with your details.
2. Work through Section 5 first. List every message type your practice sends and sort each one into clinical, administrative or marketing. This is the exercise that changes behaviour, and it is the one an assessor or investigator will effectively be running when they look at your sends.
3. Set your opt-out action standard. The template uses 2 business days against the Spam Act's 5, which leaves margin when someone is on leave.
4. Add Appendix A to your forms: the paper registration form, the online intake form and the website enquiry form. Keep the consent unticked and separate from consent to treatment.
5. Set up the register in Appendix B in your clinical software or as a spreadsheet, and check the suppression list before every send.
6. Review your website tracking against Section 10 before you publish the policy, because that is the area most likely to be non-compliant today.
7. Brief reception, who receive most verbal opt-outs and need to know they count.
8. Review every two years, or sooner if you add a channel or platform.

Website tracking is part of this policy

The most common gap is not the newsletter. It is the marketing technology already running on the practice website.

Advertising pixels and analytics tools can transmit health-related signals, such as which service page a visitor viewed or which appointment type they booked, to an advertising platform. The OAIC treats that as a disclosure of sensitive information requiring consent, and has taken enforcement action against Australian health providers on exactly this point. Our post on the OAIC tracking pixel determinations covers what was decided and what practices had to change, and the six website privacy mistakes post covers the related fixes.

Section 10 of the template brings that under the same policy as the newsletter, because it is the same obligation.

Related templates and tools

• Recall and Reminder System Policy: the clinical counterpart. Between them, the two documents cover every message a practice sends.
• Privacy Policy: the parent APP 1 document this policy sits under.
• Patient Data Collection Notice (APP 5). The consent wording in Appendix A belongs beside it on your registration form.
• Third-Party Data Sharing Agreement: use it for your email platform, SMS gateway, mailing house and agency.
• Data Breach Response Plan: for the group email that exposes addresses in the To field.
• Notifiable Data Breach assessment tool: if a send has gone wrong, start there.
• Healthcare privacy and cyber security: how APP 7 fits the wider privacy picture.

Frequently asked questions

Do we need patient consent to send a practice newsletter?

Yes, in almost every case. A newsletter is direct marketing, and because your patient list is built from health information, APP 7.4 requires consent to use it for marketing. If the newsletter goes by email or SMS, the Spam Act applies as well and requires consent, sender identification and a working unsubscribe. The safe position is an express opt-in recorded against the patient record.

Are recalls and reminders direct marketing?

No. A recall or a reminder about the individual patient's own care is clinical communication, not marketing, and the OAIC's health guidance is explicit about this. It stops being clinical if you attach a promotion to it, or if you send it to the whole database rather than to patients whose own history indicates it. Clinical recalls are governed by your Recall and Reminder System Policy.

Is a flu clinic SMS to the whole patient list a reminder or marketing?

Treat it as marketing. The trigger is the practice's clinic date rather than an individual patient's clinical interval, and it promotes a service. A vaccination reminder to patients whose own record shows they are due, generated from that record, is a clinical reminder. The distinction is what drove the send.

How quickly do we have to action an unsubscribe?

The Spam Act requires an unsubscribe request to be actioned within 5 business days, and the unsubscribe facility must remain functional for at least 30 days after the message is sent. For opt-outs under APP 7 the OAIC expects a reasonable period, generally no more than 30 days. The template sets an internal standard of 2 business days across all channels, which is simpler for staff than tracking three different clocks.

Can we use patient details from My Health Record for marketing?

No. The My Health Records Act permits collection, use and disclosure only for the purposes set out in the Act, and marketing is not one of them. Unauthorised use carries civil and criminal penalties. The template lists this among prohibited practices.

Do we have to check the Do Not Call Register before phoning patients?

If the call is telemarketing, yes, unless the person has given express consent to be called by the practice. Calls about a patient's own care, such as arranging follow-up or discussing a result, are not telemarketing and are not affected. The register does not apply to email or SMS, which are governed by the Spam Act instead.

Can we ask patients for a Google review?

Asking is marketing, so it needs consent and an unsubscribe like any other promotional message. Separately, the National Law restricts the use of testimonials about clinical care in advertising for a regulated health service, which is enforced by AHPRA. That restriction is about how reviews are used in your advertising rather than about their existence, and the template's Section 11 sets out a workable position: do not solicit or publish reviews that comment on clinical care or outcomes.

What records do we need if the ACMA investigates?

Evidence of consent for each recipient, a copy of the message, the list it went to, and proof the unsubscribe worked. The ACMA's position is that the sender must produce the consent, not that the recipient must disprove it, so a list with no consent record is a list you cannot lawfully send to. Section 14 of the template sets out the full record set.

Does an opt-out from marketing stop clinical recalls?

No, and it is worth telling the patient that when you confirm the opt-out, so they are not left uncontacted for clinical care. A patient may separately ask not to receive clinical reminders, which is a different decision, recorded separately and handled under your recall and reminder policy.