AtlacareAtlacare sends two fundamentally different kinds of message, and the rules for each are different. Getting this right keeps you the right side of UK GDPR and PECR.
Transactional messages
These are tied to a specific interaction the patient is already having with you: appointment confirmations, reminders, cancellations, invoices, portal magic links. They're necessary to deliver the service, so they send to the relevant patient regardless of marketing consent — a reminder isn't marketing.
Marketing messages
These promote something or re-engage: newsletters, offers, "we miss you" re-activation, recall campaigns framed as promotion. These may only go to patients who have given marketing consent.
Atlacare enforces this for you: campaigns only send to patients with marketingConsentGiven set — a patient who hasn't opted in is automatically excluded from a marketing send, even if they're in the target group.
Where consent is recorded
A patient's marketing consent is on their record and summarised under Settings → GDPR & Consent. Consent must be a positive opt-in (not pre-ticked), and patients can withdraw it at any time.
The grey area: recalls
A genuine clinical recall ("you're due your annual review") is care, not marketing. A recall dressed up to drive rebookings for revenue leans towards marketing. Keep recalls clinically justified and you stay on the transactional side — see setting up recalls.
If in doubt, ask: would this message be sent even if I had nothing to promote? If yes, it's transactional. If it only exists to market, it needs consent.