Many clinics are nervous about sending emails because of the way GDPR (and other privacy laws) were introduced. Unfortunately, a lot of consultants made GDPR sound like a minefield and scared businesses into thinking they couldn’t communicate with their own patients without risking fines.
The truth is simpler: as long as you are clear, transparent, and respectful of people’s data, you are on safe ground.
The Paragraph We’ve Created for You
To make this easy, we’ve put together a paragraph you can copy and paste and add directly into your clinic’s privacy policy. This is what we recommend you use:
"When you sign up to receive information from us, we will use your details to send you resources, updates and guidance related to the campaign or topic you registered for (for example, advice on managing a specific condition). From time to time, we may also share other health and wellbeing information that we believe will be useful to you, such as injury prevention tips, recovery advice, or seasonal guidance. Occasionally, we may include updates about our services or special offers. These emails are designed to be supportive and informative rather than purely promotional, and you can unsubscribe at any time using the link in our messages."
Why This Works Everywhere We Operate
GDPR (UK and EU): GDPR requires that you tell people what you’ll do with their data, use it fairly, and give them control (unsubscribe at any time). This wording ticks all of those boxes.
Australia & New Zealand (Privacy Act, Spam Act, Unsolicited Electronic Messages Act): Very similar requirements — you need consent, you must be clear about what you’ll send, and you must provide an unsubscribe option. The paragraph covers this.
Canada (CASL – Canada’s Anti-Spam Law): CASL is stricter about consent, but if you are transparent and provide an unsubscribe, you’re compliant. Our wording makes clear what people are signing up for and gives them control.
United States: You may not target the US much, but for completeness — CAN-SPAM requires a clear opt-out and a physical business address. The same paragraph works, with a small addition of your clinic’s postal address.
Why This Paragraph is Safe
This works legally because it is:
Specific: It tells people what to expect (resources, advice, updates, occasional offers).
Transparent: It makes clear that not all emails will be about the exact campaign they signed up for — but they’ll still be relevant and useful.
Balanced: It emphasises the majority of emails are informative, not promotional.
Controllable: It provides an unsubscribe route.
The GDPR Myth Busted
GDPR doesn’t stop you emailing people. It just stops you from:
Spamming them with things they didn’t agree to.
Hiding what you’re doing with their data.
Making it hard for them to opt out.
If you:
Say what you’ll do (transparency),
Do what you say (consistency),
Let people opt out (control),
…then you are compliant.
✅ Bottom line: This single paragraph, when added to your privacy policy, gives you the confidence to run campaigns, prize draws, clinical awareness emails, or even occasional promotions — without the fear of breaching GDPR or international rules.