CRM for clinics: patient pipeline, WhatsApp appointment reminders and what the rules allow

What is a CRM for clinics?

A CRM for clinics organizes the relationship with a patient outside the clinical act: the first question on WhatsApp, the booked slot, the no-show, the follow-up, the treatment that stopped halfway. CRM stands for customer relationship management. One note for readers in Brazil: there, CRM also names the regional medical council and a doctor's registration with it. This guide has nothing to do with that.

A CRM answers questions your calendar can't. Who asked for information and never booked? Who booked, missed and didn't return? Who should have come back in October? Where do the patients who stay come from? Without a record, the answers live in the front desk's memory and in chats scattered across several phones.

It works for medical clinics, private practices, dentistry and aesthetics, with one important difference. Advertising rules vary by country and by licensing board, and health data gets special treatment nearly everywhere. So this guide separates what the product does, what the rule says and what is only our reading. Where we interpret, we say so, and your specific case calls for a lawyer.

CCX Messages covers this part of the operation, with a CRM and pipelines, a shared inbox, automated messages and an AI agent. The healthcare page shows how a reminder runs in the product. This article is useful even if you use another tool, because the rules and the message templates don't depend on the vendor.

Practice software, EHR and CRM: who does what

If you are looking for clinic software, you probably want an electronic health record, a calendar and insurance billing. CCX Messages does none of that. It has no appointment calendar, keeps no patient records, doesn't prescribe and doesn't bill. Your practice system remains the source of truth for appointments and for the patient's health.

The two work together through an API and webhooks. Your system signals that there's an appointment in 48 hours, CCX sends the reminder, the patient replies, and the answer goes back by signed webhook to whatever runs your calendar. There's no ready-made connector, so someone has to link the two. The integrations page shows what the API offers.

The practical split is simple. The EHR holds complaints, diagnoses, tests, prescriptions and progress notes. The CRM holds name, phone, source, stage, owner, last visit date and expected return date. If a piece of information only matters to the person treating the patient, it stays out of the CRM. That one rule prevents most of the problems in this guide.

In the Contact 360 record, each person has a timeline with conversations, notes and tasks, plus custom fields and tags. Watch the names you choose. A "return in 6 months" tag helps the front desk. A "diabetic" or "high-risk pregnancy" tag turns your CRM into a health record, with all the weight that carries. That's our advice: the law doesn't mention tags.

The CRM pipeline of a clinic: lead, first visit, follow-up and treatment

A clinic pipeline can have four stages. Lead: the person asked, on WhatsApp or Instagram, and hasn't booked. First visit: there's a booked slot. Follow-up: the person was seen and a return is agreed. Treatment: a plan is underway, with several sessions. In CCX, any inbox conversation can become a deal at the stage you choose.

Each stage takes a maximum time. A lead sitting for two days gets flagged on the board, so someone knows it needs an answer. Each stage also has a probability, and the board adds up total and weighted value. For a private-pay clinic, that shows how much sits in open quotes. If you only take insurance, value matters less and the head count per stage matters more.

A CRM for dental practices usually needs more stages in the middle: quote presented, quote approved, in treatment, finished and maintenance. The stalled quote needs the most attention, because the patient already came, was assessed and just hasn't decided. A short maximum time at that stage gets someone at the front desk to pick the conversation up before it goes cold.

A CRM for aesthetic clinics runs at another pace: assessment, session plan, in progress, finished and maintenance. Since each session depends on the last, add a next-session field. Separate pipelines when the timing differs. You can create as many as you need, so the dental and aesthetic sides of one group don't have to share a board.

At the end, each deal closes as won or lost, with a reason. Keep the list short and free of clinical data: price, insurance not accepted, schedule, distance, went elsewhere, no reply. After a few months, that list says more about your operation than the team's impressions do. For the wider topic, read our WhatsApp CRM guide.

Appointment reminder and confirmation messages: templates to copy

The WhatsApp messages below are templates, the format WhatsApp requires to start a conversation outside the 24-hour window. You submit the text for Meta's approval, and the words in braces are variables. None of them mentions a specialty, a procedure or the reason for the visit. Approval and final category are Meta's call, so check what comes back.

Template 1, appointment confirmation, sent at booking. "Hi {{name}}. Your appointment at {{clinic}} is booked for {{date}} at {{time}}. Address: {{address}}. If you need to change it, tap Reschedule." Button: Reschedule.

Template 2, appointment reminder, sent 48 hours before. "Hi {{name}}. Reminder: your appointment at {{clinic}} is on {{date}} at {{time}}. Can you confirm?" Buttons: Confirm and Reschedule. This is the main template. It can be this short because the patient only needs a date, a time and one tap.

Template 3, for those who didn't answer, 24 hours before. "Hi {{name}}. We haven't received your confirmation for {{date}} at {{time}} at {{clinic}}. Are you coming?" Buttons: Confirm and Reschedule. Send it once. People who feel nagged block the number, and then not even the next reminder arrives.

Template 4, backup reminder by email. "Hi {{name}}. We haven't heard from you about your appointment at {{clinic}} on {{date}} at {{time}}. To confirm or change it, reply to this email or write to us on WhatsApp." Replies go to your own address. In CCX, SMS backup only reaches Brazilian numbers, so plan on email anywhere else.

Template 5, preparation. "Hi {{name}}. We sent the instructions for your appointment on {{date}} to your email. Questions? Just reply here." Fasting, documents and directions go by email from the clinic's domain, where more text fits. That's the same split shown on our healthcare page.

Template 6, result available. "Hi {{name}}. Your result is available on the {{clinic}} portal. Log in here: {{link}}." The name of the test and its content stay behind the login. If the clinic has no portal, the message asks the person to contact the front desk, and delivery follows whatever route the clinic already uses.

Template 7, after a no-show. "Hi {{name}}. You had an appointment at {{clinic}} on {{date}} and we couldn't see you. Would you like to book another?" Buttons: Book and Not now. Meta may treat this text as marketing, because it invites a new booking. If that happens, it falls under the campaign rules described further on.

What not to write: "Reminder of your oncology visit with Dr. Lee to review the biopsy." The message shows on the lock screen and whoever is nearby can read it. A specialty's name counts too. If your clinic's name already points to the field, such as psychiatry or oncology, ask patients whether they prefer another channel. That caution is our reading, and the laws we checked don't go into this detail.

What happens when the patient taps Confirm or Reschedule?

The full path uses a journey. Your system sends an event 48 hours before, the journey sends the template and waits for the answer as long as you decide. With an answer, a signed webhook carries the tap to your system, which marks the slot as confirmed. Without one, you choose the next step in the builder, such as the email backup.

A tap on Reschedule reaches the inbox as the patient's reply, with the history alongside, and opens the 24-hour window so the front desk can write freely. They check the calendar in your practice system, offer two slots and record the change there. CCX doesn't change the calendar on its own. Your system does, when it receives the webhook, or your team does.

Without a developer, there are two routes. The Scheduling screen in the dashboard holds a queue of timed messages, one line per person, template and time. On saving, it checks that the template is approved, the variables are filled, the person hasn't opted out and the time is in the future. It suits a few slots. For the next day's list, use a scheduled campaign with a CSV whose columns fill the variables.

Either way, replies land in the inbox and the front desk updates the calendar by hand. It's more work, but it gets you started and shows whether the integration is worth paying for. If you integrate later, you lose nothing, because the same templates keep working.

We have no honest number for how much a reminder will cut no-shows at your clinic. It depends on your patients, your specialty and how the calendar is built. Measure your no-show rate and empty slots for a month before you turn it on and for a month after. Your own figure is worth more than any vendor's promise, ours included.

Follow-ups and recalls: when an appointment reminder becomes marketing

Follow-ups and recalls look alike, but they carry different weight. A follow-up is a return booked or requested by the clinician, with a date. A recall is an invitation to come back after a while, with nothing on the calendar: the six-month cleaning, the annual checkup, the aesthetic maintenance visit. The first reminds someone of a commitment. The second proposes a new one.

Meta's template category page, read on November 4, 2026, sets two conditions for utility: nothing promotional, and a message specific to, requested by or essential to the person. Mixed content counts as marketing. The page doesn't mention appointment reminders, so the rest is our reading: a booked slot leans utility, and "it's been six months, shall we book?" leans marketing, as our category guide explains.

Recall template, marketing category. "Hi {{name}}. This is {{clinic}}. It has been {{time_since}} since your last visit. Would you like to see available times?" Buttons: See times and Stop messages. No offer, no discount and no procedure name. Send it only to people who agreed to this kind of notice, and treat the second button as a request to stop.

In the CRM, a recall starts with a field. Store the expected return date, build a segment or let your practice system send the event, and use a journey with a wait. If the person books, take them out through the reply condition. If they don't answer, stop. In our opinion, two notices per cycle are plenty.

There's a case in between: the doctor asked the patient to return in 30 days and wrote it in the record. To us, reminding them of that sits closer to care than to sales. Meta, however, only sees the template's text and may classify it as marketing. Write it with the agreed date, leave out the reason, and check the category on approval.

WhatsApp for clinics and Instagram in a single inbox

At a clinic, the same person asks about prices on Instagram at night and writes on WhatsApp in the morning. If each channel lives on its own phone, the front desk answers twice, or not at all. A multichannel support platform fixes that, with one customer service system for every channel. The full concept is in our omnichannel guide. Here, what matters is the effect at the desk.

In the CCX inbox, WhatsApp and Instagram share one live queue. Round-robin looks at each person's load. Rules by tag, area code and priority send the conversation to the right team, and each team has its own hours. A group can separate locations, or dentistry and aesthetics, without changing numbers. There's no charge per agent.

For clinic support, SLA tracks the time of each reply turn, and the supervisor sees who's waiting. Saved replies keep address, accepted insurance and parking one "/" away. The satisfaction survey goes out on resolution, and our CSAT guide helps you read the result. Internal notes follow the earlier rule: nothing clinical in them.

Access control matters more here than in other sectors. There are nine roles, from owner to read-only, with two-step verification. A doctor's personal phone offers none of this, and when someone leaves the clinic, the history leaves too. Our team inbox guide explains how several people can use one number in an orderly way.

Instagram has its own limits. You can't blast a campaign through Direct: the patient starts the conversation, so reminders can't go that way. Comments can trigger an automatic keyword reply with a Direct message. Use that to move the question to private, and never to discuss symptoms, treatment or results in public.

Chatbot for clinics: what the AI answers and what goes to a person

The CCX Messages AI answers on WhatsApp and Instagram Direct from the knowledge base your clinic wrote. The safe ground is practical: address, parking, opening hours, accepted insurance, documents to bring, standard preparation approved by your team and how to book. It says it's an AI at first contact.

These go straight to a person: symptoms, pain, urgency, test results, medication, dosage, pregnancy, mental health and complaints. You list those topics in the dashboard and set the confidence threshold. If the patient asks for an agent, the conversation passes over at once, with the history. After someone on the team replies, the AI stays out of that conversation for 24 hours.

Add an urgency instruction to the base: if someone describes something serious, tell them to call the local emergency number (911 in the US, 112 in the EU) and hand the conversation to the team. Have a clinician review that text. The AI has no calendar of its own. With a read-only HTTP tool, it can look up slots in your system, and anything that writes depends on a person. The AI agent page has the details.

Regulators are starting to write this down. Brazil's Federal Council of Medicine (CFM), in Resolution 2.454/2026, published on February 27, 2026 and in force 180 days later, lists scheduling AI and chatbots with general information, with no personalized clinical advice, as low risk. It also bars doctors from delegating to AI the communication of a diagnosis, prognosis or treatment decision without human mediation.

The same resolution requires telling patients that AI is in use, and asks medical institutions for a preliminary risk assessment. That's Brazil's rule for doctors. We didn't check AI rules country by country, so ask your licensing board and your data protection officer. CCX doesn't do that assessment for you, and the line makes sense anywhere: no diagnosis from a bot.

The AI is processed in the US by sub-processors listed in the Trust Center, and the conversation text goes there so it can answer. CCX doesn't train models on your conversations. Include this flow in your processing records and tell patients about it. Test before going live: our AI agent guide has 20 questions, and you should add the ones your front desk hears most.

GDPR and HIPAA: health data is special, so the message should show little

In the EU, GDPR art. 9(1) prohibits processing data concerning health unless an exception applies, and art. 4(15) defines that data to include the provision of care when it reveals health status. Two exceptions matter here: explicit consent for specified purposes (art. 9(2)(a)), and processing necessary to provide care (art. 9(2)(h)), by or under a professional bound by secrecy (art. 9(3)). We read the text on November 4, 2026.

Our reading, which doesn't replace a lawyer: a reminder of a booked appointment has a reasonable case under the provision of care, and a commercial recall or a campaign doesn't. We didn't look for guidance from each national authority. Given that, the simplest route to defend is collecting agreement on the intake form, which also meets section 1 of WhatsApp's policy.

Text for the intake form, as two separate consents. "I authorize {{clinic}} to send me reminders and notices about my appointments on WhatsApp, at this number." "I authorize {{clinic}} to send me return invitations and news on WhatsApp." Neither is pre-ticked, and the person can ask to stop at any time. Our opt-in guide shows what to record.

Under GDPR the clinic is the controller, CCX is the processor, and art. 28(3) requires a contract between them, which is part of ours. Conversation retention is configurable from 30 days to 5 years, 180 by default. Data stays in São Paulo, Brazil, with the exceptions declared in the Trust Center: delivery by Meta, AI in the US, push providers and Cloudflare. For an EU clinic, that's an international transfer under Chapter V, so involve your data protection officer.

In the US, HIPAA applies to covered entities: health plans, clearinghouses and providers that transmit health information electronically in connection with covered transactions. It also reaches their business associates, and 45 CFR 164.502(e) requires written assurances from them. If you're covered, settle that with any vendor before protected health information enters the tool. CCX doesn't claim HIPAA compliance here, so talk to us first. Other state and federal laws may also apply, and we didn't review them.

Patients write whatever they want: "I need to move my appointment because I'm having surgery." You can't control that, but you control what happens next. Don't copy it into a CRM field or pass it around in an internal group. If a test arrives as an attachment, move the conversation to a person and to the channel your clinic uses for documents. Check whose number it is, too: a parent's, child's or spouse's phone shows the message to someone else.

Medical advertising and telehealth: what a licensing board can require

Medical advertising rules are set country by country, often by the licensing board. For this guide we read Brazil's, because they're recent and name WhatsApp directly. We didn't check other countries. Use what follows as a list of questions for your own board, since none of it binds a clinic outside Brazil.

Brazil's CFM Resolution 2.336/2023 defines advertising as communication to the public by any means. It lists WhatsApp among a doctor's own channels, allows using them to form, keep or grow a patient base, and lets doctors explain how to book, opening hours, location, parking and accepted plans. We searched it and the CFM's 2024 advertising manual and found nothing on reminders. Our reading: an individual reminder falls outside communication to the public, and a campaign falls inside it.

A clinic's advertising there must carry the establishment's registration and the technical director's name and license. The manual adds that a piece shared through messaging apps, such as WhatsApp and Telegram, must carry that identification itself. The technical director answers for the establishment's advertising. Ask your board whether a similar duty applies to you.

Brazil also bars guaranteeing, promising or suggesting good results, sensationalism and self-promotion, and advertising free services at a private practice. Discounts are allowed, without tied sales or prizes. Before-and-after images follow strict educational criteria, and to us they don't belong in a mass message. Results claims are a good first question for your own board.

On private messaging, CFM Opinion 14/2017, dated April 27, 2017, accepts WhatsApp between doctor and patient to send data or answer questions. The information stays confidential, and the app doesn't replace in-person consultations or further diagnostic follow-up at the doctor's discretion. It predates Brazil's telemedicine resolution, so the two should be read together.

Telehealth is where a messaging inbox should stop. CFM Resolution 2.314/2022 requires telemedicine care to be recorded in a patient record or in an electronic system at a specified security level, with patient consent. Wherever you practice, check the equivalent. CCX isn't a patient record or a telehealth platform. Use the inbox to book and to send the link to your platform, and hold the consultation there.

Dentistry and aesthetics: another board, other rules

Dentists usually answer to a different body. In Brazil, the Federal Council of Dentistry's Code of Ethics (Resolution 118/2012, amended by Resolution 271 of June 18, 2025) treats advertising with prices, free services and payment terms as an ethics breach. So a dental campaign with a price in the message carries a risk that a Brazilian doctor's campaign, in principle, doesn't.

The same code, as worded in 2025, bars offering services to solicit patients through outbound telemarketing to the general public, among other means. The 2025 change took discount cards, internet direct mail and promotional sites off the list, after a competition authority ruling. Our reading: since the list stays open, a blast to a purchased or cold list still comes close. Reminders and recalls to your own patients who agreed to receive them stay far from it.

Communications must carry a name and registration number, plus the technical lead's for a company, and owners, technical lead and other professionals involved answer jointly. Resolution 196/2019 allows selfies and images of diagnosis and of the finished treatment, with signed consent, and bars images of a procedure underway. Before-and-after remains delicate under the code, so Brazilian dentists should ask their regional council.

The council set up a group in 2025 to review this chapter of the code. We found no new text published by November 4, 2026. Outside Brazil we didn't check dental boards. If you run a dental clinic elsewhere, start by asking your board what it says about prices and about direct messages to patients.

Aesthetics depends on who signs. Physicians answer to the medical board, dentists to the dental board, and other professions to their own, whose rules we didn't check for this guide. Ask yours before your first campaign. In all cases the next section applies: WhatsApp's policy blocks promoting medical products.

WhatsApp's policy: what sections 3 and 4 mean for a clinic

WhatsApp's policy, in the version of September 23, 2026, has two passages that touch on health. Section 3 forbids using WhatsApp for telemedicine, or to send or request health information, where applicable regulations prohibit that data from moving through systems without heightened requirements. The condition matters: the text defers to local law.

Our reading: booking, confirming and reminding, with no clinical content, stays clear of that problem. Teleconsultation falls within it wherever local rules demand a dedicated record system, as Brazil's do. Results and diagnoses stay out of the message as a precaution, even where no express ban covers each case. We have no Meta decision or court ruling that confirms this reading.

The same section forbids asking for full payment card numbers, account numbers, ID card numbers or other sensitive identifiers. Don't ask for a national ID, passport or a photo of a document in the chat. Insurance member numbers aren't on the list, but as a precaution treat them the same way and handle registration through your portal or at the desk.

Section 4 lists what can't circulate, even with a license. That includes drugs of any kind, with or without a prescription, and "Medical and healthcare products". Section 5 opens exceptions in listed countries, including over-the-counter drugs, only through the API and only for people over 18. For most clinics, that exception changes nothing.

In practice, an appointment reminder promotes no product. "Botulinum toxin injection at a discount" does, and the clinic's license doesn't change that. Whitening kits, supplements and skincare sold by the clinic land in the risk zone. The policy doesn't name supplements or medical services, so part of this is our interpretation, and your specific case calls for a lawyer.

Breaking the policy puts the number at risk of restriction or a ban, and our banned account guide shows how that happens. At a clinic, the damage goes beyond the campaign. Tomorrow's reminders and today's support go out from the same number, and one badly written message can stop both.

Marketing for clinics and messages to patients: what's left after all the limits

Quite a lot. Notice of new hours or a new location, return invitations, educational content with no promises, prevention campaigns that identify who sponsors them. On Instagram the work is organic, and the question turns into a Direct conversation. Anything you send proactively on WhatsApp needs its own consent and a marketing template.

CCX campaigns go out by WhatsApp and email, with scheduling and an estimated cost before sending. Duplicates enter once, and anyone who opted out stays out. Segment by pipeline stage: someone in treatment doesn't need an invitation to an assessment. What each message costs is on plans and pricing.

Campaign template for a clinic. "Hi {{name}}. {{clinic}} now opens on Saturdays at the {{location}} location. To see times, tap below. Responsible clinician: {{director}}, license {{license}}." Buttons: See times and Stop messages. It names no condition, promises no result, and carries the identification some boards demand. Remove the last line if yours doesn't.

Messages to patients outside opening hours are another easy win. A greeting and an away reply say when the front desk returns and what to do in an emergency. These work inside the window, with no template, and our automatic messages guide shows how to set them up in the app and where it falls short. Keep the path to a person clear, as section 2 of the policy requires.

What CCX doesn't do, and when it isn't the right choice

CCX has no appointment calendar. It isn't an EHR, doesn't issue prescriptions, doesn't bill insurance and isn't a telehealth platform. There's no ready-made connector for practice systems: integration goes through an API and webhooks, and someone has to build it. We also have no ISO 27001 or SOC 2 report today, encryption isn't end to end, and SMS only reaches Brazilian numbers.

In some cases another choice is better. If you want a single product with records, calendar and reminders, and the built-in reminder is enough, practice software solves it with fewer parts. A solo practice with low volume can start on the WhatsApp Business app. A hospital or a group that requires a certification or a HIPAA business associate agreement by contract needs a vendor that provides it.

CCX makes sense when your clinic already has a calendar system that works and struggles with what happens around it: scattered conversations, reminders sent by hand, leads with no answer, several channels and several locations. In that setting, the CRM and the inbox complete what practice software wasn't built to do.

Where to start: an order that avoids rework

First, consent. Adjust the intake form with the two texts above and have your data protection officer or a lawyer review it. Without that, every send starts crooked. Then connect the number through the official API and submit templates 1, 2 and 3 for approval. Check the category that comes back on each.

Next, build one pipeline with the four stages and train the front desk to move conversations through it. Start reminders at one location or with one clinician, using Scheduling or a CSV campaign. Once the routine is steady, ask your practice software vendor to send the events and receive the webhook.

Leave the AI for later. Write the base with your team, list the topics that go to a person, do any risk assessment your board requires and test before going live. Recalls and campaigns come last, once you know how many patients agreed to receive them and who answers for each piece.