How applaud and your practice always stay compliant.
Many practice owners ask the same question before they start: how can an outside company text and call my patients? Here is the whole answer — where the consent comes from, what we are allowed to do, what we are not, and the rule behind each step.
The journey, in order
Consent is created before we arrive.
Nothing here asks you to collect a new permission. The patient gives you their number to become your patient; every stage after that is a limit on what may be done with it.
- 01
Your patient books, or fills in your intake form
TCPAThey write their mobile number on your booking page or your intake sheet, in the ordinary course of becoming your patient. That is the moment consent is created — and it happens between them and you, before applaud is involved at all.
Giving a business your number is consent to be contacted at it about the reason you gave it.
The detail - 02
You sign one BAA with applaud
HIPAAA single document, signed once, before we ever see a patient. From that moment applaud is your business associate — bound by the same rules you are, with direct liability of its own.
The Business Associate Agreement is the mechanism HIPAA provides for exactly this.
The detail - 03
We receive the minimum, and nothing else
HIPAAThe patient's name, a mobile number, and the date they came in. No diagnosis, no chart note, no billing detail — because none of it is needed to ask someone how their visit went.
Minimum necessary: a business associate gets only what the task actually requires.
The detail - 04
We follow up, about their visit
HIPAAOne message from your practice, inside your hours, asking how it went. Never about anything else, never about applaud, never for us. To your patient it is simply their dentist checking in.
Following up on a patient's experience is your own health care operations — no separate authorization needed.
The detail - 05
They answer — or they stop it, instantly
TCPAA reply comes back to you privately, whether it is praise or a complaint, while there is still time to act. And any patient who wants out is out: STOP ends it immediately and permanently, on every channel at once.
Consent is the patient's to withdraw, at any time, by any reasonable means.
The detail - 06
Every patient gets the same review invite
FTCDelighted or annoyed, the same link goes to all of them. We never survey first and then quietly show the public link only to the happy ones — and it is not a policy we could drift from, it is written into the code and locked by a test.
Asking only the happy ones is review gating, which the FTC's reviews rule prohibits.
The detail
HIPAA and the BAA
We are not a third party. We are you, for this one job.
HIPAA does not forbid a practice from using a vendor to handle patient information. It specifies how: the vendor becomes a business associate under a signed Business Associate Agreement, and is then bound by the same rules you are, with direct liability of its own.
Following up on how a visit went is part of your practice’s own health care operations — the regulation names quality assessment and improvement and evaluating provider performance explicitly. A practice may use patient information for its own operations without asking the patient to sign anything further, and may disclose it to a business associate to carry them out. It receives only what the task actually requires.
It is worth saying what this is not. HIPAA’s definition of marketing covers communications that encourage a patient to buy or use something. Asking someone how their appointment went sells them nothing.
Minimum necessary
The patient’s name, a mobile number, and the visit date. Not diagnoses, not chart notes, not billing.
No clinical detail leaves
Outbound text is scanned against a denylist before it can be sent.
Sub-processors under BAAs
Including the AI running the voice calls, covered by our agreement with AWS.
Names stay behind your login
Patient names and their exact words are never put into an email.
Texting
The number your patient gave you is the consent.
Under the TCPA, when someone gives a business their telephone number, that is consent to be contacted at it about the matter they gave it for. Your patient handed you their mobile so your practice could reach them about their care. A message asking how the visit went sits squarely inside that.
Two things follow, and both are limits rather than permissions. The consent belongs to your practice — so every message goes out in your name, from your number, about their visit with you. And it is theirs to withdraw at any moment, by any reasonable means.
STOP is honoured instantly
Not within the days the rules allow. Any recognised opt-out ends messaging immediately and permanently.
Quiet hours on your practice’s clock
We send only between 9am and 8pm in your practice’s local time, and where a state sets tighter hours, the tighter window wins.
Checked at the moment of send
Your practice’s time zone is set when you join and shown on your account page. Every message is checked against it as it leaves, not when it was scheduled.
Registered with the carriers
Every campaign runs under A2P 10DLC and the CTIA messaging rules, so messages arrive as legitimate business traffic.
Calling
The same consent, on your practice’s hours.
The legal basis for a call is identical to a text — the number was given to your practice, and the call is about the visit, so the same TCPA consentcarries it. What differs is when we ring. A badly timed call costs a practice more goodwill than it can ever earn back, so calls run only in the hours you set, on your practice’s clock.
Your hours, never ours
Proactive calls run only inside the calling hours the practice sets, on the days it chooses — and never outside our 9am–8pm quiet hours in your practice’s local time, whichever is stricter. Outside that, a call waits rather than drops.
A requested callback wins
If a patient asks to be called at a time, their request outranks our window.
It says what it is
The caller identifies itself as an assistant calling for your practice. It does not pretend to be a person.
Recordings deleted at 14 days
From our systems and from the telephony provider, whose own default would otherwise keep them a year.
Reviews and the FTC
We ask everyone. Including the ones who will not be kind.
This is where most review services quietly break the rules. The pattern is called review gating: survey the patient first, then send the public review link only to the ones who answered well, and route everybody else to a private complaint form. It reliably produces a beautiful rating, and it is deceptive — what a prospective patient reads no longer represents the patients who were actually asked.
The FTC’s reviews rule, in force since October 2024, targets exactly this family of conduct, and the Endorsement Guidesgovern how a review may be collected and shown in the first place. Google’s own policies prohibit gating independently of either.
applaud does not gate, and that is not a policy — it is the code. The function deciding whether to offer the review link takes the patient’s sentiment score as an input and ignores it. Someone who rated the visit 2 out of 10 is offered the same link as someone who rated it 10, and an automated test locks that behaviour so it cannot be softened later by editing a script.
What sentiment does decide is who hears about it and how fast. An unhappy patient gets a person, quickly. They still get the invite.
We never write it for them
No ghost-written reviews, and no supplied wording to paste.
Nothing is offered in exchange
No discount, no entry, no incentive of any kind for leaving one.
Negative reviews are never suppressed
Not hidden, not delayed, and nobody is ever pressured over one.
A person confirms before we bill
Automated matches never count on their own.
The short list
What we will never do, whoever asks.
Everything above is how the system is built. This is the part that does not change with a setting, a plan, or a request from anyone — including from you.
Contact them about anything else
Only their visit with you. Never another subject.
Market applaud to your patients
They never hear our name or become our leads.
Put clinical detail in a message
Not in a text, not in a call, not in an email.
Message someone who opted out
For any reason, on any channel, ever.
Filter the ask by how happy they are
The review invite is offered to every patient.
Use your patient list for ourselves
It is yours. We hold it to do your job, under your BAA.
Sources
Read the rules yourself.
Every claim above rests on one of these, and these are the primary texts rather than somebody’s summary of them. Take them to your own attorney if you want a second opinion, which is a reasonable thing to want.
- What counts as “health care operations” — quality assessment and improvement, and evaluating provider performance45 CFR § 164.501
- A practice may use and disclose patient information for its own treatment, payment and health care operations45 CFR § 164.506(c)
- Business associate contracts — the mechanism for a vendor acting on a practice's behalf45 CFR §§ 164.502(e), 164.504(e)
- Minimum necessary — a business associate receives only what the task requires45 CFR § 164.502(b)
- Telephone Consumer Protection Act rules, including consent and revocation47 CFR § 64.1200
- A consumer may revoke consent by any reasonable means, and it must be honoured47 CFR § 64.1200(a)(10)
- FTC Rule on the Use of Consumer Reviews and Testimonials — fake reviews, bought reviews, suppression16 CFR Part 465 · in force since 21 Oct 2024
- FTC Endorsement Guides — how reviews and testimonials may be collected and shown16 CFR Part 255
- CTIA Messaging Principles and Best Practices — the carrier rules every business text must satisfyCTIA
Still want it in writing
We will send the BAA before you send us a single patient.
And if you want belt and braces, we will give you a one-line consent sentence for your intake form that puts the question beyond argument.
This page explains how applaud is built and which rules it is built to satisfy. It is not legal advice and it does not create a lawyer-client relationship. Your practice remains the covered entity, and your own counsel is the right person to sign off on how you use any vendor — including us.