Clinic software: what it must do, and what it never does

By Jorge Birck · Founder, I Am Vicky
Published Aug 22, 2026 · Updated Aug 22, 2026

The practice spent three months moving to a new system. Records exported, insurer tables rebuilt, the team trained over two weekends, a new contract signed. On the first Monday after go-live, reception opens WhatsApp and finds exactly what was there before: the overnight messages stacked up, people asking about prices, people asking to move an appointment, someone who wrote at 11pm and never got an answer.

The new software works. It was simply never built for that.

The confusion is expensive because it happens before the signature, while you are comparing vendors. The owner thinks they are choosing “the system”, singular, when they are choosing half of it — the half that faces inwards. So it is worth being precise about what the rules in the Gulf and the UK actually demand of clinic software, what they say nothing about, and where the part your patient can see actually lives.

What does “clinic software” actually cover?

Patient records, the diary, billing, insurer claims and reporting. In other words, the system your team types into after something has already happened, or to schedule something that has already been agreed.

That is the honest description of the category, and it explains its blind spot. Every workflow inside a practice management system starts with a member of staff. The patient never touches it — they are represented in it, as a row, a slot, an invoice. Which is fine, until you notice that the moment a clinic actually wins or loses revenue is the moment a stranger sends a message asking whether you have anything on Thursday.

What does UAE law require of clinic software?

Before any feature comparison in the Gulf, one question settles the shortlist: where does the data physically sit? Under UAE Federal Law No. 2 of 2019 on the use of ICT in health fields, the answer cannot be “our cloud, somewhere”.

As Latham & Watkins summarised in its client alert of 19 June 2019, “Article 13 of the Law states that health data related to health services provided in the UAE may not be stored, processed, generated, or transferred outside of the UAE, unless such activity has been approved by a decision of the health authority or the Minister”. The same alert records the penalty attached to that obligation: a fine “between AED 500,000 and AED 700,000” for violating the data localisation requirement.

Retention is set in the same law. Article 20, per the alert, requires that “health data must be kept for a minimum of 25 years from the date on which the last health procedure was performed on the patient”, and that period “may be longer if it is commensurate with the need to keep such data”.

Twenty-five years is a long relationship with a vendor. It makes two contract questions non-negotiable, and neither appears on a pricing page: in which country is the data hosted, and in what format do you get it back on the day you leave.

Is an appointment reminder really health data under UK GDPR?

For a UK private clinic, the sharper question is not where the data lives but what class it belongs to — and the answer catches most practices by surprise, because it reaches the messaging tools, not just the records system.

The UK GDPR treats “data concerning health” as special category data, defined in Article 4(15) as “personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status”. The ICO’s detailed guidance then spells out how far that reaches. Health data includes “appointment details, reminders and invoices which tell you something about the health of the individual”, and the ICO explains that while a single GP or hospital appointment may reveal nothing on its own, “you could reasonably infer health data from an individual’s list of appointments at an osteopath clinic or from an invoice for a series of physiotherapy sessions”.

Read that against how a typical practice runs its reminders: a spreadsheet of names and mobile numbers, exported weekly, pasted into whatever bulk-messaging tool reception found. If a list of appointments at a physiotherapy clinic can reveal health status, that spreadsheet is special category data leaving your controlled system. The messaging layer is not an accessory to the clinical record. It is part of the same duty of care over the data.

Where does your practice management system stop?

It stops at the edge of your team. Everything inside is designed for staff; the conversation that decides whether tomorrow’s chair is filled happens outside.

The cheapest way to see it is at 11pm. A parent messages asking whether you have anything for her son on Thursday. Inside the system, the slot exists — the diary is right there, open, with the gap in it. Outside, nobody opens the door. The receptionist is asleep, the message joins the queue, and by 8:40 the next morning it is buried under twenty others. By the time someone replies, she has booked with the clinic that answered in the same minute.

No retention policy, no localisation clause and no records module changes that scene. It belongs to a different product category: the one that reads the request, checks the diary and comes back with a booked appointment. It is the same distinction that separates WhatsApp appointment booking from a booking portal — the patient does not want to log in anywhere, they want to settle it in the thread already open on their phone.

Why does the patient layer have its own rulebook?

Because it does not run on your servers. The moment the conversation happens on WhatsApp, Meta’s rules decide what you may send, when, and at what cost — and none of that is described in a practice management contract.

Two mechanics matter for a clinic. First, cost is now per message: Meta’s pricing documentation states that “effective July 1, 2025”, charging moved to a “per-message basis”, and that “you are only charged when a template message is delivered”. Second, and this is the part almost nobody uses on purpose, “utility templates delivered within an open customer service window are free” — while “all marketing template messages are charged”, window open or not.

The operational reading: a clinic whose patients actually reply, and which replies quickly in return, keeps a service window open and pays less for its own reminders than a clinic that only broadcasts. Speed of response is not just a conversion tactic in a WhatsApp-first market. It is also the cheaper way to run the channel. Which is another way of saying the patient-facing layer has its own economics, and your records system was never designed to optimise for them.

Does “AI” in your PMS mean AI that talks to patients?

Usually not. When a practice management system advertises artificial intelligence, it typically means AI pointed inwards: transcribing the consultation, drafting the clinical note, summarising history, generating reports. That is genuinely useful and it saves clinician time.

It just does not speak to the patient. And there is a third thing in between that muddies the label further: automated reminder broadcasts. Sending a message the day before an appointment is a notification, not a conversation. The difference shows the moment a patient replies with anything other than “yes” — “can I move it to Friday?”, “how much is it?”, “do you take my insurance?”. A broadcast has nowhere to put that reply. An AI agent does, which is the whole argument we set out in our guide to a healthcare WhatsApp chatbot.

Do you have to replace your clinic software to add an AI receptionist?

No — and that is what saves you the three-month migration this article opened with.

Records are one category; the front desk is another. The conversation layer sits alongside whatever the practice already runs: it receives the message, understands the request, checks the diary, books, confirms and writes the outcome back. An AI receptionist for clinics like Vicky replies in about 15 seconds, at 2am, on a Sunday, on a public holiday — precisely the hours in which a private clinic quietly loses patients to whoever answered first.

It also means the decision does not have to be made in one go. Switch on automated appointment confirmation first, look at what happens to next week’s did-not-attends, and only then open up full booking. Your clinic software stays exactly where it is.

If you would rather see it running on your own clinic’s WhatsApp before deciding anything, message us here.

Questions to put in writing before you sign

1. In which country is our patient data hosted, processed and backed up? In the UAE this is Article 13, not a preference.
2. What is your retention model, and how do we get 25 years of records out? Format, timescale, cost.
3. Which of your messaging features touch patient data, and how are they covered? Reminders and invoices can be special category data under UK GDPR.
4. Does your “AI” write clinical notes or answer patients? Both are valid. They are not the same purchase.
5. Who replies to the patient at 11pm? If the answer is “reception, the next morning”, that gap is still open — and it is the only one that shows up in revenue.

Choosing clinic software is a decision about records, billing and compliance. It deserves the slow, careful treatment, with the rules in front of you. Just do not confuse it with the other decision, the one that never appears in a feature matrix: who answers the patient who arrived just now. What our side of that costs is published on the pricing page, with no “contact sales” wall.