Pharmacy SMS and Email Marketing: Consent and Unsubscribe Checklist

Pharmacy messages can move quickly from helpful to promotional. A prescription-ready alert is factual. Adding a retail offer can make the whole message commercial.

That distinction matters because Australian spam and privacy rules apply before the campaign leaves your system.

The pharmacy remains responsible when a third-party provider sends messages on its behalf.

This checklist helps owners design a controlled SMS or email campaign. It does not replace legal advice about your circumstances or state and territory privacy requirements.

For acquisition planning, use our pharmacy marketing guide. This article focuses on the compliance controls after a campaign idea is chosen.

Separate service messages from marketing

Begin by classifying the purpose of each message. A service message should communicate information needed to provide an existing service.

A marketing message promotes goods, services or a commercial opportunity. ACMA says promotional content can make an otherwise factual message commercial.

Links, phone numbers or contact details leading directly to promotional material can also affect that classification. Branding alone is not generally enough.

Message	Likely treatment	Safer workflow
Prescription-ready notice	Factual service communication	Keep it limited to the service update
Vaccination offer	Marketing communication	Check consent, identification and unsubscribe controls
Reminder plus retail promotion	Commercial message	Separate the promotion or apply marketing controls
Health campaign using patient contact details	Privacy-sensitive direct marketing	Confirm specific consent and permitted data use

Do not use a marketing message to ask for marketing consent. ACMA notes that the consent request would itself be a commercial message.

Build a defensible consent record

ACMA requires consent before marketing emails or messages are sent. Consent may be express or inferred, but inference needs a sound factual basis.

For each recipient, retain:

• who gave consent
• when and how consent was obtained
• the channel and purpose covered
• the wording presented at collection
• any withdrawal or preference change
• the system and person recording the evidence

Do not treat a mobile number collected during dispensing as automatic marketing permission. OAIC says a patient’s health information includes their name and contact details.

Our pharmacy privacy guide explains how to map data purpose, access and vendors beyond the campaign itself.

It also says health information may only be used or disclosed for direct marketing with consent.

Check every campaign before sending

Use a release checklist for every audience, template and channel.

1. Confirm the list has a documented consent basis.
2. Exclude withdrawn, suppressed and uncertain records.
3. Confirm the sender is accurately identified.
4. Keep sender contact details correct for at least 30 days.
5. Include a clear and functional unsubscribe method.
6. Test the unsubscribe route on the actual message format.
7. Check that opting out needs no fee, login or extra personal details.
8. Record who approved the audience, content and send time.

ACMA says unsubscribe requests must be honoured within five working days. The facility must remain functional for at least 30 days after sending.

An alphanumeric SMS sender ID usually cannot receive replies. If you use one, provide another working unsubscribe route and test it before release.

Protect health information in campaign operations

Pharmacies are health service providers under federal privacy law. OAIC expressly lists pharmacists and says coverage applies regardless of small-business turnover.

Limit campaign access to people who need it. Avoid exporting contact lists into unmanaged spreadsheets or personal accounts.

Define retention for consent evidence, suppression records and send logs. A deleted campaign should not accidentally delete the evidence needed to honour an opt-out.

Your provider contract should cover access, subprocessors, incident response, exports and deletion. Responsibility does not disappear because a vendor presses send.

Register branded SMS sender IDs

Australia’s SMS Sender ID Register commenced on 1 July 2026.

Unregistered branded sender IDs must be labelled Unverified and grouped into an Unverified thread. Registration normally occurs through the messaging provider.

The register applies to branded sender IDs, not every ordinary telephone number. It also does not replace Spam Act or privacy controls.

Where KMail fits

KMail owns governed campaign behaviour within KSuite’s current pilot scope. Inbox provides the underlying communications delivery foundations.

The useful design principle is separation. Audience permission, campaign approval, sending, opt-out handling and evidence should be visible as distinct controls.

A pilot should test one bounded campaign with approved content, a verified audience and a working suppression path. The pharmacy retains legal and operational accountability.

To discuss a controlled campaign workflow for your pharmacy, book a demo.