The compliance line in international patient marketing

International patient marketing compliance comes down to three questions: what you may say, what you may collect and keep, and who may speak in your name. Avoid outcome claims, success figures and comparisons between countries. Capture consent in the family’s own language and keep it separate by purpose. Keep data in the system of record. Written by an operator, not a lawyer.

Let me say the important thing first. I am an operator, not a lawyer. I have run digital, CRM and content teams inside hospital groups, and what follows is how I have learned to keep that work on the right side of a line. It is not legal advice, the rules change, and they differ by country. Every point below should be checked with your own counsel and with the people who own compliance in your organisation before it becomes a policy.

With that said, international patient marketing compliance is not an exotic subject. It is three ordinary questions asked carefully. What are you allowed to say. What are you allowed to collect and keep. And who is allowed to say things in your name.

Teams get into trouble because medical value travel work happens at the edges of the organisation: a message thread on a phone, a partner’s brochure in another language, a landing page built quickly for a market nobody in the legal team has visited. The controls that exist for domestic advertising often never reached any of it.

The aim is not caution for its own sake. Families choosing treatment in another country are making a decision they cannot verify, and the constraints that feel restrictive to a marketer are largely what make the decision safe for them.

What international patient marketing compliance covers

Four bodies of rules land on the same campaign at once, and teams usually remember only the first.

There are the professional and advertising rules that apply to healthcare providers in India, including what a doctor may be associated with in promotional material. There are the rules of the country where the patient lives, which may restrict how health services are advertised to its residents or how patients may be recruited there. There are platform policies, which govern what health related advertising and audience targeting the large advertising and social platforms permit, and which often change faster than any statute. And there is data protection law, on both sides of the journey.

Almost nobody in a hospital holds all four in their head. That is fine. What matters is that someone is responsible for asking about each one before a campaign goes live in a new market, and that the answer is written down. A written answer, even a cautious one, is how a team stops relitigating the same question every quarter.

The claims you cannot make

The specific prohibitions vary, but the shape of them is remarkably consistent across jurisdictions, and I would keep to the stricter reading.

Do not promise or imply an outcome. No cure, no guarantee, no reassurance that a condition will be resolved. Do not publish success rates or survival figures as marketing material, and do not let a well meaning clinician’s quote turn into one. Do not use superlatives you cannot substantiate, and treat comparative claims against other hospitals, other cities or other countries as off limits. The claim that treatment here is cheaper or better than treatment somewhere else is exactly the kind of statement that reads as persuasion to a regulator and as a promise to a frightened family.

Be careful with the softer forms of the same claim. Before and after imagery implies an outcome. A testimonial that describes a recovery implies an outcome. An award or ranking used without saying who gave it and on what basis implies a verified quality it may not have. A doctor’s credentials stated loosely can imply a qualification that does not exist. None of these read as claims to the person who wrote them, and all of them read as claims to the person who receives them.

Offers and inducements need their own discussion with counsel. Discounts, packages and anything resembling a commission paid to someone who influences a patient’s choice sit in sensitive territory in many places. The honest test I apply is simple: would this sentence still be acceptable if it were read aloud to the patient’s family in their own language, by their own doctor, after treatment. If not, do not publish it.

The rules of the patient’s country matter too

A campaign aimed at families in another country is advertising in that country, whatever the servers say. Some places restrict the advertising of health services to their residents, some restrict how intermediaries may operate, and some have data rules of their own that apply to information collected from people living there.

I would not attempt to describe any specific country’s position here, because these rules move and because getting them wrong in print is worse than not writing them at all. What I would do operationally is keep a short register: for each market you actively work, a note of what has been checked, by whom, and when. Review it when you enter a market, when you change how you collect enquiries, and once a year regardless.

Platform rules deserve a line of their own. Health related targeting is restricted on the major platforms, remarketing to people who have shown interest in a condition is usually not permitted, and an account can be suspended without much conversation. Build the assumption of restricted targeting into your media plan from the start rather than discovering it after a campaign is stopped.

Consent a family actually understands

Consent is where most hospitals are furthest from where they think they are. A checkbox at the bottom of an English form, ticked by a son on behalf of a father who speaks another language, is a weak foundation for everything that follows.

India’s data protection framework, the DPDP regime, is easier to work with than its reputation suggests, and the principles translate well into an international desk’s daily work. Tell people clearly what you are collecting and why, in language they can actually read. Collect only what you need for the purpose you stated. Use it for that purpose and not quietly for another. Let people withdraw as easily as they agreed. Keep it secure, keep it no longer than you need it, and give people a named way to raise a problem and to have information corrected or erased. Take particular care with information about children. I have written about the domestic version of this in consent under DPDP and what changes for hospital marketing, and the international desk needs the same discipline with extra translation.

Three practical points I would insist on. First, capture consent in the language of the conversation, not the language of the website. Second, record who gave it, since an enquiry is very often made by a relative and the patient may not yet know anything about you. Third, keep consent to be marketed to separate from consent to be treated and from consent to have reports reviewed. They are different permissions and bundling them is how good teams end up with a bad answer to a simple question.

Data that crosses a border

An international enquiry arrives as a scan, a report, a passport photograph nobody asked for and a chain of messages. Within a day it can exist on a desk executive’s personal phone, in a shared inbox, in the CRM, in a consultant’s email and in a partner’s system in another country. That is a real risk, and it builds up quietly.

Reduce what you collect first, because you cannot mishandle what you never took. Most enquiries need the medical information and a way to reply, not identity documents. Then decide where the record properly lives and make that place convenient enough that people use it. A desk that runs on your CRM is a compliance control as much as an efficiency measure, because it takes patient information off personal devices and puts it somewhere with access control and a retention rule. The same logic applies to messaging: if most of your demand arrives on WhatsApp, that channel needs to be connected to the system of record rather than lived in.

Decide in advance what happens when a family asks you to stop. A patient who has flown home and wants no further messages, or wants their enquiry record removed, is making a reasonable request that should not depend on which executive receives it. Write the steps down, make sure they reach every copy of the record including the partner’s, and keep a note that the request was honoured. Requests like these arrive rarely and are remembered permanently.

Sharing with partners needs a contract that says what they may do with the information, what they may not, how long they may hold it, and what happens when the relationship ends. Whether a partner counts as a processor acting for you or as an independent holder of the data is exactly the kind of question to put to a lawyer rather than to settle in a marketing meeting, and the answer changes what you must document.

Patient stories, told safely

A family’s story is the most persuasive asset an international desk will ever have, and the most dangerous one to handle casually.

Consent to be photographed in a ward is not consent to appear in an advertisement in the patient’s home country. Consent given in a moment of gratitude at discharge deserves to be revisited before publication. Consent should be specific about where the material will appear and for how long, given in a language the family reads, and withdrawable without an argument. Where a patient has died or a child is involved, the care required goes well beyond the paperwork.

Content that avoids implying an outcome usually works better anyway. What travels is the description of the process: how the family was answered, how the estimate was explained, who met them at the airport, how the reports were sent home. That is the version I argue for in patient stories with consent, across borders and cultures, and it is both safer and more useful to the next family.

Who speaks for you abroad

Most international compliance failures I have seen were not committed by the hospital. They were committed by someone acting in the hospital’s name.

A partner writes a brochure in a language nobody at the hospital reads, and it contains a success rate. A freelance page owner in a source market runs ads with the hospital’s name and a promise attached. A well meaning coordinator sends a family a quotation that reads like a guarantee. From the outside, all of it is you.

The controls are unglamorous and they work. Approved material only, supplied by you, with a version you can point to. A written standard of what may never be said, translated into the languages your partners actually use. Someone whose job includes searching for your own name in each market from time to time. A right to require withdrawal of material, and the willingness to use it. And a rule that any commercial arrangement is documented, because an undocumented one is a compliance question and a financial control question at the same time.

Where you can, keep the count of who introduced what. The case records that support measuring international demand honestly are the same records that let you show, if anyone asks, which route a patient came through and on what terms.

The checks I would put in this quarter

Begin with an inventory, not a policy. List every place your hospital is currently being marketed to patients abroad: pages, campaigns, channels, partner material, individual accounts. Most teams find something they did not know existed, and that discovery is usually more valuable than the policy that follows it.

Then do three things. Write the one page of claims that may never be made, in plain words, and give it to everyone including partners. Put a single review step in front of anything new that goes to an international audience, staffed by someone who can say no. And map where international patient data sits today, then move the worst of it into the system of record.

After that, book the conversation you have been avoiding. Sit with counsel and the compliance owner, bring the inventory rather than a list of questions, and ask them to mark what must change now and what can wait. It is a short meeting when you arrive prepared, and it is the difference between a marketing team that believes it is compliant and one that can show why.

Questions people ask