Log inGet Started for Free
How it worksPricingThe strategyAboutComplianceLog inGet Started for Free
Compliance

Compliant by design.
So you can send with confidence.

Dental and health marketing is closely regulated, and the rules change from country to country. ModularMail builds them into every email: the words we write, the images we create, the way we send and how we treat patient data.

GDPR and UK GDPR Spam Act 2003 CAN-SPAM Australian Privacy Act Health advertising rules

Last reviewed 14 October 2026

The regulators we build for.
And what we do about each.

The rules that apply depend on where your practice and your patients are. We know the main regulators and turn their rules into checks that run on every campaign.

Australia

Regulators and rules

  • Ahpra and the Dental Board of Australia: the Health Practitioner Regulation National Law (s133) and the guidelines for advertising regulated health services
  • TGA: advertising of prescription-only medicines and therapeutic goods
  • ACMA: the Spam Act 2003
  • OAIC: the Privacy Act 1988 and the Australian Privacy Principles

What ModularMail does

  • No clinical testimonials: they are blocked, never on by default.
  • No guarantees, no claims of being the best, and no unverified use of “specialist”.
  • Prices only with exact, confirmed terms, or no price at all.
  • Prescription-only injectables are never promoted. Only the consultation can be.
  • Before-and-after images go to human review with provenance and sign-off.
  • Medicare Child Dental Benefits Schedule wording comes from a confirmed, current source.

United States

Regulators and rules

  • FTC: the FTC Act (including endorsement and testimonial rules) and the CAN-SPAM Act
  • State dental boards, which regulate dental advertising state by state, and the ADA's recognised specialties
  • HHS Office for Civil Rights: HIPAA rules on marketing and patient authorisation
  • California Privacy Protection Agency and state attorneys general: CCPA/CPRA and other state privacy laws

What ModularMail does

  • A patient's name, image or health information is never used without written authorisation.
  • Testimonials and results must be typical, or clearly and prominently qualified. “Results not typical” alone is not enough.
  • Paid or incentivised endorsements must disclose the connection, close to the claim.
  • Specialty claims only for areas recognised by the ADA, or with the required disclosure.
  • Practices in states whose rules we have not loaded are flagged for review before the first send.
  • Every email carries a working unsubscribe and the practice's identity and address, as CAN-SPAM requires.

United Kingdom

Regulators and rules

  • General Dental Council: Standards for the Dental Team and its guidance on advertising
  • ASA and the CAP Code: advertising standards, including rule 12.12 on prescription-only medicines
  • ICO: the UK GDPR, the Data Protection Act 2018 and PECR (the rules on electronic marketing)

What ModularMail does

  • Treatments are never implied to be suitable for everyone. Copy states they are subject to a satisfactory assessment.
  • Whitening is never promoted to, or for, under-18s, and “up to X shades whiter” is blocked without clinical evidence.
  • Prescription-only medicines such as anti-wrinkle injections are never promoted. Only the consultation can be.
  • Before-and-after images must be representative, unaltered and approved.
  • GDC registration numbers and the practice's complaints route are checked and flagged if missing.

European Union

Regulators and rules

  • National data protection authorities, under the General Data Protection Regulation (GDPR)
  • The ePrivacy rules on electronic marketing, as implemented in each Member State

What ModularMail does

  • A Data Processing Addendum with Standard Contractual Clauses applies to every account.
  • A published list of sub-processors, with notice of any change.
  • Consent evidence recorded for each contact: basis, date and source, plus the IP address for people who join through a hosted sign-up form.
  • Erasure and unsubscribe handled in the product, keeping only a one-way hash so a person is never re-added.
  • Data is minimised: no clinical records, and no patient data sent to our AI provider.

GDPR: our commitment

ModularMail complies with the GDPR and the UK GDPR. We act as your processor for your contacts’ and patients’ data, and as a controller for your account details.

  • Data Processing Addendum in place with every customer, automatically, including the EU Standard Contractual Clauses and the UK Addendum.
  • Lawful basis and consent evidenced: how, when and where each contact agreed to hear from you.
  • Individual rights built in: access, correction, export, unsubscribe and erasure, with one-way hashes kept so erased and unsubscribed people are never re-added.
  • Minimal data: contact details and booking requests only. No clinical records, and no patient data sent to our AI provider.
  • Sub-processors published, bound by written agreements, with 30 days’ notice of any change.
  • Safeguarded transfers outside the EEA and UK, under Standard Contractual Clauses.
  • Breach notification to you within 72 hours of our confirming one, so you can meet your own obligations.
  • Security that matches the risk: encryption in transit and at rest, separation between practices and limited access.
Our copy

Copy that stays
on the right side of the rules.

Every email is written under a rulebook for your market and checked afterwards by code, not just by AI. A blocked claim stops the email. A flagged one comes to you to decide.

Guarantees and certainty

“Guaranteed”, “painless”, “risk-free”, “miracle”. We rewrite them into qualified, factual language, or block them.

Superiority and authority

“Best dentist”, “#1”, “leading”, “top-rated”, “specialist”, “expert”. Only claims we can support from your confirmed practice details stay in.

Offers

A price or discount must come with what it includes, who is eligible and when it ends. An offer without terms is blocked.

Pressure and fear

“Act now”, “last chance”, scarcity and scare tactics are removed in favour of calm, consultation-led wording.

Clinical claims

Sedation, sleep apnoea and other medical services use non-diagnostic, qualified language only.

Patient identity

Patient names, images and health details are blocked unless written authorisation is on file.

Our imagery

Images can mislead as easily as words. We hold them to the same standard.

  • Show the service itself, literally, so no image promises more than the treatment offers.
  • Natural-looking smiles and a natural tooth shade. No exaggerated, over-bright teeth.
  • No before-and-after photographs in generated imagery. If you use a pair, it goes to human review.
  • Nothing graphic: no distress, fear or blood. Discomfort is shown only where the service calls for it, such as emergency care.
  • Different, representative people in every image. No real patients are shown without authorisation.
  • Images are illustrative. They are not photographs of your team, your practice or your patients, and we do not present them as such.
  • Your logo and social icons are your brand assets, never generated.

How we send

Email law is mostly about consent, identity and being able to opt out. We build all three in.

  • Contacts are added with a confirmation that they agreed to receive email from your practice.
  • Consent basis, date and source are recorded for every contact.
  • Every email has a working unsubscribe link, and the legal footer cannot be edited out.
  • Unsubscribes, bounces and complaints are suppressed automatically, and never emailed again.
  • Your practice name and postal address identify you as the sender.
  • A pre-send check blocks missing essentials and link shorteners before anything goes out.
  • Links carry no personal information. Booking links contain no names or email addresses.

Working together

Compliance is shared. We build the checks and the safeguards. You know your practice, your patients and your registrations, and you stay responsible for what you send. Our checks help; they are not legal advice, and they do not replace your own review. Please read each email before you send it, and tell us if your practice’s rules are different from the ones we apply.

The detail, in writing.

Privacy PolicyWhat we collect, why, and your rights.Data Processing AddendumHow we process your contacts’ data.Sub-processorsThe providers that help us run ModularMail.SecurityHow we protect your data.Acceptable Use PolicyThe rules for sending email.Terms of ServiceThe agreement between us.

Questions from your compliance adviser or regulator? support@modularmail.io