Marketing data in a clinical setting is not ordinary marketing data
The distinguishing feature of clinic marketing is that the data is rarely as innocuous as it looks. An enquiry form asking which treatment somebody is interested in has collected information about their health concerns. A tag on a mailing list recording that a subscriber is interested in a procedure has recorded the same thing. That information attracts additional protection, and it frequently sits in tools designed for retail email.
This is the finding that matters most in the lowest band, and it is why criterion four exists separately. A clinic can have functioning consent, an accurate notice and defined retention, and still be holding health information in a system nobody thought of as clinical.
The same point applies to imagery collected through marketing routes, which the imagery governance scorecard covers. The second distinguishing feature is provenance. Marketing lists in this sector accumulate: an old event, a competition, a previous owner, an imported spreadsheet. Each addition seemed reasonable at the time and none is documented, so the clinic cannot say how any given address arrived. Criterion five scores that, and it is the criterion clinics most often score 0 on while believing otherwise.
The reference points are the ICO's guidance for organisations and its guidance on direct marketing and electronic communications, both of which are written for people who are not lawyers.
How to score this assessment
Start by drawing the data flows. Where does personal data enter marketing systems, from which forms, into which tools, and who can see it. Most clinics find at least one flow nobody had documented, usually a form feeding a tool somebody set up and left.
For criterion two, look at the actual consent mechanism. Pre-ticked boxes, consent bundled with terms, and consent that is harder to withdraw than to give all score 0. Test the withdrawal route yourself.
For criterion five, take a sample of fifty addresses from your list and attempt to establish how each was obtained. Score by the proportion you can trace.
For criterion seven, list every tool and supplier that touches personal data and check that a written arrangement exists for each. Free tools count.
For criterion ten, run a test subject access request through your own process and time it. Clinics that have never tested this routinely discover the data is in more places than the process anticipated.
Common scoring errors
Treating treatment interest as ordinary contact data. It indicates a health concern. Criterion four scores whether that has been recognised.
Scoring consent by the presence of a checkbox. The criterion asks whether consent was freely given, specific, recorded and withdrawable. Most checkboxes fail at recorded.
Assuming the existing customer position covers the whole list. The rules on marketing to existing customers are narrower than generally assumed and do not cover addresses collected from competitions, events or purchased sources.
Excluding free tools from supplier arrangements. A free tool processing personal data is a processor.
Setting retention periods nobody enforces. A stated period with no deletion process scores 1 at most, because the statement misdescribes what is happening.
Cleaning a list you cannot account for
The finding clinics dread is a mailing list with untraceable provenance, because the remedy looks like deleting an asset. In practice the position is less painful than it appears.
Segment the list by what you can establish. Addresses collected through a documented route with a recorded basis stay. Addresses you can trace to a competition, an imported spreadsheet or an unknown origin form a second group.
For the second group, the practical options are to seek fresh consent through a single message that makes continuing easy and does nothing else, or to remove them. Clinics that do this consistently report that the remaining list performs better, because it consists of people who chose to be there.
Then close the source. New addresses arrive with a recorded route, a recorded basis and a date, so the problem does not rebuild. This is a form change and a habit, not a project.
Finally, look at where health-related data sits and reduce it. Recording that somebody enquired about a category of treatment is often unnecessary once the enquiry is handled, and data you do not hold requires no protection. Pair this with the measurement maturity assessment, which should be read as increasing your obligations rather than merely your insight.