DLT registration for clinic SMS: how to send SMS to patients legally Principal entity, header, content template and consent under TRAI's 2018 regulations and the 2025 and 2026 amendments, and who does which step.

To send SMS to patients legally, the clinic (or the vendor sending on its behalf) must be registered as a sender on a telecom operator's DLT platform, must send from a registered header, must use a content template registered and approved for that header, and must hold consent where the message category needs it. TRAI's regulations place the enforcement on the Access Providers, which is why an unregistered message simply does not get delivered. Below is what each step is, and who does it.

For the WhatsApp side, which runs on Meta's platform rather than the telecom DLT system, see our post on WhatsApp Business API cost for clinics. For how tokens reach patients on paper, display and phone, see OPD token systems.

Which rules govern SMS to patients?

The Telecom Commercial Communications Customer Preference Regulations, 2018 (6 of 2018), notified by TRAI on 19 July 2018, with the Second Amendment of 12 February 2025 and the Third Amendment of 18 September 2026. The 2018 regulations define "Commercial Communication" as any voice call or message using telecommunication services "where the primary purpose is to inform about or advertise or solicit business for" goods or services or a supplier of them. A clinic telling a patient their token number is informing about a service, so the message is inside the definition even though it is not an advertisement. The 2018 regulations also require Access Providers to adopt Distributed Ledger Technology (DLT) for the registers of entities, headers, templates and consent, which is where the name comes from.

What are the sender, header, template and consent registrations?

Which category is a token or appointment SMS?

The category is decided by the message definitions and fixed when the template is registered. The 2025 amendment defines a Service Message as one sent by a Sender to "its Customer or Subscriber to provide information pertaining to any product or service, its warranty, product recall, software upgrade alerts, safety or security of the product used or purchased by the Customer, periodic balance alerts, information regarding delivery of goods or services, and such Messages are not promotional in nature and do not require Explicit Consent". The 2026 amendment substitutes a new text with the same first limb and adds "OTPs for authentication, such as app login, password reset, two-factor authentication etc." to it.

A Transactional Message under the 2025 text is one sent "in response to Customer initiated transaction within thirty minutes of the transaction", with OTPs, transaction alerts and confirmations as examples, and "does not require Explicit Consent". Both texts add that a transactional message "containing information pertaining to service shall be treated as a Service Message". A token issued at the desk and a call-to-cabin message are information about the delivery of a service the patient has asked for; which suffix your templates carry is for the registered sender and the operator's registrar to settle when the templates are filed. Ask your vendor what category its token templates are approved under.

Mixing is the trap. The 2025 amendment says: "if promotional content is mixed with any type of Transactional or Service Message, such Message shall be treated as a Promotional Message". A token message that ends with a line about a new service becomes promotional, needs consent, and is blocked for patients who have set a preference against promotions. Keep the token message to the token.

What does the clinic do, and what does the vendor do?

1. Decide who the registered Sender is. If the vendor is the registered sender and the header is the vendor's, the clinic signs nothing with an operator, and the header leaves with the vendor. If the clinic registers itself, it needs its own documents with an operator's DLT platform and then authorises the vendor as the telemarketer that delivers the messages. The 2025 amendment requires Access Providers to make registered Senders and telemarketers "self-certify annually" their registration details, headers and templates.
2. Choose the header. A clinic registering itself picks a header that patients will recognise; the suffix is added by the operator by category.
3. Register the templates. Each wording, with its variable fields, is filed under the header and approved by the operator's registrar. The clinic should read every template its vendor will send under its name.
4. Record consent where it is needed. For promotional messages the 2025 text requires an opt-out mechanism in the same message. For service messages, document the patient's request for the service: the registration form, the booking, the token slip.
5. Keep the DPDP side in order. Explanation 3 to the 2026 consent definition says: "Nothing contained in these regulations shall exempt the Sender from its obligations, or liability under the Digital Personal Data Protection Act, 2023". The patient's phone number is personal data; the clinic is the Data Fiduciary and the vendor its Data Processor under section 8(2)'s contract.
6. Watch for suspension. The 2026 amendment sets out suspension of a misused header or content template across all Access Providers until remedial action is taken, and action against a Sender whose numbers are flagged for spam. A vendor with a suspended header stops your tokens too.

What does SMS cost a clinic?

The regulations let each Access Provider "specify the fee for registration of Senders" and for related activities, and do not set a per-message price; operators and SMS providers price per message. For a clinic the cost is what the software vendor charges, inside the plan or per message, so ask the same questions as for WhatsApp: included or not, the cap, the price above it, and which events send a message. Our worksheet in free versus paid clinic software has a line for it.

The clinic's SMS checklist

• Who is the registered Sender for our messages: the clinic or the vendor? In writing.
• What header do patients see, whose is it, and what suffix does it carry?
• Which templates are registered under it, with what category, and can we read them?
• What happens to the header and templates if we leave?
• Is any promotional content ever added to a token or appointment message? The answer must be no.
• Where is patient consent recorded, and does it cover both TRAI's purposes and the DPDP Act?