Back to the build library
Healthcare & clinics
Standard

Patient Satisfaction and Review Program

Survey every visit, route unhappy answers into a private recovery queue, and send satisfied patients straight to a public review.

Industry
Healthcare & clinics
Build effort
Standard
Typical time to launch
2–3 weeks
On this page
The problemWhat gets builtHow it runsAutomations in detailWhat changesBefore you start
Want this built for you?

Bring your stack to a call and we will scope it against how your business actually runs.

Book a call
01

The problem

A clinic's public reputation is decided in the forty-eight hours after a visit, and almost nobody is working that window. The front desk has closed, the provider has moved on to tomorrow's schedule, and the only patients who say anything are the ones annoyed enough to go looking for your listing. That is a selection problem, not a quality problem. The unhappy patient is motivated. The satisfied patient, who outnumbers them, is not. The public record drifts away from what actually happens in the building.

The second loss is operational. A patient who waited fifty minutes past their slot, or who could not get a callback about a prior authorization, or who felt rushed by a provider they had not met before, tells nobody who can fix it. The complaint resurfaces three weeks later as a public one-star review that names a staff member. By then it is a reputation incident rather than a process defect, and the fix costs ten times what it would have cost on the day.

Where the money leaks is referral and conversion. New patients choose between clinics on a phone, in under a minute, and the deciding inputs are review count, recency and star average. A practice with a thin, stale and negatively skewed review profile pays more for every acquired patient and converts fewer of the ones it already paid to reach. Meanwhile the patients who would have written a glowing review were never asked, because asking is a manual task that competes with checkout, and checkout always wins. This build removes the asking from human hands and puts a decision gate in front of it: survey privately first, repair privately, and only invite public reviews from patients who have already told you they are happy.

02

What gets built

Pipeline and stages

A single Patient Experience pipeline carries every surveyed visit. It is a service-recovery queue, not a sales pipeline, and it is the only place a complaint is allowed to live.

  • Survey Sent: request delivered, no response yet.
  • Promoter: scored 9-10. Eligible for a public review invitation.
  • Passive: scored 7-8. Gets an open-ended question, never a review ask on the first pass.
  • Detractor - Needs Contact: scored 0-6. Clock running against an SLA.
  • Recovery In Progress: a named human has made contact.
  • Recovery Resolved: outcome logged, patient confirmed satisfied or declined further contact.
  • Escalated - Clinical or Legal: anything touching a safety concern, a billing dispute over a threshold, or a stated intent to complain to a regulator. Leaves automation entirely.
  • Review Posted: a public review was detected after an invitation.
  • No Response: closed unworked after the full cadence.

Calendars

  • Service Recovery Callback: a shared calendar the recovery owner books into when a detractor asks to be called at a specific time. Fifteen-minute slots, business hours only, no public booking link.
  • Practice Manager Review Block: a recurring internal block, twenty minutes twice weekly, where the queue is worked. The build is worthless without someone's time reserved for it.

Custom fields

Create these on the contact record. Keep every one of them free of clinical content.

  • last_visit_date: date, written by the appointment sync.
  • last_visit_location: text, for multi-site practices.
  • last_visit_provider: text. Staff-visible only; never echoed back to the patient over SMS.
  • survey_sent_date: date, prevents re-asking inside the cooling-off window.
  • survey_score: number 0-10.
  • survey_score_date: date.
  • survey_comment: long text, free-text verbatim.
  • survey_channel: option: SMS, Email, In-Person Tablet.
  • recovery_owner: text, the named staff member.
  • recovery_first_contact_at: date-time, drives the SLA report.
  • recovery_outcome: option: Resolved, Patient Declined Contact, Unreachable, Escalated.
  • review_invite_sent_date: date.
  • review_platform_clicked: option: Google, Healthgrades, Facebook, Other.
  • review_detected_date: date.
  • sms_consent: option: Granted, Declined, Withdrawn, Unknown.
  • sms_consent_date: date.
  • email_consent: option, same values.
  • preferred_contact_channel: option: SMS, Email, Phone, Mail only.
  • survey_suppressed: switch. Set true for bereavement, active complaints, patients who have asked not to be contacted, and any cohort the practice decides should be excluded.
  • language_preference: option, drives which message template fires.

Tags

  • survey-sent, survey-responded, survey-no-response
  • promoter, passive, detractor
  • review-invited, review-clicked, review-posted
  • recovery-open, recovery-closed, recovery-escalated
  • do-not-survey: hard suppression, honoured by every workflow in the build.
  • sms-opted-out: written automatically on any opt-out keyword.
  • theme-wait-time, theme-billing, theme-front-desk, theme-provider-time, theme-phone-access, theme-facility: applied to verbatims so the monthly report shows causes rather than averages.

Forms and surveys

  • Visit Experience Survey: the long form behind the SMS link. Three questions: the 0-10 recommendation score, one open text box labeled "What stood out, good or bad?", and a single optional checkbox, "It is OK to contact me about this." No symptom, diagnosis, medication or treatment fields. None.
  • Service Recovery Log: internal-only form the recovery owner completes after contact: what happened, what was done, whether the patient is satisfied, whether it needs escalation. Writes to recovery_outcome and stamps recovery_first_contact_at.
  • Communication Preferences: a standalone page linked from the footer of every email, where a patient sets channel and language and can switch surveys off without unsubscribing from appointment reminders. Keep clinical reminders and marketing on separate consents.
  • Front-Desk Consent Capture: a tablet form at check-in that records sms_consent, sms_consent_date and preferred_contact_channel, with the disclosure language the practice's own compliance counsel has approved.

BO's role and guardrails

BO is the platform's AI assistant. In this build BO does four things and is forbidden from doing anything else.

  • Parses survey replies. A patient replying "9" or "nine" or "9 the nurse was great" is resolved to a score plus a verbatim.
  • Tags verbatims by theme. BO assigns one or more theme tags to each comment so the monthly report is actionable.
  • Drafts public review responses into an approval queue. Nothing BO writes publishes without a named human clicking approve.
  • Drafts the first recovery outreach message for the owner to edit and send.

Guardrails, enforced in the prompt and in the workflow structure:

  • BO never gives clinical advice, interprets a symptom, or comments on care quality.
  • BO never confirms or denies in any public or outbound channel that a person is a patient of the practice. Public review replies are generic by construction: thanks, regret, and an invitation to call a named phone number.
  • BO never includes provider name, visit reason, appointment type, location or date in an outbound patient message.
  • Any reply containing words in the Escalation Lexicon: pain, bleeding, infection, wrong medication, emergency, attorney, lawyer, lawsuit, report you, board, malpractice, discrimination, overcharged: stops automation, moves the opportunity to Escalated - Clinical or Legal, and notifies the practice manager. BO does not reply at all in that path.

Numbers and channels

  • One dedicated local long-code number for patient experience messaging, kept separate from the clinical reminder number so an opt-out from surveys never silences an appointment reminder.
  • A verified sending domain with SPF, DKIM and DMARC for email, and a from-address that is a real monitored inbox.
  • Inbound calls to the survey number forward to the front desk with a whisper so the person answering knows it is a survey callback.
  • Optional in-office tablet kiosk on the same survey form for patients who prefer paper or have no cell number, with survey_channel set to In-Person Tablet.
03

How it runs, step by step

  1. At check-in the front desk hands over the consent tablet. The patient sets channel and language and, if they agree, grants SMS consent. The fields sms_consent, sms_consent_date and preferred_contact_channel are written to the record.
  2. The visit happens. When the appointment is marked Showed on the provider's calendar (or the practice management system posts a visit-completed event) the platform stamps last_visit_date, last_visit_location and last_visit_provider.
  3. The Post-Visit Survey Dispatch workflow starts and immediately checks the suppression gates: survey_suppressed false, no do-not-survey tag, no sms-opted-out tag, and survey_sent_date more than ninety days ago. Any gate failing ends the run silently.
  4. Three hours after the appointment end time, inside quiet hours, the patient receives a single short SMS asking one question: how likely they are to recommend the practice, answer 0-10. No clinical reference, no provider name, no visit reason.
  5. The patient replies "4". BO parses it, writes survey_score and survey_score_date, tags survey-responded and detractor, creates an opportunity in Detractor - Needs Contact, and the SLA clock starts.
  6. The clinic sends one more message, and it is not a sales message: an acknowledgement that promises a call from a person, plus an open question. The reply, "Waited an hour past my time and nobody said anything," lands in survey_comment and BO tags it theme-wait-time.
  7. Within fifteen minutes the practice manager gets an internal notification naming the patient record, the score, the verbatim and the location. The notification goes to staff channels only and carries no clinical content.
  8. The manager assigns recovery_owner and calls. BO has already drafted an opening line; the owner edits it and uses it or ignores it. The field recovery_first_contact_at is stamped and the opportunity moves to Recovery In Progress.
  9. The owner completes the internal Service Recovery Log: the wait was caused by a double-booked slot, the patient was apologized to and offered a priority slot next visit. The field recovery_outcome is set to Resolved, tags flip to recovery-closed, and the opportunity moves to Recovery Resolved.
  10. Fourteen days later a single closing-loop message goes out confirming the fix was made, and nothing else. No review ask. A patient who was unhappy is never asked for a public review in the same cycle.
  11. Elsewhere in the same batch another patient replies "10". They are tagged promoter, routed to the Promoter stage, and after a two-hour wait receive one review invitation with a direct link, review_invite_sent_date stamped.
  12. They click. The field review_platform_clicked is set to Google and review-clicked applied. If no review is detected in four days, exactly one reminder goes out. Then the invitation sequence exits permanently for ninety days, whatever happens.
  13. A review appears. The review monitor stamps review_detected_date, tags review-posted, and moves the opportunity to Review Posted. BO drafts a generic public reply into the approval queue; the practice manager approves or rewrites it, and it posts under a human's decision.
  14. Twice a week, in the reserved calendar block, the manager works the queue: any detractor past SLA, any unreachable record, any escalation. Monthly, the theme tag counts go into the practice meeting as a list of causes with counts, which is the output that actually changes the clinic.
04

Automations in detail

1. Post-Visit Survey Dispatch

Trigger: appointment status changes to Showed on any provider calendar, or an inbound visit-completed webhook from the practice management system.

Conditions, all must pass:

  • The field survey_suppressed is false.
  • Contact does not have do-not-survey or sms-opted-out.
  • The field survey_sent_date is empty or more than 90 days ago.
  • A deliverable channel exists with consent: sms_consent is Granted and a cell number is present, or email_consent is Granted and an email is present.

Actions in order:

  1. Wait 3 hours from appointment end time.
  2. Quiet-hours gate: hold until 09:00 local if the wait lands outside 09:00-19:00 in the contact's timezone. No survey ever sends on a Sunday; hold to Monday 09:00.
  3. Branch on preferred_contact_channel. SMS path: send "Hi {{contact.first_name}}, thanks for visiting {{custom_values.practice_name}} today. One quick question: how likely are you to recommend us to friends or family? Reply with a number from 0 to 10. Reply STOP to opt out of these messages."
  4. Email path: subject "How did we do?" Body: "Hi {{contact.first_name}}, thanks for visiting {{custom_values.practice_name}}. How likely are you to recommend us to friends or family? Tap a number below. It takes ten seconds and goes straight to our practice manager." Buttons 0 through 10 linking to the Visit Experience Survey with the score prefilled.
  5. Stamp survey_sent_date and survey_channel. Add tag survey-sent. Create opportunity in Survey Sent.
  6. Wait 24 hours.
  7. If survey_score is still empty, send one reminder on the same channel: "Still just one number, {{contact.first_name}}, 0 to 10, how likely are you to recommend {{custom_values.practice_name}}? Reply STOP to opt out."
  8. Wait 48 hours. If survey_score is still empty, add survey-no-response, move opportunity to No Response, end.

Stop and exit conditions: any inbound reply from the contact; survey_score populated; any opt-out keyword; do-not-survey added mid-run; 72 hours elapsed since dispatch. Maximum two outbound messages per visit, ever.

2. Score Capture and Routing Fork

Trigger: inbound SMS or survey submission on a contact carrying survey-sent.

Conditions and branches:

  1. Escalation check runs first, before any scoring. If the inbound text matches the Escalation Lexicon, skip everything below: add recovery-escalated, move the opportunity to Escalated - Clinical or Legal, send an internal notification to the practice manager and compliance contact reading "Survey reply needs human review. See record, do not auto-reply," and remove the contact from all survey and review automation. No outbound patient message is sent on this path.
  2. BO parses the message for an integer 0-10. If no number is found, store the text in survey_comment, reply "Thanks {{contact.first_name}}, I have passed this to our practice manager, who will follow up," and route to Detractor - Needs Contact as unscored. Treat ambiguity as unhappiness.
  3. Write survey_score and survey_score_date. Add survey-responded.
  4. Branch A, score 0-6: add detractor and recovery-open, move to Detractor - Needs Contact, start workflow 3.
  5. Branch B, score 7-8: add passive, move to Passive, start workflow 5.
  6. Branch C, score 9-10: add promoter, move to Promoter, start workflow 4.

Stop and exit conditions: contact has sms-opted-out; opportunity already in Escalated - Clinical or Legal; a score already exists for this last_visit_date, which prevents double-scoring from a duplicate reply.

3. Detractor Service Recovery

Trigger: tag detractor added, or opportunity enters Detractor - Needs Contact.

Actions in order:

  1. Immediately, no wait: internal notification to the practice manager and the location lead. Body: "Low experience score at {{contact.last_visit_location}}. Record: {{contact.id}}. Score {{contact.survey_score}}. Comment: {{contact.survey_comment}}. Call within 1 business day." Internal channels only. Never a personal mobile outside the practice's covered systems, and never a channel without a signed business associate agreement in place.
  2. Wait 10 minutes, then send the patient one acknowledgement. SMS: "Thank you for telling us, {{contact.first_name}}. That is not the experience we want. Someone from our team will call you within one business day. If you would rather write it down, reply here."
  3. Wait 15 minutes, then BO drafts an opening call script into the internal note on the opportunity. Draft only. Nothing sends.
  4. Branch on recovery_first_contact_at after 24 business hours. If still empty: escalate the internal notification to the practice owner with subject "Recovery SLA breached," and repeat every 24 business hours until stamped or the opportunity is closed.
  5. When recovery_first_contact_at is stamped, move to Recovery In Progress and send nothing to the patient. The human owns the conversation from here.
  6. When the Service Recovery Log is submitted, branch on recovery_outcome. Resolved: move to Recovery Resolved, swap recovery-open for recovery-closed, wait 14 days, send "Hi {{contact.first_name}}, following up on our conversation. We made the change we talked about. Thank you for giving us the chance to fix it." Then end. Patient Declined Contact: add do-not-survey, close, end. Unreachable: two further call-attempt tasks 48 hours apart, then close. Escalated: hand to the escalation path and remove from all automation.

Stop and exit conditions: do-not-survey added; escalation lexicon match at any point; opportunity moved to Escalated - Clinical or Legal. A detractor is never enrolled in a review invitation from the same visit, and is excluded from the next survey cycle as well.

4. Promoter Review Invitation

Trigger: tag promoter added.

Conditions: no review-posted tag in the last 180 days; review_invite_sent_date empty or more than 90 days ago; no open recovery opportunity on the record.

Actions in order:

  1. Wait 2 hours. Do not ask in the same breath as the score; it reads as a transaction.
  2. Quiet-hours gate.
  3. Send SMS: "That is great to hear, {{contact.first_name}}, thank you. Would you be willing to say it publicly? It genuinely helps other people find us: {{review_link}}. One or two sentences is plenty."
  4. Stamp review_invite_sent_date. Add review-invited.
  5. Wait 4 days.
  6. Branch: if review_platform_clicked is empty, send one reminder: "No pressure at all, {{contact.first_name}}, but if you have a spare minute the link is here: {{review_link}}. Reply STOP to opt out." If it is populated but review_detected_date is empty, send instead: "Thanks for starting a review, {{contact.first_name}}. If it did not go through, here is the link again: {{review_link}}."
  7. Wait 7 days. End the sequence regardless of outcome and suppress all review invitations on this contact for 90 days.

Stop and exit conditions: review-posted detected; any opt-out keyword; any escalation lexicon match; a negative public review appearing on the record. Hard cap of two review asks per cycle and no more than two per patient per year.

5. Passive Nudge and Verbatim Capture

Trigger: tag passive added.

Actions in order:

  1. Wait 30 minutes.
  2. Send SMS: "Thanks {{contact.first_name}}. A 7 or 8 tells me there is something we could do better. What would have made it a 10? Reply here. It goes straight to our practice manager."
  3. Wait 48 hours. Branch. If a reply arrived: store in survey_comment, BO applies the theme tags, create a low-priority internal task "Review passive feedback: {{contact.last_visit_location}}," and end. No review ask on this pass.
  4. If no reply: add survey-no-response and end.
  5. Fourteen days later, a single conditional branch: if a theme tag has an internal task marked complete and survey_score is 8, send one invitation using the promoter copy. If the score is 7, send nothing.

Stop and exit conditions: opt-out, escalation match, or do-not-survey. Passives receive at most two messages.

6. Public Review Response Drafting and Approval

Trigger: a new public review is detected on any connected listing.

Conditions and branches:

  1. Rating 4-5: BO drafts a short reply using only generic language: "Thank you for taking the time to write this. We will pass it on to the team. We appreciate you choosing {{custom_values.practice_name}}." BO is prompted explicitly never to reference a visit, a condition, a provider, a date, or anything that would confirm the reviewer is a patient.
  2. Rating 1-3: BO drafts the containment reply only: "We are sorry to read this and we would like to understand what happened. Please call our practice manager at {{custom_values.practice_phone}} so we can look into it directly." BO is forbidden from apologizing for specific clinical events, disputing the account, or acknowledging any care detail.
  3. Every draft, both branches, lands in an approval queue with an internal notification: "Review reply drafted: approve, edit or discard."
  4. Nothing posts on a timer. The post action fires only on a human approval event. If no approval in 48 hours, re-notify. If no approval in 5 days, escalate to the practice owner.
  5. On a 1-3 rating, in parallel: create an opportunity in Escalated - Clinical or Legal, attempt to match the reviewer name to a contact record, and if matched, suppress all survey and review automation on that contact for 180 days.

Stop and exit conditions: human discards the draft; review is removed by the platform it was posted on. BO's posting permission is never granted: approval is a required gate by design, not a setting.

7. Negative Review Interception and Internal Alert

Trigger: review detected with rating 1-3, or a review verbatim matching the Escalation Lexicon at any rating.

Actions in order:

  1. Immediate internal notification to the practice manager, the location lead and the compliance contact: "Negative public review posted. Do not reply publicly until reviewed. Listing: {{review_platform}}."
  2. Pause all outbound review invitations practice-wide for 24 hours. A fresh wave of review asks landing in the middle of a public complaint is how a single bad review becomes three.
  3. Create a task on the practice manager with a 4-business-hour due date: "Attempt identification and direct contact."
  4. Wait 24 hours. If the task is incomplete, escalate to the practice owner and repeat every 24 hours up to three times.
  5. When the task is closed, log the outcome on a Review Incidents record: platform, rating, theme tags, whether the reviewer was identified, whether direct contact was made, and what process change resulted.

Stop and exit conditions: task closed; review withdrawn. Invitation pause lifts automatically after 24 hours unless manually extended.

8. Weekly SLA Report and Monthly Theme Rollup

Trigger: scheduled, Monday 07:30 local, plus the first of each month.

Actions in order:

  1. Query the pipeline for the prior 7 days: surveys sent, response rate by channel, score distribution, detractor count, median hours from survey_score_date to recovery_first_contact_at, count of SLA breaches, review invitations sent, reviews detected.
  2. Email the practice manager and owner an internal summary. Aggregate counts only. No patient names or identifiers in the body of a routine report.
  3. Branch: if any detractor opportunity has been sitting in Detractor - Needs Contact for more than 2 business days, add a line "ACTION: overdue recovery records: open the queue now" and copy the owner.
  4. On the first of the month, additionally roll up the theme tag counts by location and by month-over-month change, and attach the verbatims for the top three themes with identifiers stripped. Create a task on the practice manager: "Bring top three themes to the staff meeting with one owned fix each."

Stop and exit conditions: none; this is the heartbeat of the build. If the report stops arriving, treat it as an outage.

05

What changes

The clinic stops discovering its problems in public. Complaints arrive privately, on the day, in a queue with an owner and a clock, which is the only arrangement where a complaint is cheap to fix. Review volume rises because the ask is automatic and goes to the right people, and the star average rises not because anything was gamed but because the satisfied majority is finally being asked at the same rate as the unhappy minority.

The second change is less visible and worth more: the practice acquires a continuous read on its own operations. Wait times, phone access, billing friction and front-desk conduct arrive as tagged counts every month instead of as anecdotes in a staff meeting. That turns reputation work into process work.

Metrics to watch:

  • Survey response rate, split by SMS and email. If SMS is not clearly ahead, the send timing or the copy is wrong.
  • Median hours from detractor score to first human contact. This is the single number that determines whether the build works. Set a target and report the breach count, not the average.
  • Recovery resolution rate: resolved divided by all detractors, with Unreachable broken out separately so it cannot hide.
  • Review invitation to posted-review conversion, and click-to-post drop-off, which tells you whether the link or the platform is the obstacle.
  • New reviews per month and rolling 90-day star average, by listing and by location.
  • Theme tag counts month over month. A theme that does not fall after a fix was shipped means the fix did not land.
  • Suppression and opt-out rate. If opt-outs climb past a low single-digit share of sends, you are messaging too often: cut the reminder, not the survey.
  • Escalation count and time to closure, reviewed with the compliance contact.
06

Before you start

Prerequisites

  • A named recovery owner with reserved calendar time. Without a human on the hook for the detractor queue, this build generates a tidy list of unhappy patients that nobody calls, which is worse than no survey at all.
  • An appointment data source that can signal visit completion. A practice management or EHR integration, a calendar sync, or at minimum a front-desk habit of marking appointments Showed.
  • Claimed and verified listings on every review platform the practice intends to use, with admin access granted to the platform connection.
  • Agreed definitions before the first send: what counts as a surveyable visit, which visit types are excluded, the cooling-off window, and the recovery SLA in business hours.

Integrations

  • Practice management or EHR for appointment status, via whatever supported connector or middleware the practice already uses.
  • Google Business Profile and any other review listings for invitation links and review monitoring.
  • Google Calendar or Outlook for the recovery callback calendar and the manager's review block.
  • An internal notification channel (Slack or Microsoft Teams) used for staff alerts only, and only if it is covered by the practice's own agreements for handling patient information.

Numbers and sending

  • Provision a dedicated local long-code number for patient experience messaging, separate from the clinical reminder number.
  • Complete A2P 10DLC brand and campaign registration before the first send. Register this as its own campaign with accurate use-case description and sample messages. The survey and review-invitation copy in this guide, verbatim. Unregistered traffic gets filtered, and filtered surveys look like a build failure when they are a paperwork failure.
  • Keep the opt-out language in the message body for the first message of every sequence, and ensure STOP, STOPALL, UNSUBSCRIBE, CANCEL, END and QUIT all write sms-opted-out and halt every workflow immediately. Honor HELP with a one-line reply naming the practice and the front-desk number.
  • Set quiet hours to 09:00-19:00 in the contact's local timezone, no Sunday sends, and no sends on practice holidays. Many states impose their own calling and texting windows; confirm the applicable ones with the practice's own counsel.
  • Authenticate the sending domain with SPF, DKIM and DMARC, and warm it before the first bulk send.

Protected health information: operational practice

This is a patient-experience system, not a clinical one, and it should be built so that it never holds clinical information in the first place. The following is how practices commonly operate it. It is not legal advice, and the specifics for your practice (including whether this configuration meets your obligations) must be confirmed with the practice's own compliance counsel or privacy officer.

  • Keep clinical content out of SMS and email entirely. No diagnosis, symptom, medication, test result, treatment, visit reason, appointment type, provider name or specialty in any outbound patient message. A message that says only "thanks for visiting, rate 0 to 10" is content-free by design. A message that says "thanks for your dermatology visit with Dr. Reyes" is not.
  • Minimum necessary applies to internal messages too. Staff notifications should carry a record identifier, a score, a location and a verbatim, not a full chart context. Pull the detail from the system of record, do not push it into a chat tool.
  • Surveys must not collect clinical data. The open text box will sometimes receive it anyway. That is why the Escalation Lexicon exists and why escalated records leave automation: a patient writing about a symptom should reach a human, not an automated reply.
  • Capture consent explicitly and store the evidence. Record sms_consent, email_consent, the date, and the method. Keep patient-experience consent separate from clinical-reminder consent so a survey opt-out never suppresses an appointment reminder. The disclosure wording shown to the patient should be the practice's own approved language.
  • A signed business associate agreement must be in place with every vendor in the chain that creates, receives, maintains or transmits patient information on the practice's behalf. The platform, the messaging carrier path, the email sender, any middleware, any chat tool used for alerts, and any analytics or storage layer. If a tool in the diagram has no agreement, either get one or keep patient information out of it. Review the list before go-live, not after.
  • Public replies must never confirm a patient relationship. Responding to a review with "we are sorry your injection appointment ran late" discloses treatment. The generic containment reply in workflow 6 exists precisely to avoid this, and it is why human approval is mandatory on every public post.
  • Access control and audit. Limit the Patient Experience pipeline and the recovery log to staff who need them, use named accounts rather than a shared login, enable two-factor authentication, and confirm the platform's audit logging covers who viewed and changed what. Define a retention period for verbatims and survey records with your privacy officer.
  • Marketing versus operations. A review invitation is closer to marketing than to treatment communication, and different rules may attach. Have counsel confirm how the practice should characterize and authorize it.

Scoping

Build effort is standard, but the integration to the practice management system and the consent configuration are where the time goes. To scope it against your own appointment volume, provider count and listing set, book a call at bookings.appbo.io.

Field notes

Build it with us.

Every build on this page is something we configure, test and hand over with the SOPs your team needs to run it.

Book a call