CRM Architecture and Patient Data Responsibility in Health Tourism
The first design decision
The first decision is data classification: which field is health data and which is operational data? Health data falls into the special category of personal data, with separate rules for processing, access, retention and cross-border transfer. Flight details, accommodation and transfers are operational. If this split is not written into the data model, the entire system ends up designed to the highest protection level and operations become needlessly heavy. For the data-model side of patient and agency relationships, see the [CRM guide](/en/blog/crm-software-guide).
Stages of the patient journey
- First contact: usually in a foreign language, in a different time zone, across multiple channels.
- Pre-assessment: getting the patient's reports and images to the physician.
- Quotation: pricing treatment, accommodation, transfer and companion costs together.
- Planning: coordinating appointment, physician, theatre, accommodation and transfer.
- Treatment: keeping clinical records separate from operational records.
- Post-discharge follow-up: check-ups, remote consultations, satisfaction.
Different teams run these stages, so each stage needs a defined record owner and a defined moment of hand-off. An unowned record is the most common cause of lost cases in health tourism.
Multilingual is not only an interface question
Translating the interface is the easy part. The real requirements are recording which language the patient is being served in, versioning document templates per language, displaying dates and times in the patient's time zone, and sending automated notifications in the right language. Assigning an interpreter is also resource planning: interpreter availability should be checked together with the appointment.
Agency and commission structure
Referral chains are layered: agency, sub-agency, individual referrer. The system must track the source of each case and the stage at which commission is earned — quotation, arrival or completed treatment. Commission must also be reversible on cancellation or partial treatment; if that scenario is not defined up front, reconciliation becomes manual.
A secure default for document sharing
Circulating medical reports and images by e-mail attachment or messaging apps is common but risky. The secure default is to hold documents inside the system, share them through time-limited personal links, log every access, and delete them when the retention period ends.
Cross-border transfer and consent
When the patient is abroad, the data flow crosses borders. The legal basis for the transfer, the scope in which explicit consent was obtained, and what happens to each data item if consent is withdrawn must all be defined in advance. Consent texts should be versioned per language, and the record should show which version each patient approved.
Frequently asked questions
Should the clinical system and the CRM be separate?
Usually yes, and that is the right separation: the clinical system holds the medical record while the CRM manages the journey and the commercial process. Only the necessary fields should pass between them through a defined interface. Copying the full medical record into the CRM needlessly widens the protection obligation.
Why is response time so critical?
An international patient contacts several providers at once. What matters is not the average response time but the distribution of time to first response, and how out-of-hours and weekend enquiries are handled should be tracked separately.
Which measurements are meaningful?
Conversion by source (enquiry → quotation → arrival → treatment), cancellation reasons, quotation preparation time, and the completion rate of post-discharge follow-up. Without written definitions these cannot be compared over time.