# LINE CRM for aesthetic clinics: what a LINE OA does alone, what CRM adds, and what PDPA requires

Canonical: https://www.flowclinic.tech/en/blog/line-crm

Published: 2026-08-31

Updated: 2026-09-03

Language: en

Publisher: Flow Clinic (https://www.flowclinic.tech)

Almost every clinic already has a LINE Official Account. The real question is where it stops. This guide separates what a LINE OA does on its own, how messages are priced, what a CRM layer adds, what PDPA requires, and gives a worked post-treatment follow-up cadence, the metrics worth tracking, and a self-audit checklist.

### The short answer
1. **LINE CRM is not a single product.** It means connecting a LINE Official Account — the conversation channel — to the clinic's own customer records, so you can answer who this person messaging you actually is, when they last came, and when to reach out next.
2. A LINE OA already does: 1:1 chat · broadcasts · rich menus · chat tags · greeting and auto-reply messages.
3. Its ceiling is that **it does not know an HN**. It does not know who had what done and when, it has no per-person follow-up schedule, and one shared inbox that several staff answer tells you neither who replied nor how late.
4. The numbers to plan around (checked on lineforbusiness.com on 3 Sep 2026): the Free plan includes **300 messages a month** · Basic is **THB 1,280 for 15,000 messages** · Pro is **THB 1,780 for 35,000 messages**, all excluding VAT.
5. Quota is counted **per recipient**, not per message you write, and **replies inside a chat are not counted at all** — so talking to one person is far cheaper than blasting everyone.
6. PDPA: health data is sensitive data under section 26 · a consent request must be clearly separated from other text under section 19 · and a customer may object to direct marketing at any time under section 32(2).
7. Start with a cadence the clinic sets for itself, then measure three things: **repeat-visit rate · first-response time · opt-out rate**.

## What a LINE OA does on its own, and where it stops

Almost every Thai aesthetic clinic starts in the same place: a LINE Official Account where customers ask about prices and book a slot. The problem is not that a LINE OA works badly — it works very well at what it was built for. The problem is that **it was built as a merchant's marketing channel, not as a healthcare provider's customer register**. Once a clinic has a few thousand customers on file, that difference starts to hurt.

### What it does out of the box

- **1:1 chat** with anyone who added the account, with the conversation history kept.
- **Broadcasts** to all friends, or filtered by gender, age, region, OS and chat tags — but a targeted broadcast needs a Target Reach of at least **100 people**.
- **Rich menus** — the image menu pinned below the chat, used to push people to booking, prices or a map.
- **Chat tags** staff apply to a conversation by hand, which can then filter a broadcast.
- **Greeting and auto-reply messages**, triggered by keywords or by being outside opening hours.

### The ceiling you hit as the clinic grows

- **A LINE account is not an identity** — the display name can be a nickname or an emoji, and the customer can change it any time. A LINE OA has no field for "this account is HN 004512".
- **It does not know who had what treatment, or when** — that lives in the chart or the POS, in a different system from the inbox.
- **There is no per-person follow-up schedule** — a LINE OA can schedule a broadcast, but it has no concept of *this customer* being seven days post-treatment, because everyone reaches day seven on a different date.
- **One shared inbox that several people answer** — no record of who replied, who has not, which case slipped, or how many minutes it took.
- **Nowhere to keep consent records or opt-out requests** — the two things PDPA expects you to be able to produce.

## Message costs: the numbers to know before planning follow-up

Before designing any cadence, know that outbound messages have a price — a plan that looks good on paper can cost more than the package you are on. These are the LINE Official Account monthly packages in Thailand, checked on the LINE for Business site on 3 September 2026.

*Prices exclude 7% VAT · this structure has applied since 1 August 2024 · Source: LINE for Business Thailand, checked 3 Sep 2026*

| Package | Monthly fee | Messages included | Additional messages |
| --- | --- | --- | --- |
| Free | No charge | 300 messages | Cannot buy more |
| Basic | THB 1,280 | 15,000 messages | THB 0.10 each |
| Pro | THB 1,780 | 35,000 messages | THB 0.06 each |

In real money: say the clinic has 3,000 friends on its LINE OA. Broadcasting to all of them four times a month is 12,000 messages — inside the Basic plan's 15,000. Push it to six times and it becomes 18,000; the 3,000 overage at THB 0.10 adds THB 300 that month. **The expensive variable is the number of recipients, not the length of the message.** Sending to fewer, better-chosen people genuinely saves money — it is not just good manners.

> **Which messages count against the quota, and which don't** — **Counted:** broadcast · push · multicast · narrowcast — anything the clinic initiates — and counted by how many people receive it. A broadcast with three bubbles sent to 500 people is 500 messages, not 1,500. · **Not counted:** replies inside a chat, greeting messages to new friends, and auto-replies. The practical conclusion: a short nudge that gets the customer to reply, followed by the real conversation in chat, is both cheaper and safer than explaining everything in a broadcast.

## What a CRM layer adds on top of a bare LINE OA

"CRM" here does not mean a particular vendor. It means **the layer of data that knows which LINE account belongs to which customer, and what has actually happened to that person**. This table compares it job by job: what you do without that layer, and what changes with it.

*Job by job · the right-hand column is what any CRM layer should do, not a specific vendor*

| The job | LINE OA alone | LINE OA + a CRM layer |
| --- | --- | --- |
| Know who is messaging you | You see a LINE display name that may be a nickname or an emoji, so you ask for the real name again every time | The LINE account was linked to an HN on day one; opening the chat shows the real name and which branch they use |
| Know what they had done before | Scroll back through the chat, or walk over and open the file | Pulled from the chart and what was actually billed, so the customer is not asked to repeat themselves |
| Remind each person about their own next step | Nothing — you keep a calendar or rely on memory, because everyone is due on a different date | The cadence counts from each person's real treatment date and surfaces as work on the day it is due |
| Segment before sending | Chat tags applied by hand, plus gender, age and region filters (needs Target Reach ≥ 100) | Segments built from what actually happened: used this service group · two sessions left on a course · not seen in 6 months |
| Know who replied and how late | One inbox, several people answering, no record of who took it or where it slipped | Records which staff member replied, and makes first-response time a number you can read |
| Keep consent and opt-out records | No field for it — it lives outside the system and has to be cross-checked by hand before every send | Consent and objections sit on the customer profile, so whatever sends the messages can see them |
| Control message cost | You see the account's total quota in the manager and guess what this round will use | You know the segment size before you press send, so the cost is estimated up front, not discovered at month end |
| Hand work over between shifts and branches | The chat history is there, but nothing says which cases are closed | Each follow-up has an owner and a status and can be closed, so the next shift knows what is left |

## PDPA: what to watch when messaging clinic customers

![A customer tapping a consent toggle on a tablet at the clinic counter](https://www.flowclinic.tech/images/blog/line-crm/line-crm-consent.webp)

The Personal Data Protection Act B.E. 2562 was published in the Royal Gazette on 27 May 2019. The thing clinics most often conflate is that **the data you hold in order to treat someone and the data you use to sell to them do not rest on the same lawful basis**. This section covers only the provisions that bear directly on sending LINE messages, and it is not legal advice.

- **Health data is sensitive data** — section 26 forbids collecting health data without **explicit consent**, subject to listed exceptions, which include what is necessary for medical diagnosis, medical treatment or the provision of health services under the responsibility of a professional bound by a duty of confidentiality. That exception is written for **treatment**; it is not written for sending promotions.
- **A consent request has a legally prescribed form** — section 19 requires it to be explicit, in writing or through an electronic system, to state the purpose, and to be **clearly separated from other content**, in language that is easy to read and not misleading. A single checkbox that bundles "I consent to treatment and to receiving news" is therefore a risky shape.
- **Withdrawing consent must be as easy as giving it** — section 19 says so directly. If a customer can consent in two taps on a phone but has to call the clinic during office hours to stop, that is not "as easy".
- **A customer can object to direct marketing at any time** — section 32(2) gives the right to object to collection, use or disclosure for direct-marketing purposes, and once they have objected the controller may not continue, and must separate that data from the rest immediately and clearly.
- **They can also ask for erasure** — section 33 gives the right to request deletion where an objection under section 32(2) has been made. So a clinic has to know where one person's marketing data lives — not scattered across five spreadsheets.
- **Bases other than consent do exist** — section 24 permits collecting general personal data without consent in certain cases, including where it is necessary for the performance of a contract to which the data subject is a party (24(3)) or for legitimate interests (24(5)). A confirmation for an appointment the customer booked themselves and a pitch for a new course therefore do not belong in the same bucket. Separate them when you design the system, and take legal advice where you are unsure.

> **Never put the treatment name in an outbound message** — A LINE message pops up on a lock screen where other people can see it. Writing "your filler top-up is due" discloses health data through a channel the clinic does not control. Use something neutral — "it's time for the follow-up care we discussed; when suits you?" — and save the detail for the chat the customer replies into. That is safer, and it **doesn't use quota**, because replies inside a chat are not counted.

## A post-treatment follow-up cadence you can adapt

![A phone showing three follow-up notifications beside a desk calendar with dates circled](https://www.flowclinic.tech/images/blog/line-crm/line-crm-follow-up-cadence.webp)

The table below is **an example cadence a clinic sets for itself, not medical advice** — the real intervals have to come from the doctor who performed the treatment and from the treatment itself. What transfers directly is the *structure*: every touch has a purpose you can write down, a message that does not disclose the treatment, and a rule for what happens when nobody replies. That last column matters most, because it is what keeps a follow-up system from becoming nagging.

*An example cadence the clinic sets for itself · not medical advice · every sample message was written for this guide*

| When | Why you're reaching out | Example message that discloses nothing | If they don't reply |
| --- | --- | --- | --- |
| Day 1 | Check they're coping at home, and make it easy to ask | How did last night go? Message us any time if anything is worrying you. | Phone the same day, if the doctor asked for symptom follow-up |
| Day 3 | The window when side effects usually show, if they're going to | It's been three days. If anything doesn't look right to you, send us a photo and the team will look. | Don't chase. Move on to the day 7 touch |
| Day 7 | Close the short-term care window, and offer a look if needed | It's been a week. If you'd like the team to check on things, tell us a day that suits. | Don't chase. Move on to the month 1 touch |
| Month 1 | Check the result against what was discussed beforehand | It's been a month — did things turn out the way we talked about? | Don't chase. Move on to the month 3 touch |
| Month 3 | The continuing-care point agreed at the start | It's time for the continuing care we planned. When would suit you? | Don't chase. Move on to the month 6 touch |
| Month 6 | The last touch before you stop | It's been a while. If you'd like the team to look after you again, we're here any time. | **Stop.** Move them to a not-followed-up group rather than starting the loop again |

A cadence like that only works if something records *who* is where in it. That is what a customer profile in the CRM layer is for. The example below numbers each field; fields 5 and 6 are the two a bare LINE OA has nowhere to store, and the two PDPA expects you to be able to answer.

**Customer profile · front-desk view** — Opened from the inbox, before replying
- (1) Identity in the clinic: Kamonwan Jaidee · HN 004512 · Sukhumvit branch
- (2) Linked LINE account: Display name "Kam" · linked 12 Mar 2026 via an identity-verification link, not guessed from the name
- (3) Last visit: 20 Aug 2026 · treatment details stay in the chart and never go into an outbound message
- (4) Scheduled follow-up: Day 1 sent · day 7 sent · month 1 due 20 Sep 2026
- (5) Marketing consent: Given 12 Mar 2026 through an electronic form · the wording the customer saw is stored with it
- (6) Objection / opt-out: None — if one arrives, marketing messages stop immediately, not from the next round
- (7) Last exchange: Customer wrote 28 Aug 10:12 · first reply in 6 minutes, by the front-desk team
- (8) Quota the next touch will use: 1 message (sent individually) — sending to this whole 240-person segment would be 240
All data invented · use it as a template for what a customer profile should be able to answer
_An example customer profile in a CRM layer · every detail is invented — the name, HN, LINE account and dates are not real_

## The metrics worth tracking, defined so they can't flatter you

*These definitions are offered so everyone in the clinic counts the same way — they are not an industry standard*

| Metric | Definition | How to read it |
| --- | --- | --- |
| Repeat-visit rate | Customers who came back at least once within 12 months, divided by customers who came for the first time in the same window | The end number a follow-up system should move. Compare it against the period before you started — never read one month on its own |
| First-response time | From the customer's first unanswered message to the first reply a staff member sends | Use the median, not the mean: a handful of cases left overnight will drag an average until it means nothing |
| Opt-out rate | People who objected or unsubscribed in the round, divided by people who received a message in that round | The only number that tells you whether you are sending too often. And under section 32(2) every entry in the numerator is a legal duty to stop, not just a statistic |
| Booking rate from follow-up | Bookings made within 7 days of a follow-up message, divided by follow-up messages sent | Shows which touches actually work. If the month 6 touch returns zero three months running, cut it — don't write a longer message |
| Message cost per return visit | Message spend for the round, divided by the return visits attributed to that round | Compare it to the margin on a visit. If it is higher, you are paying to interrupt people rather than to keep them |

> **Write down the baseline before you start** — Before the first cadence goes live, record the last three months' repeat-visit rate and first-response time. Without that, in six months you will have no way to tell whether things improved because of the system or because you happened to enter high season.

## Getting it running inside one week

1. Day 1 — pick the single key that means "the same person"
   In a clinic that is almost always the HN. Not the phone number (people share them) and not the name (people share those too). Everything after this points back to that key.
2. Day 1–2 — decide how a LINE account gets linked to an HN
   The reliable way is one act of verification by the customer — opening a link from the chat and entering whatever the clinic verifies against — or a staff member linking it in front of them at the counter. **Never link by guessing from the display name**: one wrong link means sending one person's information to another.
3. Day 2 — write the marketing-consent request as its own thing
   Clearly separated from the treatment consent form, stating what you will send and through which channel, with the way to stop it in the same text. Store the date, the channel and the exact wording the customer saw — what you have to prove later is *what they were looking at when they agreed*.
4. Day 3 — draft one cadence per treatment group
   Start with two or three, not twenty. Let the treating doctor set the intervals, and write the purpose of every touch as a sentence. If you cannot write the purpose, the touch should not exist.
5. Day 4 — write the actual messages so none names a treatment
   Read each one aloud and ask: if the person sitting next to the customer saw this on a lock screen, would they know what the customer had done? If yes, rewrite it.
6. Day 5 — set the rules for the inbox
   Who owns which hours · the first-response target in minutes during opening hours · an auto-reply outside them that states when a real answer will come · and a way to see which cases are still open, rather than letting them sink down the list.
7. Day 5 — work out the message bill in advance
   Recipients × sends per month = messages. Compare that against your package's quota. If it goes over, decide now whether to narrow the audience, reduce the frequency, or accept the overage — don't find out at month end.
8. Day 6–7 — pilot on a small group first
   Take about 20 recent customers, run one full touch, then sit and read everything that came back. The words customers use in their replies will tell you which of your messages were ambiguous.

## Common mistakes

- **Broadcasting to everyone because the package is already paid for** — quota is counted per recipient, so messaging people it does not concern is paying money to get blocked, and a block cannot be undone from your side.
- **Treating the LINE display name as an identity** — customers change names and photos whenever they like, and plenty use nicknames or emoji. The link has to come from one act of verification and then be remembered.
- **Naming the treatment or the drug in an outbound message** — that is health data, appearing on a lock screen where others can read it.
- **Keeping consent on paper in a drawer that the sending system cannot see** — so the person who unsubscribed last month gets this month's message anyway, which is exactly what section 32(2) prohibits.
- **Chat tags nobody defined** — three staff apply the tag "interested" with three different meanings, and by the time you send, the segment cannot be trusted. Write down what each tag means before anyone uses it.
- **Measuring opens and clicks instead of people who came back** — a message everyone opens and nobody acts on is a quiet failure.
- **Scheduling follow-ups that nobody owns** — the list appears every morning, nobody closes anything, and within two weeks nobody looks. Follow-up work needs a named owner like any other work in the clinic.
- **Expecting a CRM to make people come back** — what it actually does is stop you forgetting to reach out, and tell you what worked. Whether they return still depends on the result, the price and the experience at the front desk.

## Checklist before you go live

Use it when setting the system up, and again every quarter — the items that fail most often are the ones ticked off six months ago and never looked at since.

- [ ] Every LINE account you are chatting with is linked to an HN, or sits in a to-be-linked queue someone owns
- [ ] Linking happens through verification, never by guessing from a display name
- [ ] Marketing consent is separate from treatment consent, and the date, channel and exact wording shown are all stored
- [ ] Unsubscribing is as easy as subscribing, and it stops marketing messages immediately, not from the next round
- [ ] No clinic-initiated message names a treatment, a drug, or a symptom
- [ ] The cadence counts from each person's real treatment date, not from when a staff member remembered
- [ ] Every touch has a written purpose and a rule for what happens when nobody replies
- [ ] Every follow-up has an owner and a status, can be closed, and the next shift can see what is left
- [ ] The inbox has someone responsible per time block, and you can say who answered which case
- [ ] The monthly message volume has been calculated, and you know what going over the quota costs
- [ ] Repeat-visit rate, first-response time and opt-out rate are reviewed at least monthly against the baseline you wrote down

## The data layer behind the inbox
Flow Clinic is the CRM layer described above: the inbox sits alongside the patient record, LINE accounts are linked by verification rather than by guesswork, and follow-up work is attached to real visits. Broadcasts still go out from LINE OA Manager — the system neither sends them nor builds the audience.
- One inbox for LINE, Facebook and Instagram, with replies going back out over LINE from the same screen, plus conversation tags and internal notes for the team.
- A LINE account is linked to a patient when the customer verifies themselves with their phone number and an OTP on the clinic's own LIFF page — not guessed from a display name — so opening a chat shows you which patient it is.
- The response-time report pauses outside each branch's opening hours and on holidays, breaks down per staff member, and lists conversations still waiting for a first reply (it lives on the analytics page, not inside the inbox).
- Follow-up tasks attach to a real visit, course or appointment, with an owner, a due date, a status and a recorded outcome. The system proposes what to follow up from return dates, unused course sessions and unconfirmed appointments, with a cooldown so nobody is chased twice — but a person claims each task; it is neither created nor sent automatically.
- The clinic's LIFF pages let customers book for themselves, confirm or cancel an appointment, see the sessions left on a course, and choose the language they want messages in.
- Appointment messages go out as LINE cards in the clinic's own colours and logo, in Thai, English or Chinese per the customer's choice, with automatic advance reminders.
- The settings page shows the LINE message allowance left for the month, read live from LINE — so it includes broadcasts the team sent by hand in LINE OA Manager.

## Sources
1. [LINE Official Account — monthly packages and features (Thailand)](https://lineforbusiness.com/th/service/line-oa-features) — LINE for Business · source of the Free / Basic / Pro prices and message allowances · checked 3 Sep 2026 (Thai)
2. [Announcement of changes to LINE Official Account monthly packages](https://lineforbusiness.com/th/news/20240619_1) — LINE for Business · the current package structure has applied since 1 Aug 2024 (Thai)
3. [Broadcast: how to create and send a broadcast](https://lineforbusiness.com/th/learning-hub/OA-I-01) — LINE for Business Learning Hub · quota counted per recipient, and the Target Reach ≥ 100 requirement for targeted broadcasts (Thai)
4. [Messaging API pricing](https://developers.line.biz/en/docs/messaging-api/pricing/) — LINE Developers · which sending methods count toward the quota and which do not (replies are not counted), and that the count is per recipient
5. [Personal Data Protection Act B.E. 2562 (2019)](https://ratchakitcha.soc.go.th/documents/17082307.pdf) — Royal Gazette, Vol. 136, Part 69 Kor · 27 May 2019 · sections 19, 24, 26, 32 and 33 (Thai)
6. [Office of the Personal Data Protection Commission (PDPC)](https://www.pdpc.or.th/1540/) — The Act's text and the PDPC's published guidance

## Frequently asked questions

### How is LINE CRM different from a LINE OA?
The LINE OA is the channel — chat, broadcasts, rich menus. CRM is the layer of data that knows which LINE account is which customer, when they last came, whether they consented to marketing, and when their continuing care is due. Most clinics already have the first layer; what is missing is the second, not a different LINE account.

### Do we need to upgrade to the Pro package?
Do the arithmetic first: recipients × sends per month, compared against the plan's quota (Free 300, Basic 15,000, Pro 35,000 messages a month). If you go over by a little, Basic's THB 0.10 per extra message may be cheaper than moving plans. And if the number balloons, the problem is usually that you are sending too broadly, not that the package is too small.

### Does a post-treatment check-in count as direct marketing?
Separate the message that is necessary for the care you agreed to provide from the message that sells something. Section 24 allows bases other than consent in certain cases, such as necessity for the performance of a contract, while a sales message always sits within what a customer can object to under section 32(2). The safe approach is to split the two categories when you design the system, take marketing consent separately, and get legal advice — what each clinic collects differs.

### How do you link a LINE account to an HN without getting it wrong?
Have the customer verify themselves once — opening a link from the chat and entering whatever the clinic verifies against — or have a staff member link it in front of them at the counter. Never link from a display name or photo: they change constantly and repeat across people, and a wrong link sends one person's information to another, which in a clinic is a health-data leak.

### How often should we message?
There is no correct number for every clinic. Watch your own opt-out and block rates instead. Start at a low frequency, raise it a step at a time, and stop the moment the opt-out rate moves. Messages tied to something the customer actually just did tolerate a higher frequency than promotions blasted to everyone at once.

### With several branches, one LINE OA or one per branch?
A single account means customers do not have to add a new friend when they switch branches, and it pools the message quota. The cost is a bigger inbox and more discipline about assigning work. The deciding factor is usually not the number of accounts but whether the data layer behind them can say which branch a customer belongs to and who should answer.