WhatsApp for Clinics: What to Automate and How to Stay Compliant

Clinics get more value per message than almost any other vertical — a recovered appointment slot is worth real money — but they also carry the strictest obligations, because health data is special-category data and even the existence of an appointment says something about a person's health. Both facts should shape the build.

Appointment reminders and confirmations

A utility template a day or two before the appointment, carrying the date, time and location — and nothing about why the patient is coming. "Your appointment at Clinic X on Tuesday at 14:00" is sufficient and discloses far less than "your dermatology follow-up". Drive it from your practice management system through an automation keyed to the booking record.

One-tap reschedule

The reminder should carry confirm and reschedule buttons. A patient who cannot make Tuesday will usually say so if it costs one tap, and almost never if it costs a phone call during working hours. Route the reschedule into your booking system or a Flow that collects the new preference without the exchange sprawling into clinical detail. The freed slot is the whole return on the channel.

Recalls and preparation instructions

Six-month check-up recalls, annual screening reminders, fasting or pre-procedure instructions the morning before. Keep the wording generic in the template and put anything specific behind a link to an authenticated portal. Recalls are also where the consent question bites: a recall is arguably marketing depending on how it is framed, so capture the patient's agreement to be contacted this way and record which purposes it covers.

The compliance note — stricter here

• Article 9 applies. You need an Article 6 basis and a separate Article 9 condition — usually explicit consent or the provision of health care under 9(2)(h).
• Minimise ruthlessly. Specialty, symptoms, results and medication do not belong in a WhatsApp thread.
• Evidence the consent. An append-only consent ledger records who agreed, to what, when, and through which surface — and keeps the withdrawal event rather than overwriting a flag.
• Retention and erasure. Set a retention period for message history and be able to hard-delete on request; see DSARs and erasure.
• A DPIA is likely required. The detail is in WhatsApp for healthcare under GDPR. None of this is legal advice — run it past your DPO.

Why an owned EU instance fits this buyer

A clinic answering a DPIA has to say where patient data sits, who can read it and how it gets deleted. On a shared platform those answers depend on a vendor's architecture and support access; on a single-tenant EU instance they are facts about your own deployment, which shortens both the DPIA and the Article 30 record considerably. Pricing is per instance rather than per seat, so reception, nursing and admin can all use it — see the WhatsApp pricing guide.