Most Indian clinics already run on WhatsApp. The reminder the day before, the lab report photographed and sent, the “how are you feeling now” three days after an antibiotic course. The question is not whether to use it; it is how to use it without leaking patient data or breaking the consent rules. The short answer: keep it on an account you control, get the patient’s opt-in for a stated purpose, and use the WhatsApp Business Platform’s templates for anything you send first. That is the whole discipline. The rest of this walks it for a working clinic.
Key takeaways
- WhatsApp opens a 24-hour customer service window when a patient messages you. Inside it you can reply free-form; outside it you can only send a pre-approved template. That single rule shapes every reminder.
- Patient data on WhatsApp is personal data under the DPDP Act 2023. You need consent that is free, specific, and for a stated purpose, and you must use the data only for that purpose.
- A personal WhatsApp number is the weakest option: no opt-in trail, no separation from your private life, nothing to show later. Move to WhatsApp Business or the Platform.
- Reminders and report delivery are legitimate uses. Marketing blasts are a different purpose and a different consent, and they collide with TRAI’s commercial-communication rules.
- An AI scribe does not touch any of this. It writes the note; your clinic sends the message.
How do clinics in India actually use WhatsApp?
Three jobs, over and over, and they map cleanly onto how WhatsApp itself works.
The first is reminders. A message the evening before the appointment cuts no-shows, and for a chronic patient it carries the next review date. The second is reports and documents: a lab result, a scan summary, a prescription photo, a discharge note the family wants a copy of. The third is follow-up: a check-in after a procedure, a nudge to complete a medicine course, a “come back if the fever crosses three days” that the patient can re-read at home.
Each of these is a message the clinic starts. That matters, because on WhatsApp the rules are different for a message you send first versus a reply to a patient who messaged you. Get that distinction right and everything else falls into place. Get it wrong and you either can’t send the reminder at all or you send it in a way that breaks WhatsApp’s own terms.
What is the 24-hour customer service window, and why does it decide everything?
This is the one mechanic worth understanding before you spend a rupee on any tool.
On the WhatsApp Business Platform, the API layer that powers automated messaging, Meta opens what it calls a customer service window the moment a patient messages your number. That window lasts 24 hours from the patient’s most recent message. Inside it, you can send free-form messages: type whatever you like, answer their question, send the report they asked for. Once 24 hours pass with no new message from them, the window closes.
Outside a closed window, you cannot just send a free-form message. To reach a patient who hasn’t written to you in the last day, which is exactly the case for a reminder about tomorrow’s appointment, you have to send a pre-approved message template. Meta requires this and sorts templates into categories: utility (an appointment reminder, a report-ready notice), authentication (a one-time code), and marketing (a promotion). A delivered template message is charged per message, while ordinary replies inside an open window are free. All of this comes straight from Meta’s WhatsApp Business Platform documentation on service messages and pricing.
So the practical shape of it: a patient writes to you, you have a day to reply freely; you want to reach them first, you use an approved template. A clinic that grasps this stops fighting the platform and starts designing around it.
What does the DPDP Act 2023 require before you message a patient?
Consent, and a narrow one. India’s Digital Personal Data Protection Act, 2023, enacted on 11 August 2023, is now the law that governs personal data here, and a patient’s name, phone number, diagnosis, and report are all personal data. Section 6 of the Act sets the bar for consent: it must be “free, specific, informed, unconditional and unambiguous with a clear affirmative action signifying agreement,” given for a specified purpose. That is close to the statutory wording, not a loose paraphrase.
Translate that to a clinic desk and it is not complicated:
- Free and specific. The patient agrees to WhatsApp messaging on its own, not buried in a general intake form they had to sign to be seen.
- Informed. You tell them what you’ll send: appointment reminders, reports, follow-up checks. Not “communications,” which says nothing.
- For a stated purpose. Consent for reminders is not consent to add them to a broadcast about your new physiotherapy package. That is a different purpose, and it needs its own opt-in.
Purpose limitation is the part clinics trip on. Under the Act you may use the data only for the purpose the patient agreed to. The number they gave you for their report is not a marketing list. The DPDP Rules that put operational detail around the Act are still phasing in after a draft was published for consultation, so the sensible stance is to prepare now: get clean opt-ins on record, keep them purpose-scoped, and don’t retrofit consent onto data you already hold for a different reason.
Reminders, reports, follow-ups: what’s allowed and what needs consent
Here is the original artifact for this post, the one table to keep near the front desk. It maps each common WhatsApp job to the WhatsApp mechanic it needs and the consent it needs.
| WhatsApp use | Who sends first | WhatsApp mechanic needed | DPDP consent needed | Notes |
|---|---|---|---|---|
| Appointment reminder (day before) | Clinic | Pre-approved utility template (window is closed) | Yes, opt-in for reminders | Utility category; charged per delivered template |
| Reply to a patient’s question | Patient | Free-form message inside open 24-hour window | The patient started the chat, which supports a reply; still record the purpose | Free while the window is open |
| Sending a lab report or prescription | Usually clinic | Template if window closed, free-form if open | Yes, and send only to the confirmed number | Health data; never into a group |
| Post-procedure follow-up check | Clinic | Utility template, or free-form if patient replied recently | Yes, opt-in for follow-up | Keep it clinical, not promotional |
| One-time verification code | Clinic | Authentication template | Covered by the service consent | Rarely needed by a small clinic |
| Promotion or health-camp blast | Clinic | Marketing template | Separate marketing opt-in | Also engages TRAI commercial-communication rules |
Two lines in that table do the heavy lifting. Report delivery is fine, but it is health data, so it goes only to the number the patient confirmed and never into a group where other patients or your own staff can read it. And the promotion row is where clinics get into trouble: a marketing blast is a different purpose under DPDP, a marketing template under WhatsApp, and it also runs into TRAI’s Telecom Commercial Communications Customer Preference Regulations, 2018, which require the recipient’s consent, defined there as voluntary permission, before you send commercial communication. Reminders and reports are service, not marketing. Keep the two lanes separate.
Personal number, WhatsApp Business app, or the Platform?
For a solo GP the honest answer is: start smaller than the vendors want you to.
A personal WhatsApp number is the setup to leave behind. It mixes patient chats with your family group, keeps no opt-in record, and gives you nothing to show if a patient ever disputes what you sent. It also drags your private number into a medico-legal record it shouldn’t be in.
The free WhatsApp Business app is the right first move for most small clinics. It gives you a business profile, quick replies, labels to organise chats, and greeting or away messages. If your workflow is mostly answering patients and sending the occasional reminder by hand, this is enough, and it costs nothing.
The WhatsApp Business Platform (the API) is the step up. It adds automated template messages so reminders go out on their own, lets several staff work one number, and connects to other software through a provider. You take it on when manual sending stops scaling, or when you want reminders to fire without someone remembering to press send. It runs through an approved Business Solution Provider and carries the per-template costs described above. Move up when the app starts feeling like a bottleneck, not before.
Whichever you choose, the DPDP obligation is identical. The app you pick changes the convenience, not the consent.
Where does an AI scribe fit, and where does it not?
At the note, and nowhere near the messaging. This is exactly the boundary a health vendor is tempted to blur, so we’ll be plain about it.
The AI Medical Scribe is one module inside Practice Copilot, Patient Square’s AI platform for the whole practice. The scribe listens during the visit and hands back a structured SOAP note, ICD-10 suggestions, and a prescription draft, ready to review and sign about two minutes after the visit. Read what the scribe module itself does not do. On its own it does not send WhatsApp messages and it is not a patient-communication tool or a CRM. Patient Square does add WhatsApp messaging higher up the plan, at the Copilot tier, but that is a separate module from the scribe: the note-drafting piece we are talking about here is not the thing that reaches your patients. This post is about running WhatsApp itself well, so treat the two as distinct.
The link to your WhatsApp workflow is upstream and small. When the clinical note is complete and consistent, whatever your front desk sends afterward is easier to get right. The follow-up instruction is already in the note. The diagnosis and plan the report relates to are already captured. For an Indian OPD there’s a practical detail: the scribe handles the code-mixed Hindi and English of a real consult, and the note always comes back in clean clinical English. Visit audio is processed in memory and discarded once the note drafts, so there’s no recording sitting on a server, which is the cleaner answer under the DPDP Act 2023. Data is encrypted in transit and at rest, notes belong to your practice to export or delete, and a SOC 2 Type II audit is underway; the full posture is on our security page. We think the honest version of the pitch is the useful one: better notes in, and your own messaging out. The rail that carries the reminder is your job, not ours.
If you’re weighing the note side of this, our reads on an AI scribe built for a solo doctor in India and what the DPDP Act asks of a clinic day to day go deeper than we can here. For the wider consent picture, the NMC teleconsultation rules explainer covers the record-keeping side; the NMC’s 2023 conduct regulations that touched retention were put in abeyance in August 2023, so treat the roughly three-year record-keeping expectation as guidance to plan around, not a live mandate.
The short version, and where to start
WhatsApp is a genuinely good tool for reminders, reports, and follow-ups, and Indian clinics are right to lean on it. The two things that keep it safe are the same two things vendors gloss over. First, the 24-hour customer service window: reply free-form when a patient writes, use an approved template when you write first. Second, DPDP consent: a specific, purpose-scoped opt-in, used only for what the patient agreed to, with marketing kept in its own lane away from TRAI’s commercial-communication rules. Get those two right and the account choice, app or Platform, is just a matter of scale.
If your follow-ups only land when someone remembers to type them, the fix that helps most is upstream: a complete note, ready the moment the visit ends, so the front desk isn’t reconstructing what to send. Book a short demo and bring a recent visit where the follow-up got missed, and see what a finished structured note for that encounter would have carried. Or run the 7-day trial across a real clinic day and check whether the notes hold the plan and instructions your desk keeps chasing. India pricing starts from ₹1,599 per clinician a month ex-GST (about ₹1,887 with 18% GST) on the annual Assist plan, with WhatsApp messaging bundled at the Copilot tier above it, and how the underlying data is handled sits on the security page.