WhatsApp is how most Indian clinics already communicate with patients, usually through a receptionist personal phone. It works, and it is the largest data protection exposure most clinics have.
Why the current setup fails
Patient names, phone numbers, appointment details and often reports and photographs sit in personal WhatsApp accounts on staff-owned devices. When someone leaves, the data leaves with them. There is no access control, no retention policy, no audit trail, and no way to answer a patient asking what you hold about them.
Under DPDP this is a health data processing arrangement with essentially no safeguards. Health data carries the highest penalty exposure in the Act.
What to move to
A clinic-controlled number on the WhatsApp Business API, integrated with your practice management system. Access by role, messages retained per policy, staff removable without data walking out.
This costs money and changes how reception works, which is why clinics postpone it. It is also the single change that closes the largest gap.
What to send, and what not to
Appointment reminders, confirmations and rescheduling work well and reduce no-shows substantially in most practices. Prescription-ready and report-ready notifications are useful. Post-procedure care instructions reduce follow-up calls.
Do not send diagnoses, test results or clinical details over WhatsApp. Send a notification that a report is ready with a secure link requiring authentication. The convenience of attaching the report directly is not worth the exposure.
Do not use treatment history to target promotional messages without separate specific consent naming that use.
The consent split that matters
Keep two consents, recorded separately. One for service communication about appointments and care, which most patients will accept readily. One for promotional messages about health packages and offers, which many will decline.
Clinics that bundle these find the service messages get blocked along with the promotional ones, and then appointment reminders stop reaching patients. Separating them protects the channel you actually depend on.
General information, not legal advice. Rules current as of July 2026.