WhatsApp for clinics and dental practices, handled carefully

Picture a front desk at ten past eight. Someone is typing "Hi Mrs Okafor, your root canal follow-up is tomorrow" into a personal phone, and someone else is asking a patient to send a photo of a rash. Both people mean well. Only one of those messages is a good idea.

WhatsApp for clinics can be genuinely helpful for the boring logistics: reminders, rescheduling, a callback request, a quick "we're running ten minutes late". It gets risky the moment health details enter the chat. This guide is about where that line sits, what Meta itself says, and where to read the official guidance.

This is general information, not legal advice. Using any tool, Avox included, doesn't make a practice compliant with anything. Whether and how you use WhatsApp with patients is a decision for you and your own adviser.

What WhatsApp's own policy says

Start with the platform's rules, because they apply however you connect. Meta's WhatsApp Business Messaging Policy, last updated 23 September 2026 when we read it, says that where applicable regulations prohibit distributing health information to systems that don't meet heightened requirements, businesses shouldn't use WhatsApp for telemedicine or to send or request health-related information.

Read that carefully. It isn't a blanket ban, and it isn't a blanket permission either. It hands the question back to the law that applies to you. The same policy also says you need the person's opt-in before you message them, and that you're responsible for securing the notices, permissions and consents your data handling needs. Policies change, so check the page itself.

Read the official guidance first

Two places are worth an hour of your time before you build anything:

• United States. HIPAA is, in the words of the US health IT office, "the main Federal law that protects health information", and other federal, state and local laws can apply as well. That page links to provider tools, including a security risk assessment tool. The HHS Office for Civil Rights runs the main HIPAA site.
• United Kingdom. The ICO explains that health data is special category data under the UK GDPR, which should be treated with greater care and needs an Article 9 condition. One line matters for a dental practice: the ICO notes that some appointment records and invoices can count if they reveal something about a person's health.

That last point is the one to sit with. An appointment reminder can be health information if it says what the appointment is for.

WhatsApp for clinics: what a low-risk message looks like

A sensible habit is to keep messages to logistics and keep clinical detail out. Compare:

• "Hi Sam, a reminder of your appointment at Riverside Dental on Thursday, 5 November at 10:15. Tap Confirm, or Reschedule if you can't make it."
• "Hi Sam, your root canal follow-up is Thursday at 10:15. Please don't eat beforehand."

The first tells the patient what they need. The second tells anyone who glances at a lock screen something about their treatment. Prefer the first.

In Avox, the library's appointment reminder template has the right shape: patient name, who the appointment is with, the date and time, and Confirm and Reschedule buttons. Choose generic wording for the service variable, such as "appointment", rather than the procedure. Our guide to appointment reminders covers timing and the template rules.

Intake forms: ask for logistics, not symptoms

A WhatsApp Flow is a form that opens inside the chat. Meta's Flows best practices say that, by default, everything the customer types comes back in the response, except password fields, and that other fields can be marked sensitive to keep them out. That's a technical safeguard. The safer design is to not ask.

Good fits for a Flow in a practice:

• A callback request: name, phone number, best time to call.
• A new patient enquiry: name, preferred day, which location, and a choice such as "Check-up", "Cleaning" or "Something else", with details left for the phone call.
• A change of details, such as a new mobile number.

Poor fits: symptoms, medical history, medication, test results, insurance numbers, photos and anything resembling an ID number. If Avox's premade callback Flow includes a free-text "What's it about?" box, delete it before publishing. Meta's policy also tells businesses not to ask people for sensitive identifiers such as full payment card or financial account numbers.

Answers come back into the conversation and Avox's logs, so they're stored. Before you collect anything, know where it ends up and for how long. Avox's Compliance page lets an Admin export data, erase a contact's data, and set how long operational records such as webhook logs are kept. Those tools help you meet requests. They don't decide what you're allowed to collect.

Who in the practice sees what

If more than one person answers WhatsApp, the practical risks are mostly about people and devices.

• Give each person their own sign-in. Avox has roles, and an Admin can limit what each Manager sees. By default, Managers see only the last four digits of a contact's phone number unless an Admin grants full numbers. See roles and permissions.
• Turn on two-factor sign-in for everyone. The two-factor guide shows how.
• Secure the phone. With Coexistence, the practice phone keeps the WhatsApp Business app, so a lost or shared phone is still a risk. Use a screen lock, and don't leave it on the reception counter.
• Keep clinical questions human. Avox AI (Beta) can answer, tag and follow up with rules you write. We would keep it away from anything clinical and use it only for logistics such as opening hours and parking.

Our security overview describes what Avox does. It's a description of our service, not a certificate for your practice.

Opt-in, and what to say when someone writes in with symptoms

Ask for permission when the patient registers: a tick box that says they're happy to receive appointment reminders on WhatsApp, with a way to say no. Honour a STOP straight away. Meta's policy asks businesses to respect opt-out requests, and recommends separate opt-in for each category of message, so reminders and marketing shouldn't share one tick. Our opt-in guide goes into wording.

Then write a standing reply for the day a patient starts describing symptoms. Something like: "Thanks for letting us know. We can't assess symptoms here. Please call us on the number below, and if it's an emergency, call your local emergency number." Agree the wording with whoever is responsible for clinical safety at your practice, not with a marketing tool.

Questions people ask

Can we use WhatsApp with patients at all?

Meta's policy leaves it to the regulations that apply to you. A cautious practice might keep to logistics, such as reminders and rescheduling, and move anything clinical to a channel its adviser has approved. Ask your adviser before you decide.

Is an appointment reminder health information?

It can be. The ICO says appointment records can count if they reveal something about someone's health. That's the reason to keep reminders generic.

Does using Avox make us HIPAA or UK GDPR compliant?

No. Compliance depends on how your practice collects, uses and protects information, and on what your own contracts and policies say. Avox gives you tools, such as roles, two-factor sign-in and data export, but it can't make that call for you.

What about photos or documents patients send?

Decide a rule in advance and tell patients. A practice might ask people not to send images or documents over chat, and to use whatever secure route it already provides.

Your next step: write down the five messages your practice would send on WhatsApp, cross out any that mention a procedure, a symptom or a result, and show the shorter list to your adviser.