WhatsApp has rules. Your clinic can follow them without slowing down.

Personal WhatsApp is not the same as WhatsApp Business.

Most clinics start by messaging patients from a receptionist's phone. It works until it does not: the number belongs to a person, there is no record in the EMR, and there is no consent trail. It is also outside the rules that govern business messaging.

WhatsApp offers two business routes. The WhatsApp Business app is a free app for small businesses, run from one phone, with manual replies. The WhatsApp Business Platform (often called the API) lets software send and receive messages on a business number at scale, which is what a clinic needs for reminders, prescriptions and follow-ups that go out automatically.

The Platform comes with rules set by Meta. They are not complicated, but they are enforced, and a clinic that ignores them will find its number restricted. Here is what they mean in practice.

Rule 1. The patient has to opt in first.

A business may only start a conversation with someone who has agreed to receive messages from it on WhatsApp. The agreement has to be clear about the fact that messages will come on WhatsApp and from which business. Having a patient's phone number on a registration form is not, by itself, an opt-in.

What counts as an opt-in at a clinic.

• A tick on the registration form or consent form that specifically mentions WhatsApp messages from the clinic.
• A patient messaging the clinic's business number first, for example by tapping a link or scanning a QR code at the desk.
• A reply of 'yes' to a clear question on another channel, such as SMS or the clinic's website form.

Record it. The date, the channel and what the patient agreed to. This is the same record the DPDP Act expects for consent, so one flag on the patient record serves both purposes.

Opt-out has to be just as easy. A patient who replies STOP, or any clear equivalent, must be marked and no further business-initiated messages sent.

Rule 2. Business-initiated messages use approved templates.

When the clinic starts a conversation, whether it is an appointment reminder, a report or a refill nudge, the message has to be a template that has been submitted and approved in advance. Templates have fixed wording with variables for the patient's name, date, time and so on.

Templates are grouped into categories. For a clinic, nearly everything is a utility template: it relates to a specific transaction or service the patient has with you. Marketing templates are for promotions and general offers, and authentication templates are for one-time codes.

Templates a clinic typically needs.

• Appointment confirmation and reminder, with a reply option to confirm or reschedule.
• Prescription ready, with the prescription attached or linked.
• Report ready, with the report attached.
• Follow-up due, with a date and a reply option.
• Refill due, with a reply option to reorder.
• Post-procedure check-in.
• Review request after a visit.

Keep the wording plain and specific to the transaction. A reminder that drifts into promotion is likely to be reclassified or rejected. Do not put diagnoses or sensitive clinical detail in template text; attach the document instead, so the message body stays generic.

Rule 3. The 24-hour customer service window.

Once a patient messages the clinic, a window opens during which the clinic can reply with free-form messages, not just templates. The window lasts 24 hours from the patient's most recent message. Every new message from the patient resets it.

In practice this means: when a patient replies '1' to confirm an appointment, or asks a question about a dose, the clinic can answer naturally for the next day. Once the window closes, the clinic has to go back to a template to start again.

Rule 4. Quality and messaging limits.

Meta tracks how recipients respond to a business number. Blocks and reports lower its quality rating, and a low rating can restrict how many new conversations the number can start. A clinic that messages only opted-in patients, about their own care, at sensible hours, will rarely have a problem. A clinic that blasts offers to its whole patient list will.

• Send care messages during clinic hours, not late at night.
• Do not repeat a reminder more than a couple of times.
• Honour STOP immediately.
• Keep marketing templates for patients who ticked the marketing clause, and send them rarely.

What a BSP is, and why it matters for your contract.

A WhatsApp Business Solution Provider (BSP) is a company Meta has authorised to give businesses access to the WhatsApp Business Platform. Most clinic software does not connect to WhatsApp itself; it goes through a BSP, which handles the number, the template submissions and the message delivery, and charges the software vendor for it.

That has three consequences for a clinic. First, there is a third company in the chain handling your patient messages, which matters under the DPDP Act. Second, template approval goes through the BSP's queue, so a new reminder wording can take time. Third, the vendor's messaging costs are usually passed on per message or per conversation, which is why so many EMRs meter WhatsApp separately.

Saaro Health runs SaroConnect, Lumotis's own WhatsApp Business Solution Provider infrastructure. There is no third-party BSP between the clinic and WhatsApp, templates are managed inside the product without an external approval queue, and patient messaging is bundled into every plan rather than metered.

Rule 5. The business number and display name.

The number patients see should belong to the clinic, not to a person, and the display name should be the clinic's registered name. Meta verifies business names. If you migrate from a personal number, plan the switch: tell patients, and let the EMR hold the record of who has opted in on the new number.

Putting it together at the desk.

1. 1Add a specific WhatsApp clause to your consent form, and record the answer as a flag on the patient record.
2. 2Use a business number owned by the clinic, with the clinic's name.
3. 3Send business-initiated messages as utility templates, each with a reply option.
4. 4Let the desk answer replies within the 24-hour window from the EMR, so the conversation stays on the record.
5. 5Treat STOP as final until the patient opts in again.
6. 6Keep marketing separate, rare and opt-in.

Do this and WhatsApp becomes what it should be for a clinic: the place the prescription, the reminder and the follow-up already live, with a record behind every message.