WhatsApp and GDPR for Dental Practices
There is no yes or no answer to whether WhatsApp is GDPR compliant. It depends on who can see the messages, where they are kept and what is shared in them.
There is no yes or no answer to whether WhatsApp is GDPR compliant. It depends on who can see the messages, where they are kept and what is shared in them.
The question is how you use it, not the app
Practices often ask whether WhatsApp is GDPR compliant. There is no yes or no answer, because compliance depends on how the practice uses it: who can see the messages, where they are stored, what is shared in them and whether the practice has thought the risks through.
This guide sets out the questions to settle. It is not legal advice; your data protection lead, or an adviser, should make the decisions.
A cautionary example
In 2023 the Information Commissioner's Office reprimanded NHS Lanarkshire after staff shared patient information, including clinical images, in a WhatsApp group that the organisation had not approved. The ICO found there had been no assessment of the risks of using the app in this way.
The lesson for a dental practice is not that WhatsApp is forbidden. It is that informal use on personal phones, with no policy and no assessment, is where the risk lives.
Six questions to settle before using WhatsApp with patients
- Is the account the practice's, used through a managed system, rather than an app on a personal or shared phone?
- Have you completed and recorded a data protection impact assessment for the way you will use it?
- Is there a data processing agreement with every provider that handles the messages?
- Who can see patient conversations, and how is access removed when somebody leaves?
- Do clinical details, images and notes stay in the clinical record rather than the chat?
- Do you know which messages are service messages and which count as marketing?
Service messages and marketing
UK rules on electronic marketing apply to marketing messages, not to messages sent for administrative or customer service reasons. A reply to a patient's question or a reminder about their own appointment is generally a service message. A promotion for a treatment the patient has not asked about is likely to be marketing, which needs consent. The ICO's guidance on direct marketing by electronic mail explains the distinction; check your own messages against it.
What should never be in a WhatsApp chat
Even with the right set-up, some things belong in the clinical record and nowhere else.
- Clinical notes, findings and treatment discussions.
- Radiographs and clinical photographs taken by the practice.
- Medical history and medication details.
- Anything a patient sends that is clinical, which should be moved to the record and handled by a clinician.
Writing a short WhatsApp policy for the practice
A one-page policy is usually enough for a practice, as long as everyone has read it. It should say which account the practice uses and through what system, who may reply to patients, what may and may not be sent, how clinical information that arrives in a chat is handled, how long conversations are kept and who to tell if something goes wrong.
The app or the platform
The WhatsApp Business app runs on one phone. The WhatsApp Business Platform connects the practice's business account to software, so conversations can be handled by a team in a managed system, with access controls and records, rather than on a single handset.
Clinqly connects through the WhatsApp Business Platform. It answers patients from the practice's approved information, books appointments in the conversation and hands anything clinical, including photos, to the team. Patients who ask to stop are not messaged again on that channel. Read the Trust Centre for how Clinqly handles data.