WhatsApp for clinics: what NMC, DPDP and WhatsApp's own rules allow Tokens, reports, reminders and broadcasts: a practical do and don't list for the front desk.

A clinic in India can use WhatsApp with patients for appointments, tokens, reminders and sharing their own reports, provided the patient gave the number and agreed to be contacted there, the messages stay about her own care, and the chats are kept as confidential as the paper file. What a clinic cannot do on WhatsApp is promote itself the way the NMC's 6 October 2026 advertising guidelines forbid (offers, discounts, testimonials, mass solicitation), share one patient's details with another, or give medical advice outside the Telemedicine Practice Guidelines.

This post is about the rules. If you are deciding how to run tokens, our OPD token system comparison covers paper, display boards and phone tokens, and our NMC advertising guidelines summary covers Instagram and Google listings.

Which rules apply when a clinic messages patients on WhatsApp?

Do you need the patient's permission to message her on WhatsApp?

Yes, under WhatsApp's own policy. It says a business "may only contact people on WhatsApp if: (a) they have given you their mobile phone number or username; and (b) you have received opt-in permission from the recipient confirming that they wish to receive subsequent messages or calls from you". It also says the business must "respect all requests (either on or off WhatsApp) by a person to block, discontinue, or otherwise opt out", and must maintain "a published privacy policy".

Under the DPDP Act, a patient who gives her number at the desk so the clinic can tell her about her visit is close to the Act's own example of a legitimate use. Section 7(a) covers data the person "has voluntarily provided" for a specified purpose where she has not said she does not consent, and the illustration is a pharmacy customer who gives her number to receive a payment receipt by message. Anything beyond her own visit (a health-camp list, a newsletter, promotions) needs consent that is "free, specific, informed, unconditional and unambiguous with a clear affirmative action" under section 6(1), which she can withdraw as easily as she gave it (section 6(4)). These sections commence on 13 May 2027 under G.S.R. 843(E).

In practice: at registration, the receptionist says which number the clinic will message from and what it will send (token, appointment, reports), and writes down that the patient agreed. A tick box that is already ticked does not count.

Which WhatsApp messages count as advertising under the NMC guidelines?

A message is advertising when it promotes the doctor or clinic; a message about the patient's own visit is not. Section 3.2 of the NMC's guidelines of 6 October 2026 defines an advertisement as communication that "directly or indirectly solicits, promotes or is intended to promote" a doctor's or hospital's services, and Explanation I exempts information given "without same being promotional and without any intent for commercial benefit". Section 3.5 lists "messaging platforms (WhatsApp, Telegrams, Facebook etc.)" as a medium of advertisement.

Section 10.1 sets the graded action a State Medical Council may take against a doctor, from a warning and mandatory ethics training for a first violation up to removal from the medical register for 1 to 3 years for repeated violations; "digital mass solicitation" is named under serious violations, with suspension of 6 to 12 months. Explanation III to section 3.2 also asks a doctor to disclose name, qualifications, registration status and SMR or NMR number on electronic media posts, which is one reason the clinic's WhatsApp Business profile should carry the doctors' names and registration numbers.

Can a doctor give advice or a prescription on WhatsApp?

Yes, but then it is telemedicine and the 2020 Telemedicine Practice Guidelines apply. Paragraph 1.4.1 lists "Chat Platforms like WhatsApp, Facebook Messenger etc." among the tools a registered doctor may use. The same rules apply as for any teleconsultation: confirm the patient's identity, record the consultation, and follow the drug lists for text consultations. Paragraph 3.2.5 asks the doctor to show the registration number on "prescriptions, website, electronic communication (WhatsApp/ email etc.) and receipts". Paragraph 3.7.3.1 allows "an appropriate fee" and 3.7.3.2 asks for a receipt. Our telemedicine guidelines summary covers the details.

The front desk is where this goes wrong. A receptionist who replies to "bukhar hai, kya dawai loon?" with a medicine name is giving advice no guideline allows. Write one rule for the desk: any message asking for medical advice goes to the doctor or gets the reply to come in or book a call.

Can a clinic put patients in a WhatsApp group?

Not without each patient's agreement. The Telemedicine Practice Guidelines give this exact example: a doctor planning a "virtual support group" for patients with a particular condition must not violate their privacy "by adding them to the group without their consent". A group puts patients in front of each other, and every reply in it is visible to everyone, which sits badly with the confidentiality duty in regulation 2.2 of the 2002 regulations.

WhatsApp's policy adds: "You may not forward or otherwise share information from a customer chat with any other customer." For notices that go to many patients (clinic closed, new timings), send them individually or as a broadcast to patients who agreed to receive them, and keep the content to the formal announcements section 8.2(ii) of the NMC guidelines allows.

Is it safe to receive reports and photos on WhatsApp?

It is common and it is the clinic's responsibility once they arrive. WhatsApp's policy says: "Don't use WhatsApp for telemedicine or to send or request any health related information, if applicable regulations prohibit distribution of such information to systems that do not meet heightened requirements to handle health related information." It also says not to ask people to share "personal ID card numbers, or other sensitive identifiers". The DPDP Act applies to the photos and chats as digital personal data, and from 13 May 2027 section 8(5) asks the clinic to take "reasonable security safeguards to prevent personal data breach".

• Use one clinic phone and one clinic WhatsApp Business number, not the receptionist's or the doctor's personal number.
• Put a screen lock on that phone. It holds more patient data than most registers.
• Once a report is saved to the patient's record, delete it from the phone's gallery and downloads.
• Do not forward reports to a staff group "for later"; forward only to the doctor treating the patient.
• Ask patients not to send Aadhaar or other ID numbers on WhatsApp.
• If the phone is lost, treat it as a possible personal data breach and follow your breach plan; our DPDP guide explains the steps.

Do TRAI's rules apply too?

They apply to SMS and voice calls. TRAI's 2018 regulations define commercial communication as "any voice call or message using telecommunication services" whose primary purpose is to inform about or advertise goods or services, and a clinic's SMS goes out under a registered header and template through its SMS provider. The Second Amendment Regulations of 12 Feb 2025 add that "if promotional content is mixed with any type of Transactional or Service Message, such Message shall be treated as a Promotional Message". WhatsApp messages run under WhatsApp's own policy instead. The habit that keeps you right on both: a message about a visit carries nothing else.

A do and don't list for the front desk