WhatsApp and patient data: what UK clinics need to know

Many aesthetics patients would rather send a WhatsApp than fill in a form or ring reception. That is good for bookings. But a message about a treatment, a reaction or a medical history is health information, and the law treats it with extra care. Here is what that means in practice.

Health information is special category data

Under UK GDPR, "data concerning health" is one of the special categories of personal data that need extra protection. In a clinic, that will usually include medical history, treatment notes, and messages or photos about how a treatment has settled.

To use special category data, the ICO says you need two things: a lawful basis under Article 6, and a separate condition under Article 9. One of the Article 9 conditions covers health or social care, and relying on it also means meeting a related condition in the Data Protection Act 2018. Which basis and condition fit your clinic is a question for your adviser.

The ICO also says you must carry out a data protection impact assessment (DPIA) for any processing likely to be high risk, and that this is more likely when special category data is involved. Introducing a new messaging tool is a sensible moment to do one.

Your clinic is the data controller

The controller is the organisation that decides why and how personal data is used. The ICO says the controller is ultimately in charge of, and responsible for, the processing, and must be able to show it complies with the data protection principles. For patient messages, that is your clinic, not the member of staff holding the phone and not the app provider.

Companies that handle data on your behalf, such as your booking system or messaging provider, are processors. They should only act on your instructions.

Personal phones, the WhatsApp Business app and the Business Platform

There are three common set-ups, and they are not equal.

• A practitioner's personal WhatsApp. Patient conversations and photos sit on a personal device, mixed with family chats and backups. The clinic can't easily see, search, retain or delete them, which makes it hard to meet your responsibilities as controller.
• The WhatsApp Business app on a clinic phone. Better, because the account belongs to the clinic. But messages still live on a phone, and you need clear rules on who can access it, how photos are handled and what happens if it is lost.
• The WhatsApp Business Platform (Cloud API). This connects WhatsApp to business software. Meta says that in providing the Cloud API it acts as a data processor on behalf of the business, that messages are encrypted at rest, and that messages are kept for a maximum of 30 days on its side. The conversation record then lives in the software you connect it to, so check where that software stores data.

What the NHS Lanarkshire case shows

On 1 August 2023 the ICO announced that it had issued a reprimand to NHS Lanarkshire. Between April 2020 and April 2022, 26 staff had access to a WhatsApp group in which patient data was added more than 500 times, including names, phone numbers, addresses, and images, videos and screenshots, some with clinical information. WhatsApp had been made available for basic communication only and was never approved for patient data. Someone outside the organisation was also added to the group by mistake.

The ICO found there were no adequate policies, guidance or risk assessment when the app was made available. Its recommendations included considering a secure clinical image transfer system, assessing data risks before introducing new apps, giving staff explicit guidance, reviewing policies, and making sure staff report data breaches promptly.

We could not find specific ICO guidance on clinics using WhatsApp. The recommendations in this reprimand are the clearest indication of what the ICO expects.

Marketing messages and service messages

The Privacy and Electronic Communications Regulations (PECR) set separate rules for marketing. The ICO describes service messages as those sent for administrative or customer service purposes, and gives appointment confirmations and reminders as examples. They are not direct marketing.

But if a service message also promotes something, even if that is not its main purpose, the ICO says it counts as direct marketing. A reminder that adds "20% off skin boosters this month" is a marketing message.

For electronic marketing to individuals, such as texts, emails and similar messages, you need specific consent, unless the "soft opt-in" applies. That covers existing customers who bought or negotiated for a similar service from you, and who were given a simple way to opt out when you collected their details and in every message since. Keep marketing consent separate from booking and aftercare messages.

Retention, and photos patients send

The ICO says you must not keep personal data longer than you need it, must be able to justify how long you keep it, and should review and delete or anonymise what you no longer need. Decide in advance how long you keep enquiry chats from people who never booked, and how long patient conversations stay in the clinical record.

Patients often send photos: of an area they want treated, or of how a treatment has settled. Treat these as part of the patient's record. Move them into your clinical system, then remove them from phones and personal galleries.

When staff leave

If patient conversations live on a personal phone, they leave when the person does. That is one of the strongest reasons to keep patient messaging on clinic accounts. When someone leaves, remove their access to clinic WhatsApp, Instagram and any linked devices on their last day, and check that any patient information they held has been transferred and deleted.

A practical checklist

1. Stop using personal WhatsApp for patients. Use a clinic-owned account, ideally connected to software that keeps a proper record.
2. Write a short messaging policy. Which channels, who can reply, what can be discussed, and how photos are handled.
3. Do a DPIA before introducing a new messaging tool, and record your lawful basis and Article 9 condition.
4. Check your processors. Get data processing agreements and know where data is stored.
5. Separate marketing from service messages. Record marketing consent, and offer an opt-out in every marketing message.
6. Set retention periods for enquiries and patient conversations, and diarise a review.
7. Lock down devices. Passcodes, no personal cloud backups of patient chats, and a plan for lost phones.
8. Have a leaver process that removes access on the last day.
9. Train staff to report breaches straight away, such as a message sent to the wrong person.

Where a front desk helps

The FlowSmart front desk keeps every WhatsApp, Instagram and web conversation in one timestamped record for the clinic, hosted in London, rather than on whoever's phone was on the desk that day. Anything clinical is flagged to a clinician rather than answered. It doesn't replace your own policies and DPIA, but it makes them much easier to follow.