WhatsApp Business for hospitals: opt-in, templates and what you can't send

For a hospital, WhatsApp is the natural place for an appointment confirmation, a reminder the evening before and the doctor’s prescription. It is also a platform with its own rules, written by Meta, and breaking them can cost you access to WhatsApp for Business. This guide sets out those rules from Meta’s own pages as they read in November 2026, quoting them where the wording matters, and turns them into practice for an OPD.

The Business app and the Business Platform

The WhatsApp Business Messaging Policy covers both the free WhatsApp Business App on a phone and the WhatsApp Business Platform, which booking and hospital software connects to. The rules on templates and the 24-hour window below are Platform rules. Either way, Meta asks for a business profile with “customer support contact information” and forbids impersonating another business.

Meta can change the policy “without notice (unless such notice is required by law)”. Whoever runs your WhatsApp should reread it every few months.

What counts as a valid opt-in

The policy is short on this point: “You may only contact people on WhatsApp if: (a) they have given you their mobile phone number or username; and (b) you have received opt-in permission from the recipient confirming that they wish to receive subsequent messages or calls from you.” It also makes you “solely responsible for determining the method of opt-in”, and for meeting the law where you operate.

Meta’s developer guide on opt-in adds three requirements. The opt-in “can be general and not specifically for WhatsApp, as long as businesses comply with all local laws”, but:

1. “Businesses must clearly state that a person is opting in to receive communication from the business.”
2. “Businesses must clearly state the business’s name that a person is opting in to receive messages from.”
3. “Businesses must comply with applicable law.”

Meta’s examples of where to collect it include a website, an SMS, a phone call through an IVR, and a signature in person or on paper.

In India, applicable law includes the DPDP Act. From 13 May 2027, consent under it must be “free, specific, informed, unconditional and unambiguous with a clear affirmative action” (section 6(1)), and if it is ever questioned you must prove it was given (section 6(10)). So don’t rely on a general line buried in a registration form. Ask about WhatsApp specifically, at the counter or on the call, and keep a record. Here is an example, written for this guide:

Log the number, the date and time, who took the yes and exactly what the patient agreed to. If you ever want to send promotions, Meta’s own best practice is a “separate opt-in by specific message category”.

Utility, marketing or authentication: where hospital messages fit

On the Platform, a conversation you start must use an approved template, and Meta puts every template in one of three categories:

• Utility: “Enable businesses to follow up on user actions or requests, since these messages are typically triggered by user actions.”
• Marketing: “Enable businesses to achieve a wide range of goals, from generating awareness to driving sales and retargeting customers.”
• Authentication: “Enable businesses to verify a user’s identity”. Only these may carry a one-time passcode.

A utility template must meet both tests: it “Must be non-promotional, not containing any promotional or persuasive intent”, and it must “ALSO be either specific to or requested by the user (clearly related to their order, account, services, or transactions) OR essential or critical to the user (for example, to ensure user safety).” Here is how a hospital’s usual messages sort:

Meta decides the category, not you. Since 9 April 2025, a template submitted as utility that Meta judges to be marketing “is approved as MARKETING”. Mixed messages count as marketing too, such as “an order update with a promo”. A business that keeps misclassifying may face “escalating restrictions”. The safe rule: one message, one job, and no offers inside a reminder.

The 24-hour customer service window

Meta’s developer documentation puts it plainly: “When a WhatsApp user messages you or calls you, a 24-hour timer called a customer service window starts. If the user messages or calls you again before the timer expires, the timer resets to 24 hours.” While the window is open you can reply in free text. “When the window closes, you can only send pre-approved template messages.”

You may automate replies in the window, but the policy says you “must also have available prompt, clear, and direct escalation paths”, such as a transfer to a person, a phone number or an email. For a hospital that includes emergencies. A patient who writes “पापा को सीने में दर्द हो रहा है” (my father has chest pain) must be told at once to call 108 or 112 or come to the emergency, and a person at the hospital must see the message.

Mind the cost. Meta charges per message, by category and market. Since 1 October 2026 it has again charged for utility messages sent inside an open window, which had been free since July 2025, and for free-text service replies beyond the first 1,000 a month on each business number, which had been free since November 2024.

Stop means stop

The policy leaves no room here: “You must respect all requests (either on or off WhatsApp) by a person to block, discontinue, or otherwise opt out of communications from you via WhatsApp, including removing that person from your contacts list.” It also asks you to “Provide clear instructions for how people can opt out of receiving specific categories of messages or calls, and honor these requests.”

Patients won’t always type the keyword. Treat any clear request as a stop: “STOP”, “बंद करो” (stop it), “मैसेज मत भेजो” (don’t send messages), “अब नहीं चाहिए” (I don’t want these any more), or a request at the counter or on the phone.

Meta enforces this from its side as well. Users “can block or report businesses”, and Meta’s systems “may limit the amount of messages a business can send” based on that feedback. For marketing, WhatsApp gives users a setting, Offers and announcements, “to stop or resume delivery of marketing messages from your business entirely”. From 13 May 2027 the DPDP Act adds that withdrawing consent must be about as easy as giving it, and that you must stop processing within a reasonable time (sections 6(4) and 6(6)).

What you can’t send: medicines and medical products

This is the part of the policy that matters most for hospitals. Section 4 says: “We prohibit use of WhatsApp for Business for buying, selling, promoting, or otherwise facilitating the exchange of certain regulated or restricted goods and services listed below”. The list includes “Drugs, whether prescription, recreational, or otherwise” and “Medical and healthcare products”. And: “These prohibitions apply irrespective of the global or local licenses, registrations, or other approvals your business may hold.” Your drug licence doesn’t change the answer.

There is one narrow exception. India is on Meta’s list of countries where messages promoting over-the-counter drugs are allowed on the Business Platform, if they follow local law and licences and are never sent to anyone under 18. Even then, the policy prohibits “messaging about any Regulated Verticals on the WhatsApp Business App” and “providing any commerce experiences to buy or sell goods or services that are Regulated Verticals”.

Meta’s Commerce Policies, which apply to WhatsApp catalogues, go further:

• “Commerce content may not promote the buying, selling or trading of drugs, drug paraphernalia or prescription products.” The detail page lists “Over-the-counter drugs or medication” as not allowed.
• “Commerce content may not promote the buying, selling or trading of medical and healthcare products and services, including medical devices or ingestible supplements.” Its detail page also lists “Contact lenses and reading and prescription glasses” as not allowed, which matters if you run an optical counter.

None of this keeps hospitals off WhatsApp. Meta’s enforcement page says: “Businesses may not transact in the sale of illegal, prescription, or recreational drugs. Manufacturers and healthcare services who do not engage in direct sale are allowed.” In practice:

• Keep the prescription message plain: “Your prescription from today’s visit is attached.” No prices, no offers and no “order now” button.
• No refill reminders or medicine offers. Take pharmacy orders at the counter, by phone or through the pharmacy’s own channels.
• No catalogue of consultations, check-up packages or spectacles for sale.
• Never ask a patient to type an Aadhaar or card number into the chat. The policy says: “Don’t share or ask people to share full length individual payment card numbers, financial account numbers, personal ID card numbers, or other sensitive identifiers.”

The policy also says: “Don’t use WhatsApp for telemedicine or to send or request any health related information, if applicable regulations prohibit distribution of such information to systems that do not meet heightened requirements to handle health related information.” Ask your lawyer how that applies to video consultations and to what you send, and send no more health detail than the patient needs.

A WhatsApp checklist for your front desk

• Opt-in: asked at the counter, on the call or on the booking page, naming your hospital, and logged.
• Templates: written as plain utility messages, one job each. A separate opt-in if you ever send marketing.
• Stop: any clear request honoured the same day, including in Hindi, and recorded.
• Profile: your hospital’s name, address and a support contact on the WhatsApp Business profile.
• People: a named person who sees escalations, and an emergency reply that gives 108 and 112.
• Never on WhatsApp: medicine orders, refill offers, catalogues of health products or services, Aadhaar or card numbers.
• Access: only named staff can read patient chats, and patient details stay out of personal phone groups.
• Notice: your privacy notice says you use WhatsApp, for what, and how to stop. Our DPDP guide covers what the notice must contain.

Where DrMate fits

DrMate’s front desk sends WhatsApp messages only to patients who said a clear yes, on the call, at the counter or on the booking page, and honours stop. It sends the booking confirmation, a reminder from 6 pm the evening before, a “you’re next” message, notices when a time changes or the doctor is running late, the doctor-approved prescription PDF, and a follow-up reminder 2 days before the date the doctor wrote. It never sends medicines, promotions or orders on WhatsApp.