Tools & Checklists · Free template

WhatsApp consent flow for hospitals

A step-by-step WhatsApp flow and message wording that separate service consent from marketing consent, record both, and make withdrawal easy, in line with India’s DPDP Act.

Seven steps
Copy-ready messages
Not legal advice

Flow

The seven steps

Step	What happens	What to record
1. Entry	Patient taps a WhatsApp button on the website, an ad or the Google listing, or messages the number directly	Entry point and source
2. Acknowledgement	Automatic reply: who you are, staffed hours, and a short privacy line with a link to the full notice	Time of first message
3. Service consent	Patient is asked to agree to messages about this enquiry and appointment	Consent to service messages, time, wording version
4. Conversation	An agent or bot helps with the enquiry and booking; anything clinical goes to a qualified person	Enquiry details in the CRM
5. Reminders	Confirmation and reminder templates for the booked appointment	Messages sent
6. Marketing choice	Separately, and only once, the patient is offered updates on health camps and services, with no pre-selection	Marketing consent yes or no, time, wording version
7. Withdrawal	Any message such as STOP ends marketing, and patients are told how to stop all messages	Withdrawal time; suppression across systems

Messages

Starter wording

Acknowledgement

Thank you for contacting [Hospital name]. Our team replies between [hours]. We use the details you share only to help with this enquiry and your appointment. Our privacy notice: [link].

Service consent

To help with your enquiry and send appointment confirmations and reminders on WhatsApp, we need your agreement. Reply YES to continue. You can stop these messages any time by replying STOP.

Marketing choice (separate, once)

Would you also like occasional updates from [Hospital name] about health camps and services? Reply UPDATES to opt in. This is optional and does not affect your care.

Withdrawal confirmation

You will no longer receive [marketing / all] messages from [Hospital name] on WhatsApp. To change this, contact [privacy contact].

Replace the bracketed text and have legal counsel review the final wording. Outbound messages outside an open conversation must use templates approved by WhatsApp.

Principles

What makes it work

Ask for consent in context, at the moment it is needed.
Keep service messages and marketing as separate choices.
Record the wording version and time of every consent.
Make withdrawal as easy as agreeing, and honour it in every system.
Never let a bot give clinical advice.

Background in the WhatsApp Business API for hospitals and DPDP consent and hospital marketing. For forms, use the DPDP consent notice template.

FAQ

Questions people ask

Do hospitals need consent to message patients on WhatsApp?

Yes. WhatsApp’s business policy requires permission, and the DPDP Act requires purpose-specific consent that can be withdrawn.

Should appointment reminders and marketing share one consent?

No. Keep them separate so patients can accept reminders without agreeing to marketing.

What should be recorded?

The consent given, its purpose, the time, the wording version and the entry point.

How should withdrawal work?

A simple reply such as STOP should end marketing immediately, with clear instructions to stop all messages.

Can a WhatsApp bot collect consent?

Yes, if the wording is clear and the response is recorded against the patient record.

Is this template legal advice?

No. Have legal counsel review the final flow and wording.