Photo: NIAID, CC BY 2.0, via Wikimedia Commons.
A patient writes a mobile number on your registration form so you can reach them about their appointment. Six months later, your front desk sends that number a WhatsApp message saying a cleaning is due. Most clinics treat those as the same permission. Under the rules that now apply to WhatsApp, and the ones that apply to all clinics from May 2027, they are not.
This article covers what you have to show the patient, what you have to record, and what has to happen when they say stop. It is a plain-language reading of the primary texts, not legal advice.
Meta's rule applies today. The WhatsApp Business Messaging Policy, last updated 23 September 2026, says a business may contact someone on WhatsApp only if the person has given their number and the business has received opt-in permission confirming they want to receive messages. The policy adds that the business alone is responsible for how that opt-in is collected and for meeting the law that applies to it. In India, that law is the DPDP Act.
The DPDP consent rules apply from 13 May 2027. The DPDP Rules 2025 were notified on 13 November 2025, and Rule 1(4) brings the notice rule, Rule 3, into force eighteen months later. The consent sections of the Act itself follow the same staggered timetable, as the Internet Freedom Foundation's summary of the notification sets out.
The practical point: Meta already requires an opt-in, so you need to collect one now. If you build it to the DPDP standard today, you change your form once instead of twice.
Your clinic is the The DPDP Act's term for whoever decides why and how personal data is used. In a clinic that is the practice itself, not the software it uses., and the DPDP Act sets a high bar for consent. Section 6(1) says consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data needed for the stated purpose.
Three common set-ups fail that test:
Rule 3 of the DPDP Rules sets the minimum content of the notice that goes with a consent request. Here is each element next to what it looks like for WhatsApp recall.
| Rule 3 asks for | For WhatsApp recall, that means |
|---|---|
| A notice that makes sense on its own, not buried in other information | A separate block or slip, not a sentence inside the treatment consent |
| An itemised description of the personal data | Name, mobile number, date of last visit, and which treatment is due |
| The specified purpose and what it enables | WhatsApp messages telling you when a check-up, cleaning or follow-up is due |
| How to withdraw consent, as easily as it was given | Reply STOP on WhatsApp, or tell the front desk |
| How to exercise your rights under the Act | Who to ask to see, correct or delete your details, with a phone number or email |
| How to complain to the Data Protection Board | A line saying you can complain to the Board, and a link to where that is done |
Two more requirements come from the Act. Section 5(3) says the patient must be able to read the notice in English or any One of the languages listed in the Eighth Schedule to the Constitution of India, such as Hindi, Marathi, Tamil or Bengali.. Section 6(3) says the request must name a person the patient can contact about their rights. For most clinics, that means the notice in English plus the language your patients actually read, and the name of whoever handles these requests.
Meta's policy gives the same advice from the other direction. Its best practices for opt-in recommend a separate opt-in for each category of message, and a separate one again before a business calls someone. Put together with Section 6(1), that points to one tick box for each thing you plan to send:
All boxes start unticked, and a patient who ticks only the first is still a patient. Treatment cannot depend on ticking the others, because consent under Section 6(1) has to be unconditional. Recall reminders usually go out as a A message you write in advance and submit to Meta for approval. Only an approved template can start a conversation with a patient who has not messaged you recently., which is exactly the kind of message that needs its opt-in to exist first.
Section 6(10) of the Act puts the burden of proof on you. If a question about consent comes up in a proceeding, the clinic has to prove it gave the notice and got the consent. A tick on a sheet of paper nobody can find does not do that. For each patient, keep:
Section 6(4) gives the patient the right to withdraw consent at any time, with withdrawal as easy as giving it was. If they opted in with one tick at the desk, withdrawal cannot mean writing a letter. A reply of STOP on WhatsApp has to work.
After a withdrawal, Section 6(6) says the clinic must stop within a reasonable time, and make sure anyone processing the data for you stops too. Meta's policy is broader: you must honour a request to stop messages whether it is made on WhatsApp or off it. A patient who tells the receptionist "please don't message me" has opted out, even if nobody typed anything.
Withdrawal is not retroactive. Section 6(5) says messages sent while consent was in place stay lawful. It also covers only the purpose withdrawn: a patient can stop recall reminders and still get confirmations for appointments they book.
Section 5(2) covers people who gave consent before the Act's consent provisions started. You must give them a notice as soon as reasonably practicable, and you may keep using their data until they withdraw. That protection only helps where consent actually exists. A number in a 2019 register, with no record of what the patient agreed to, is not consent under the Act and is not an opt-in under Meta's policy.
The low-risk way to fix an old list is at the desk. When each patient next visits, hand them the new notice with the three boxes. Patients who have not visited in a long time are the ones recall exists to reach, and they are also the ones least likely to have a record, so that list is the one to be most careful with.
No. Meta's WhatsApp Business Messaging Policy requires opt-in permission as well as the number, and DPDP Act Section 6(1) requires consent that is specific to the purpose and given by a clear affirmative action. A separate, unticked box for recall reminders meets both.
Rule 3 of the DPDP Rules 2025, which sets out what the consent notice must contain, comes into force on 13 May 2027, eighteen months after the Rules were notified on 13 November 2025. Meta's opt-in requirement for WhatsApp already applies today.
Stop sending that kind of message within a reasonable time, record the date of the withdrawal, and remove the patient from future sends of that category. DPDP Act Section 6(4) requires withdrawal to be as easy as giving consent, and Meta's policy requires businesses to honour opt-out requests made on or off WhatsApp.
To be straight about it: Dentomate does not yet store a per-patient WhatsApp consent record, and it does not automatically leave out patients who replied STOP. You pick campaign recipients yourself, so leaving out anyone who has opted out is up to you. The app's terms of service ask each clinic to get explicit patient consent before sending WhatsApp messages, which is also where the DPDP Act puts the duty.
What Dentomate does give you is patient records and recall segments in one place, instead of a register and a receptionist's phone. Recall campaigns are not on the free plan. Starter at ₹399 a month includes 2 campaigns every 30 days, and Pro at ₹799 a month has no campaign limit. Full details are on the pricing page.
Patient records and recall segments in one place, not spread across a register and a receptionist's phone. Free forever, no card required.
.jpg){kind=link}