DPDP consent for WhatsApp marketing in healthcare

Two regulators, one WhatsApp broadcast

Every clinic marketing message on WhatsApp has to survive two independent tests:

• The DPDP Act 2023 — governs the processing of personal data (the patient's phone number, name, message history). Requires valid consent for marketing, a clear purpose, an easy opt-out.
• The NMC Code of Ethics, Section 6 — governs professional conduct of registered medical practitioners. Restricts solicited testimonials, promises of cure, comparative superiority claims.

A message can be perfectly DPDP-compliant (correctly consented, easy opt-out) and still breach NMC. Or perfectly NMC-neutral (no cure claims) and still breach DPDP (sent to a non-consented list). Both tests apply to every broadcast.

The DPDP consent standard for WhatsApp marketing

1. Free, specific, informed, unambiguous

Consent must be voluntary (not conditional on receiving care), specific to the purpose (WhatsApp marketing from this clinic), informed (patient knows what they are opting into), and unambiguous (an affirmative action, not silence or a pre-ticked box).

2. Purpose disclosure at the point of consent

The patient has to know what they are consenting to. A generic "we may contact you" line does not survive DPDP. A specific line — "we may send you monthly health tips, service announcements and offers on WhatsApp" — does.

3. Separate consent lines for separate purposes

Service messages (appointment reminders) and marketing messages (offers) are different purposes. Best practice is two separate tick-boxes on the intake form, each with its own purpose disclosure, each independently opt-in or opt-out.

4. Record retention that can survive audit

The consent record — when the patient consented, on which form, for which purpose, in which channel — needs to be producible on request. A signed physical intake form archived digitally, or a digital form with timestamped submission log, both work. Verbal consent captured on a call without recording is not producible.

5. One-click opt-out

Every marketing WhatsApp template must include an opt-out instruction. "Reply STOP to opt out" is the standard. The opt-out must be honoured immediately — not "we will unsubscribe within 7 days", not "please call reception to unsubscribe".

The NMC Section 6 overlay

Even with valid DPDP consent, marketing WhatsApp templates from a registered medical practitioner cannot:

• Solicit or publish patient testimonials
• Claim superiority over other practitioners or clinics
• Promise cure, guarantee outcome or use comparative language
• Use before-after imagery of patients
• Promote drugs listed in Schedule H, H1, X directly
• Advertise scheduled surgeries with promotional language ("best price", "special offer")

Combined, DPDP and NMC narrow the acceptable marketing template to service announcements, general health education, festival greetings, and consented invitations to camps or events.

Utility templates — the "provision of service" lawful basis

Utility messages tied to an active service relationship (appointment confirmations, reminders, prescription-ready alerts, invoice notifications, test-result-available alerts) generally pass under the "provision of service" lawful basis in DPDP. They do not require the same explicit marketing consent, because they are part of delivering care the patient already asked for.

The line matters: an appointment reminder is utility. An appointment reminder that adds "and check out our new laser hair removal offer" is marketing, needs marketing consent, and (if sent as a utility template) will get reclassified by Meta.

Building the consent intake — what actually works

Physical intake form

Add a separate section titled "WhatsApp communication preferences" with two independently tickable options:

1. "I agree to receive service messages from this clinic on WhatsApp (appointment reminders, prescription and report notifications, invoice confirmations). Not required to receive care."
2. "I additionally agree to receive marketing messages (offers, camps, festival greetings, service launches). I can opt out at any time by replying STOP."

Patient ticks either, both, or neither. The clinic records the state in the CMS as two independent flags.

Digital intake form (website / lead form)

Same two options. Both un-ticked by default. Submission logged with timestamp.

WhatsApp double opt-in for online-only leads

Where the first touch is a WhatsApp enquiry (Google click-to-WhatsApp, GMB WhatsApp button), send a one-time consent-capture template early: "To keep you updated on services, offers and camps, may we send you WhatsApp messages? Reply YES to opt in or IGNORE to stay on service messages only."

What happens on a Data Principal Rights request

Under DPDP a patient can ask the clinic — as the Data Fiduciary — for:

• A summary of their personal data being processed
• Correction or updating of that data
• Erasure where processing is no longer necessary
• Grievance redressal within a defined window

The clinic needs a named Data Protection Officer (or equivalent) and a way to respond within the statutory window. WhatsApp records fall within the scope of these requests.

Retention and purging — the DPDP purpose-limitation principle

Personal data can be retained only as long as necessary for the stated purpose. For WhatsApp marketing:

• Active marketing relationship — retain and use
• Lapsed relationship (no marketing engagement for 24+ months) — review and either re-consent or archive
• Explicit opt-out — cease marketing use immediately; retain the opt-out record itself
• Do-not-contact request — respect forever, across channels

The compliance vetting gate on PatientPulse Scale

Every marketing template on PatientPulse Scale (₹1,49,999/mo) goes through a formal compliance sign-off before it ships:

1. Template body vetted against NMC Section 6 (no cure, no comparison, no testimonial)
2. Recipient list verified against marketing opt-in flag in CMS
3. Purpose disclosure matched to consent capture wording
4. Opt-out language present and functional
5. Documentation logged for audit trail

Growth (₹49,999/mo) includes a monthly compliance audit; Scale gates every send.

What a DPDP notice from the DPB might look like

The Data Protection Board of India has enforcement powers under DPDP. Notices typically ask for:

• Copy of the consent capture form
• Consent record for the specific complainant
• Purpose disclosure text shown at the time of consent
• Opt-out log for the complainant
• Data flow diagram (where the phone number is stored, who has access, how long it is retained)

A clinic that has never documented these has 30 days to construct them under pressure. A clinic on PatientPulse Scale has the documentation as a byproduct of routine operations.

Related reads

• Utility template approval for medical use
• Patient recall automation on WhatsApp
• WhatsApp Business API setup guide