Healthcare marketing Q&A · ICG Editorial

Do clinics need patient consent for WhatsApp marketing under the DPDP Act?

Yes. Under the Digital Personal Data Protection Act 2023, a clinic needs clear, specific consent before it sends marketing messages on WhatsApp, and it must give a notice explaining how the data will be used. Appointment reminders linked to a service the patient asked for sit differently from promotion. As of October 2026, collect a separate marketing opt-in, record it and honour opt-outs. Confirm details with counsel.

What does the DPDP Act require before a clinic sends WhatsApp marketing?

The Digital Personal Data Protection Act 2023 expects consent that is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. Before collecting it, the clinic must give a notice explaining what data it holds and why. The patient must be able to withdraw consent as easily as they gave it.

The Act and the DPDP Rules notified in November 2025 are published by the Ministry of Electronics and Information Technology. The Rules bring most obligations into force in phases, with the main consent duties scheduled to apply from 2027. As of October 2026, check the exact commencement dates with your counsel, but build your consent process now. Retrofitting consent onto an old list is far harder than collecting it properly at the start.

Health data adds weight. A WhatsApp message about a fertility consult or a skin condition reveals something sensitive about the person who receives it. That is why clinics should treat marketing consent as its own, separate permission.

It also helps to decide who in the clinic owns consent. Usually that is the practice manager, working with whoever runs the WhatsApp account. One owner keeps the records consistent and answers patient requests to stop.

Reminders versus marketing: which messages need what?

Not every WhatsApp message is marketing. An appointment confirmation the patient asked for is part of the service they requested. A message about a new laser offer or a health camp is marketing. The Act allows some processing for the purpose a person voluntarily shared data for, but promotion usually needs separate, explicit consent.

Message type	Example	Consent position (general guide)
Transactional	Appointment confirmation, report ready	Linked to the service the patient asked for; give notice
Care follow-up	Post-procedure check-in from the treating team	Usually linked to the service; keep it clinical
Recall reminder	Six-monthly dental check-up	Safer with explicit opt-in at registration
Educational broadcast	Monsoon infection tips from the doctor	Needs opt-in for marketing or updates
Promotional	New service launch, health package	Needs explicit marketing consent

WhatsApp's own business policies also require that people opt in before businesses message them. Treat that as a separate, platform-level requirement on top of the law.

How to do marketing with WhatsApp, step by step

Collect consent at the point of contact, store it with a timestamp, message only the people who said yes, and make "stop" work instantly. Then send useful content, not constant promotion. Clinics that follow this order keep their WhatsApp number healthy and their lists responsive.

Consent capture. Add an unticked checkbox on web forms and the registration desk form: "Send me health updates and clinic news on WhatsApp." Keep it separate from consent to treatment.
Record it. Store who consented, when, through which form and to what. Your CRM should hold this field.
Segment. Split lists by interest, such as dental recall, diabetes education or new parents.
Use approved templates. The WhatsApp Business Platform needs pre-approved templates for outbound messages.
Honour opt-outs. Remove anyone who replies "stop" from every list, the same day.

ICG's WhatsApp marketing service for healthcare sets this up end to end, from form fields to template approval.

How can WhatsApp be used in the healthcare industry?

WhatsApp works for appointment booking, reminders, report delivery, post-care check-ins, patient education and enquiry follow-up. For marketing teams, its biggest value is speed. A lead that gets a WhatsApp reply within minutes is more likely to book than one left waiting for a call the next day.

For a fuller list of uses by specialty, see WhatsApp use cases in healthcare. If you run broadcasts at scale, read our answer on sending bulk WhatsApp messages from a clinic.

Can we do marketing on WhatsApp under NMC rules too?

Yes, if the content follows the NMC's 6 October 2026 advertising guidelines as well as the DPDP Act. Messages that carry testimonials, before-and-after images, discounts or "best clinic" claims are a problem whatever the consent status. Consent covers the right to message someone, not what you say.

A good test: would the message be acceptable as a post on the clinic's website? If not, it should not go out on WhatsApp. ICG's NMC compliance audit can review your templates alongside your site. This page is general information, not legal advice; confirm your setup with counsel.

Detailed answers

Usually not. Sharing a number to book an appointment links the data to that purpose. The DPDP Act expects consent for marketing to be specific and given by a clear affirmative action, such as ticking an unticked box. Ask separately for marketing or health-update messages, and keep a record of when and how the patient said yes.

Reminders for an appointment the patient booked are tied to the service they requested, so they sit differently from marketing. Still, give a clear notice at booking that reminders will come on WhatsApp, and let the patient choose another channel. Keep reminders purely operational, with no promotional content added.

Store the patient name, number, the exact consent wording, the date and time, the source form or desk, and the categories agreed to. Keep it in your CRM or practice software, not a spreadsheet on one laptop. When a patient withdraws, record that too and remove them from all marketing lists.

Once the relevant duties apply, the DPDP Act lets the Data Protection Board impose financial penalties for breaches, and WhatsApp can restrict or ban numbers that receive many blocks and reports. For clinics, the bigger loss is often the number itself, since patients use it to book. Consent-led lists protect both.

The Act applies to any person or organisation processing digital personal data, with limited exemptions set by the government. Size alone does not exempt a clinic. A small clinic can comply simply: a tick box on the form, a short notice, a consent column in its records and a prompt opt-out process.

Ready to move?

Book a free 30-minute Brand & Growth Diagnostic.

It's a working session, not a sales pitch — you leave with a written root-cause analysis you can act on, whether or not you engage ICG.

Book free diagnostic → See ICG's WhatsApp marketing service for healthcare → WhatsApp ICG →