Is WhatsApp free for clinics?

The WhatsApp Business app is free to download. On the WhatsApp Business Platform, Meta charges per delivered template message. Since October 1, 2026, Meta also charges per message for replies to a patient (service messages) and for utility templates such as appointment reminders, with the first 1,000 service messages per number each month free. Before that date, replies inside the 24-hour window were free. Marketing and authentication templates are charged. Your software provider may add its own fee.

Can a clinic use an AI chatbot on WhatsApp?

Meta's terms prohibit AI providers from using the Business Platform when a general-purpose AI assistant is the primary thing being offered. A Meta spokesperson told TechCrunch the platform's purpose is to help businesses provide customer support, and Meta confirmed to TechCrunch that the change does not affect businesses using AI to serve their customers. The AI must still offer a clear path to a human.

Can a clinic send appointment reminders on WhatsApp?

Yes, with the patient's opt-in. Outside the 24-hour customer service window you must use a pre-approved template. A reminder with no promotional content is normally a utility template; adding a promotion turns it into a marketing template, which Meta always charges for.

Home · Guide

WhatsApp Business API pricing, HIPAA and the rules for clinics

Q: Is WhatsApp HIPAA compliant?

No, according to Meta. Meta's terms for the WhatsApp Business Platform state that Meta is not a Business Associate under HIPAA and that the platform is not HIPAA compliant. US covered entities should check with their compliance officer or lawyer before sending any protected health information over WhatsApp.

Q: Can doctors use WhatsApp with patients?

It depends on the country and on what is said. In the US, Meta's terms say Meta is not a HIPAA business associate and the WhatsApp Business Platform is not HIPAA compliant, and the pandemic-era HHS telehealth flexibility ended in 2023. In the UK, the ICO reprimanded NHS Lanarkshire in 2023 after staff shared patient data in a WhatsApp group the organisation had not approved. This is not legal advice: check with your regulator, medical council or lawyer.

Published September 24, 2026 · Last reviewed October 16, 2026
By the ClinicConvo team

On the WhatsApp Business API (Meta's WhatsApp Business Platform, also called the Cloud API), Meta charges per delivered message, and since October 1, 2026 that includes replies to patients: each phone number gets 1,000 free service messages a month, then every reply is charged at the rate for the patient's country. The rules that matter most for clinics are privacy law (Meta states the platform is not HIPAA compliant), Meta's ban on sending or requesting health information where regulations forbid it, and the requirement to offer patients a clear path to a human.

Comparing the platforms that sit on top of the API? See our comparison of WhatsApp chatbots for clinics, which lists what each vendor charges on top of Meta's fees.

This guide covers the two WhatsApp products, what Meta charges, what Meta allows for AI chatbots, the healthcare limits, privacy law in the US, EU and UK, where patients actually use WhatsApp, and example appointment messages. Every rule and number links to its source. This is general information, not legal advice: check with your regulator or lawyer before you change how you handle patient data.

Business app or Business Platform: which one does a clinic need?

Meta offers two products for businesses. The WhatsApp Business app is, in WhatsApp's words, "a free-to-download app" that "was built with the small business owner in mind" (WhatsApp Help Center). It includes automatic greeting and away messages. The WhatsApp Business Platform is the programmable version, usually reached through a software provider, and it is where automated systems, CRMs and AI assistants connect.

You do not always have to choose one. Meta's documentation on onboarding Business app users (often called "coexistence") lets a business keep its existing number and app while also connecting to the Cloud API, with message history kept in sync. Meta lists limits: group chats, broadcast lists and disappearing messages, among others, are not supported on the Cloud API side, and after onboarding the app's broadcast lists become read-only and disappearing messages are turned off.

	WhatsApp Business app	WhatsApp Business Platform (Cloud API)
Best for	A small team answering by hand	Clinics that want automation, a CRM, reminders or an AI assistant
Cost from Meta	Free to download	Per delivered message; 1,000 free replies per number each month (see below)
Automation	Greeting and away messages	Anything your software provider builds, within Meta's policies
Messages you start	Sent by hand	Must use a Meta-approved template outside the 24-hour window
Keep your number	Yes	Yes, including alongside the app (coexistence)

If your clinic gets a handful of messages a day and someone is always free to answer, the free app with an away message may be all you need.

How much does WhatsApp cost a clinic?

Meta charges per delivered message, "by category–market, and only for messages from businesses to users", and "does not charge for messages from users to businesses" (Meta, pricing, page updated September 30, 2026, read October 16, 2026). Templates are pre-approved messages you use to start or restart a conversation. Since October 1, 2026, Meta "resumed charging, on a per-message basis" for service messages (ordinary replies, whether written by a person or a third-party AI), which had been free since November 2024, and utility templates sent inside the 24-hour window are charged too (Meta, pricing; pricing update). Meta gives "every business phone number" a free tier of 1,000 service messages a month and charges from the 1,001st; unused free messages do not roll over. Businesses and providers with no payment method on file get the free tier delivered, then nothing more.

Category	Clinic example	Until September 30, 2026	Since October 1, 2026
Service (non-template reply)	Replying to a patient's question	Free	First 1,000 a month per number free, then charged per message
Utility	Appointment reminder, confirmation	Free inside the 24-hour customer service window, charged outside it	Charged per message
Authentication	One-time login code for a patient portal	Charged	Charged
Marketing	Promotion, check-up campaign	Charged	Charged

Three details matter in practice:

The 24-hour window. When a patient messages you, a 24-hour customer service window opens. Inside it you can reply with ordinary messages, without templates. Outside it, you can only send templates.
Free entry points. If a patient reaches you through a Click to WhatsApp ad or a Facebook Page call-to-action button, a free entry point window opens. Meta says it "may remain open for up to 7 days" and that while it is open, "Meta does not charge for marketing, utility, authentication or service messages" (Meta, pricing).
Rates vary by country. Meta prices each template by its category and the country calling code of the patient's number. Lower rates for utility and authentication messages unlock at higher volumes; Meta says service messages have no volume tiers.

Sample list rates in US dollars per delivered message, effective October 1, 2026, from Meta's USD rate card linked on its pricing page:

Patient's country	Service (reply)	Utility (reminder)	Marketing
United States and Canada	US$ 0.0034	US$ 0.0034	US$ 0.025
United Kingdom	US$ 0.022	US$ 0.022	US$ 0.0635
Germany	US$ 0.055	US$ 0.055	US$ 0.1365
Mexico	US$ 0.0085	US$ 0.0085	US$ 0.0397
India	US$ 0.0014	US$ 0.0014	US$ 0.0118

So a US clinic that sends 3,000 replies in a month pays Meta nothing for the first 1,000 and about US$ 6.80 for the other 2,000. A UK clinic pays about US$ 44 for the same 2,000. Your software provider's fees come on top.

Meta also has rules on which category a template belongs in. Its template guidelines say a utility template must be non-promotional and either specific to or requested by the user, or essential or critical to them, and that templates mixing utility and marketing content are considered marketing. A reminder that ends with "Book your teeth whitening at 20% off" is a marketing message.

Meta's fees are only part of the bill. If you reach the Business Platform through a software provider, it charges its own subscription or per-message fee on top. Ask for both numbers.

Are AI chatbots allowed on WhatsApp?

Yes, for a business answering its own customers, with one important limit. Section 4.7 of the Meta Terms for WhatsApp Business Platform (read September 24, 2026) says "AI Providers", including providers of large language models and "general-purpose artificial intelligence assistants", are "strictly prohibited" from using the platform when that technology is "the primary (rather than incidental or ancillary) functionality" being offered. Meta decides who counts "in its sole discretion."

This rule was aimed at companies offering general chat assistants over WhatsApp. When the change was announced, a Meta spokesperson told TechCrunch that "the purpose of the WhatsApp Business API is to help businesses provide customer support and send relevant updates," and Meta confirmed to TechCrunch that the change doesn't affect businesses using AI to serve their customers. Meta's own pricing documentation also describes service messages as ones that can be powered by a person or by a third-party AI solution. The terms also say the restricted technologies may be made available to businesses in certain countries. The EU, Italy and Brazil opened antitrust investigations into the rule, and Brazil's competition authority ordered Meta to suspend it, as TechCrunch reported in January 2026.

For a clinic, the practical reading: an assistant that answers questions about your clinic, your hours and your services is the customer-support use Meta describes. An open-ended "ask me anything" health chatbot is not a good idea on any count. Whatever you use, the WhatsApp Business Messaging Policy says: "You may use automation when responding during the 24-hour window, but must also have available prompt, clear, and direct escalation paths," such as a transfer to a human, a phone number or email.

What can't a clinic do on WhatsApp?

The WhatsApp Business Messaging Policy (read September 24, 2026) contains three rules clinics should read closely:

Health information. "Don't use WhatsApp for telemedicine or to send or request any health related information, if applicable regulations prohibit distribution of such information to systems that do not meet heightened requirements to handle health related information." Whether this applies to you depends on your country's law, not on Meta.
Medical products. The policy lists "Medical and healthcare products" among categories you may not buy, sell or promote, except for limited cases in its section on regulated verticals.
Opt-in. You need the patient's opt-in permission before you message them.

Separately, Meta's platform terms say you may not give Meta data that the law requires you to safeguard. Keep diagnoses, test results and prescriptions out of WhatsApp unless your lawyer has confirmed it is allowed where you practise.

Is WhatsApp HIPAA compliant? And what about GDPR?

United States (HIPAA). No, according to Meta. Section 4.2 of the platform terms says: "Meta is not a Business Associate or Subcontractor (...) and that the WhatsApp Business Platform is not HIPAA compliant." That matters because, under HHS guidance, a vendor that creates, receives, maintains or transmits protected health information for a covered entity is a business associate and needs a business associate agreement. HHS's summary of the Privacy Rule counts information about the provision of health care to a person as health information, so even "your appointment with Dr. X" can be sensitive. The alternative is a texting vendor that will sign a business associate agreement with you; your compliance officer should make this call.

EU and UK (GDPR). Health data is "special category" data under Article 9 of the GDPR, which you may only process under one of its listed conditions. The UK regulator, the ICO, explains those conditions in its special category data guidance. On the Cloud API, Meta's data privacy documentation says Meta "acts as a data processor/service provider on behalf of the business," keeps messages for a maximum of 30 days, and offers a local storage option in some countries. Your clinic remains the controller, and GDPR Article 28 requires a written contract with each processor, including your software provider.

Other countries. Other privacy laws also give health data extra protection. Medical councils and advertising rules also differ by country. Check with your regulator or lawyer.

Can doctors use WhatsApp with patients?

It depends on the country and on what is said. Confirming an appointment time is not the same as discussing a diagnosis. For the places this guide covers (sources read September 25, 2026):

United States. Section 4.2 of Meta's platform terms says Meta "is not a Business Associate or Subcontractor" under HIPAA and that "the WhatsApp Business Platform is not HIPAA compliant." Under HIPAA, a vendor handling protected health information for you normally needs a business associate agreement (see the section above), so keep that information off WhatsApp unless your compliance officer has approved otherwise. During the COVID-19 public health emergency, HHS said it would not penalize good-faith telehealth over popular video chat apps such as Apple FaceTime and Facebook Messenger video chat (HHS notice). That flexibility expired on May 11, 2023, and its transition period ended on August 9, 2023 (HHS).
United Kingdom. In July 2023 the ICO, the UK data protection regulator, reprimanded NHS Lanarkshire after staff shared patient data, including names and clinical information, in a WhatsApp group between April 2020 and April 2022. WhatsApp had not been approved for patient data and no data protection impact assessment was in place. The ICO found breaches of the UK GDPR and pointed to the lack of a formal approval process and of a risk assessment before WhatsApp was deployed (ICO, reprimand PDF). That case involved staff messaging each other, not patients. Check your organisation's own policy before you use any messaging app with patients.
European Union. The GDPR rules in the section above apply.

This is general information, not legal advice. Check with your regulator, medical council or lawyer.

Where do patients actually use WhatsApp?

It depends heavily on the country, which is the first thing to check before you move patients to WhatsApp:

Country	WhatsApp use	Source
India	50% of adults	Same Pew survey
8 middle-income countries	Median 73% of adults	Same Pew survey (10,235 adults, Feb to May 2023)
United Kingdom	About 90% of online adults	Ofcom Online Nation 2025
United States	32% of adults	Pew, 2025 survey (5,022 adults)

In the US, ordinary text messaging is still the default: the wireless industry group CTIA reports that Americans exchanged nearly 2.2 trillion SMS and MMS messages in 2024. A US clinic that only offers WhatsApp will miss most of its patients. In the UK, the opposite risk applies: most adults already use it.

Timing matters too. A WhatsApp line with nobody watching after closing leaves messages waiting until morning. The Inbox X-Ray shows how many of your own patients write after hours.

When WhatsApp, or an AI on it, is not the right choice

Your patients don't use it. In the US, SMS, phone and your practice's patient portal will reach more people.
You need to discuss clinical details. Use a channel your lawyer has approved for health information, such as a secure patient portal.
You get few messages. The Business app's free away message plus a staff member checking twice a day costs nothing.
You want a person to answer every time. A human medical answering service is a reasonable choice, especially for urgent calls.
You only need reminders. If your practice-management system already sends reminders by SMS or email, that may be enough. A Cochrane review found moderate-quality evidence that text-message reminders increased attendance compared with no reminder (risk ratio 1.14, 95% CI 1.03 to 1.26, seven trials, 5,841 participants). That review covered SMS and MMS, not WhatsApp.

Example appointment messages

These are examples, not approved templates. Meta must approve each template before you use it outside the 24-hour window. Keep them free of diagnoses and of promotions, so they stay in the utility category.

Example 1: request received (reply inside the 24-hour window)

Thanks, {{1}}. We've received your appointment request for {{2}}. Our front desk will confirm the time by {{3}}. If it's urgent, call {{4}}.

Example 2: confirmation (utility template)

Hi {{1}}, your appointment at {{2}} is confirmed for {{3}} at {{4}}. Reply 1 to confirm or 2 if you need to change it.

Example 3: reminder the day before (utility template)

Reminder: you have an appointment at {{1}} tomorrow, {{2}}, at {{3}}. Address: {{4}}. Need to reschedule? Reply to this message.

Notice what the examples leave out: the reason for the visit and the doctor's specialty. Both can reveal health information to anyone who sees the patient's phone.

Checklist before you start

Check whether your patients actually use WhatsApp in your country.
Choose the Business app (manual) or the Business Platform (automation), or both on the same number.
Collect and record opt-in before sending messages.
Write templates without promotions or clinical details.
Get prices from Meta's rate card and from your software provider.
If you use AI, limit it to your clinic's information and make the human handoff obvious.
Ask your lawyer or regulator about health data: HIPAA in the US, GDPR in the EU and UK, local law elsewhere.
Sign a data processing agreement (EU/UK) with every vendor that touches patient messages.

Disclosure: we make ClinicConvo. It answers a clinic's WhatsApp with AI and, by default, hands appointment requests to the front desk to confirm. See ClinicConvo.

Sources

All read September 24, 2026.

Keep reading

Prebuilt WhatsApp agents by specialty · All guides