Is WhatsApp free for clinics?

The WhatsApp Business app is free to download. On the WhatsApp Business Platform, Meta charges per delivered template message. Until September 30, 2026, replies to a patient within 24 hours of their last message are free, and so are utility templates such as appointment reminders sent inside that window. From October 1, 2026, Meta charges per message for those replies and for utility templates sent inside the window too. Marketing and authentication templates are charged. Your software provider may add its own fee.

Can a clinic use an AI chatbot on WhatsApp?

Meta's terms prohibit AI providers from using the Business Platform when a general-purpose AI assistant is the primary thing being offered. A Meta spokesperson told TechCrunch the platform's purpose is to help businesses provide customer support, and Meta confirmed to TechCrunch that the change does not affect businesses using AI to serve their customers. The AI must still offer a clear path to a human.

Can a clinic send appointment reminders on WhatsApp?

Yes, with the patient's opt-in. Outside the 24-hour customer service window you must use a pre-approved template. A reminder with no promotional content is normally a utility template; adding a promotion turns it into a marketing template, which Meta always charges for.

Home · Guide

WhatsApp for clinics: rules, costs and how to use it with patients

Q: Is WhatsApp HIPAA compliant?

No, according to Meta. Meta's terms for the WhatsApp Business Platform state that Meta is not a Business Associate under HIPAA and that the platform is not HIPAA compliant. US covered entities should check with their compliance officer or lawyer before sending any protected health information over WhatsApp.

Published September 24, 2026 · Last reviewed September 24, 2026
By the ClinicConvo team

A clinic can talk to patients on WhatsApp through the free WhatsApp Business app or through Meta's WhatsApp Business Platform (Cloud API), where messages you start are charged per message and replies to a patient who wrote in the last 24 hours are free until September 30, 2026, then charged per message from October 1, 2026. The rules that matter most for clinics are privacy law (Meta states the platform is not HIPAA compliant), Meta's ban on sending or requesting health information where regulations forbid it, and the requirement to offer patients a clear path to a human.

This guide covers the two WhatsApp products, what Meta charges, what Meta allows for AI chatbots, the healthcare limits, privacy law in the US, EU and UK, where patients actually use WhatsApp, and example appointment messages. Every rule and number links to its source. This is general information, not legal advice: check with your regulator or lawyer before you change how you handle patient data.

Business app or Business Platform: which one does a clinic need?

Meta offers two products for businesses. The WhatsApp Business app is, in WhatsApp's words, "a free-to-download app" that "was built with the small business owner in mind" (WhatsApp Help Center). It includes automatic greeting and away messages. The WhatsApp Business Platform is the programmable version, usually reached through a software provider, and it is where automated systems, CRMs and AI assistants connect.

You do not always have to choose one. Meta's documentation on onboarding Business app users (often called "coexistence") lets a business keep its existing number and app while also connecting to the Cloud API, with message history kept in sync. Meta lists limits: group chats, broadcast lists and disappearing messages, among others, are not supported on the Cloud API side, and after onboarding the app's broadcast lists become read-only and disappearing messages are turned off.

	WhatsApp Business app	WhatsApp Business Platform (Cloud API)
Best for	A small team answering by hand	Clinics that want automation, a CRM, reminders or an AI assistant
Cost from Meta	Free to download	Per delivered message; replies free until September 30, 2026 (see below)
Automation	Greeting and away messages	Anything your software provider builds, within Meta's policies
Messages you start	Sent by hand	Must use a Meta-approved template outside the 24-hour window
Keep your number	Yes	Yes, including alongside the app (coexistence)

If your clinic gets a handful of messages a day and someone is always free to answer, the free app with an away message may be all you need.

How much does WhatsApp cost a clinic?

According to Meta's pricing documentation (read September 24, 2026), since July 1, 2025 Meta charges per message, and only when a template message is delivered. Templates are pre-approved messages you use to start or restart a conversation. This changes on October 1, 2026: Meta's pricing update says it will then charge per message for all service messages (ordinary replies, whether written by a person or a third-party AI) and for utility templates sent inside the 24-hour window, with service rates equal to the utility and authentication rates in each market. Meta also says it will stop delivering service messages for businesses and solution providers with no payment method on file by September 30, 2026.

Category	Clinic example	Until September 30, 2026	From October 1, 2026
Service (non-template reply)	Replying to a patient's question	Free	Charged per message
Utility	Appointment reminder, confirmation	Free inside the 24-hour customer service window, charged outside it	Charged per message
Authentication	One-time login code for a patient portal	Charged	Charged
Marketing	Promotion, check-up campaign	Charged	Charged

Three details matter in practice:

The 24-hour window. When a patient messages you, a 24-hour customer service window opens. Inside it you can reply with ordinary messages, without templates. Outside it, you can only send templates.
Free entry points. If a patient reaches you through a Click to WhatsApp ad or a Facebook Page call-to-action button, a 72-hour window opens after your first reply, and Meta says you can send any type of message at no charge while it is open. Meta's pricing update says service messages stay free inside this window after October 1, 2026.
Rates vary by country. Meta prices each template by its category and the country calling code of the patient's number. Lower rates for utility and authentication messages unlock at higher volumes; Meta says service messages will have no volume tiers.

Meta also has rules on which category a template belongs in. Its template guidelines say a utility template must be non-promotional and either specific to or requested by the user, or essential or critical to them, and that templates mixing utility and marketing content are considered marketing. A reminder that ends with "Book your teeth whitening at 20% off" is a marketing message.

Meta's fees are only part of the bill. If you reach the Business Platform through a software provider, it charges its own subscription or per-message fee on top. Ask for both numbers.

Are AI chatbots allowed on WhatsApp?

Yes, for a business answering its own customers, with one important limit. Section 4.7 of the Meta Terms for WhatsApp Business Platform (read September 24, 2026) says "AI Providers", including providers of large language models and "general-purpose artificial intelligence assistants", are "strictly prohibited" from using the platform when that technology is "the primary (rather than incidental or ancillary) functionality" being offered. Meta decides who counts "in its sole discretion."

This rule was aimed at companies offering general chat assistants over WhatsApp. When the change was announced, a Meta spokesperson told TechCrunch that "the purpose of the WhatsApp Business API is to help businesses provide customer support and send relevant updates," and Meta confirmed to TechCrunch that the change doesn't affect businesses using AI to serve their customers. Meta's own pricing documentation also describes service messages as ones that can be powered by a person or by a third-party AI solution. The terms also say the restricted technologies may be made available to businesses in certain countries. The EU, Italy and Brazil opened antitrust investigations into the rule, and Brazil's competition authority ordered Meta to suspend it, as TechCrunch reported in January 2026.

For a clinic, the practical reading: an assistant that answers questions about your clinic, your hours and your services is the customer-support use Meta describes. An open-ended "ask me anything" health chatbot is not a good idea on any count. Whatever you use, the WhatsApp Business Messaging Policy says: "You may use automation when responding during the 24-hour window, but must also have available prompt, clear, and direct escalation paths," such as a transfer to a human, a phone number or email.

What can't a clinic do on WhatsApp?

The WhatsApp Business Messaging Policy (read September 24, 2026) contains three rules clinics should read closely:

Health information. "Don't use WhatsApp for telemedicine or to send or request any health related information, if applicable regulations prohibit distribution of such information to systems that do not meet heightened requirements to handle health related information." Whether this applies to you depends on your country's law, not on Meta.
Medical products. The policy lists "Medical and healthcare products" among categories you may not buy, sell or promote, except for limited cases in its section on regulated verticals.
Opt-in. You need the patient's opt-in permission before you message them.

Separately, Meta's platform terms say you may not give Meta data that the law requires you to safeguard. Keep diagnoses, test results and prescriptions out of WhatsApp unless your lawyer has confirmed it is allowed where you practise.

Is WhatsApp HIPAA compliant? And what about GDPR?

United States (HIPAA). No, according to Meta. Section 4.2 of the platform terms says: "Meta is not a Business Associate or Subcontractor (...) and that the WhatsApp Business Platform is not HIPAA compliant." That matters because, under HHS guidance, a vendor that creates, receives, maintains or transmits protected health information for a covered entity is a business associate and needs a business associate agreement. HHS's summary of the Privacy Rule counts information about the provision of health care to a person as health information, so even "your appointment with Dr. X" can be sensitive. The alternative is a texting vendor that will sign a business associate agreement with you; your compliance officer should make this call.

EU and UK (GDPR). Health data is "special category" data under Article 9 of the GDPR, which you may only process under one of its listed conditions. The UK regulator, the ICO, explains those conditions in its special category data guidance. On the Cloud API, Meta's data privacy documentation says Meta "acts as a data processor/service provider on behalf of the business," keeps messages for a maximum of 30 days, and offers a local storage option in some countries. Your clinic remains the controller, and GDPR Article 28 requires a written contract with each processor, including your software provider.

Other countries. Other privacy laws also give health data extra protection. Brazil's LGPD, for example, classifies health data as sensitive personal data. Medical councils and advertising rules also differ by country. Check with your regulator or lawyer.

Where do patients actually use WhatsApp?

It depends heavily on the country, which is the first thing to check before you move patients to WhatsApp:

Country	WhatsApp use	Source
Brazil	90% of adults	Pew, 2023 survey
India	50% of adults	Same Pew survey
8 middle-income countries	Median 73% of adults	Same Pew survey (10,235 adults, Feb to May 2023)
United Kingdom	About 90% of online adults	Ofcom Online Nation 2025
United States	32% of adults	Pew, 2025 survey (5,022 adults)

In the US, ordinary text messaging is still the default: the wireless industry group CTIA reports that Americans exchanged nearly 2.2 trillion SMS and MMS messages in 2024. A US clinic that only offers WhatsApp will miss most of its patients. In Brazil or the UK, the opposite risk applies: most adults already use it.

Timing matters too. Across our own platform, 32.7% of customer messages arrived outside business hours (88,892 messages to 61 businesses in several industries, mostly in Brazil, July 30 to September 21, 2026). These are not clinic-only numbers, but they show that a WhatsApp line with nobody watching after closing leaves many messages waiting.

When WhatsApp, or an AI on it, is not the right choice

Your patients don't use it. In the US, SMS, phone and your practice's patient portal will reach more people.
You need to discuss clinical details. Use a channel your lawyer has approved for health information, such as a secure patient portal.
You get few messages. The Business app's free away message plus a staff member checking twice a day costs nothing.
You want a person to answer every time. A human medical answering service is a reasonable choice, especially for urgent calls.
You only need reminders. If your practice-management system already sends reminders by SMS or email, that may be enough. A Cochrane review found moderate-quality evidence that text-message reminders increased attendance compared with no reminder (risk ratio 1.14, 95% CI 1.03 to 1.26, seven trials, 5,841 participants). That review covered SMS and MMS, not WhatsApp.

Example appointment messages

These are examples, not approved templates. Meta must approve each template before you use it outside the 24-hour window. Keep them free of diagnoses and of promotions, so they stay in the utility category.

Example 1: request received (reply inside the 24-hour window)

Thanks, {{1}}. We've received your appointment request for {{2}}. Our front desk will confirm the time by {{3}}. If it's urgent, call {{4}}.

Example 2: confirmation (utility template)

Hi {{1}}, your appointment at {{2}} is confirmed for {{3}} at {{4}}. Reply 1 to confirm or 2 if you need to change it.

Example 3: reminder the day before (utility template)

Reminder: you have an appointment at {{1}} tomorrow, {{2}}, at {{3}}. Address: {{4}}. Need to reschedule? Reply to this message.

Notice what the examples leave out: the reason for the visit and the doctor's specialty. Both can reveal health information to anyone who sees the patient's phone.

Checklist before you start

Check whether your patients actually use WhatsApp in your country.
Choose the Business app (manual) or the Business Platform (automation), or both on the same number.
Collect and record opt-in before sending messages.
Write templates without promotions or clinical details.
Get prices from Meta's rate card and from your software provider.
If you use AI, limit it to your clinic's information and make the human handoff obvious.
Ask your lawyer or regulator about health data: HIPAA in the US, GDPR in the EU and UK, local law elsewhere.
Sign a data processing agreement (EU/UK) with every vendor that touches patient messages.

Disclosure: we make ClinicConvo. It answers a clinic's WhatsApp with AI and, by default, hands appointment requests to the front desk to confirm. See ClinicConvo.

Sources

All read September 24, 2026.