Updated 2026-07-25 · 2 min read
Almost every dental practice uses WhatsApp with its patients, because it's what people use. The problem isn't the channel: it's that information ends up travelling down that channel that shouldn't.
This article offers general guidance for thinking the subject through. It isn't legal advice: for your specific case and your country, talk to a professional.
The distinction that sorts everything out
There's calendar information — who somebody is, their phone number, what appointment they have and when — and there's clinical information: what's wrong, what medication they take, their history, X-rays.
The first needs ordinary care. The second belongs to a specially protected category and its place is the clinical record, inside the practice's management software. Not a chat.
What's best avoided over messaging
Commenting in writing on a patient's condition or treatment, even to reassure them.
Asking for history, allergies or medication over chat. If the patient sends them unprompted, the sensible thing is to thank them and say it'll be dealt with at the appointment — not to turn it into a record.
Sending detailed treatment plans or X-rays by message.
WhatsApp groups with patients, where everybody can see everybody else's phone number.
Good habits that cost little
Give every member of the team their own login, with permissions matching their role, instead of a shared phone with no control.
Be clear about who can see what, and keep a record of the important actions.
Store only what's needed to manage the appointment. The less you keep, the less there is to protect.
Respect immediately anybody who asks not to receive marketing messages, keeping those separate from reminders about their own appointments.
What to ask a supplier
Where the data is hosted, under what processing agreement, whether you can export it whenever you want, and whether the system stores clinical information anywhere.
In ClaudIA that last answer is no: there are no fields for allergies, medication or history, and a photo a patient sends is never assessed or commented on.