WhatsApp Business for UK Dentists: Compliance, Reply Rates, and What to Send

This is not a general "why WhatsApp" article

We already published a shorter guide, WhatsApp for dental practices, on why the channel suits patient replies and why a personal phone is the wrong place for them. This piece is the compliance-first version: Business Platform versus the Business app, the customer care window, what counts as a service message, what counts as marketing, and the controls a clinic needs when staff join and leave.

Read the other guide if you are still deciding whether patients will reply at all. Stay here if you are deciding how to run the channel without creating a data protection mess.

Two products share one name

The WhatsApp Business app is a small-business handset app. It is quick to install and fine for a sole trader selling appointments in a low-risk trade. In a dental practice it fails the tests that matter. The history sits on a device. When that person is on holiday, off sick, or leaves, the conversations are awkward to retrieve and easy to lose. There is a weak audit trail. A second receptionist cannot safely pick up the same thread. Patients end up messaging a human's identity rather than the practice.

The WhatsApp Business Platform, often still called the Business API, is the setup clinics should assume. The practice number connects to software the team shares. Conversations can be assigned. Templates can be approved for messages you start outside a live chat. The thread can be written onto the enquiry in the CRM, next to website, SMS, email, and Facebook leads. That is what "the practice is on WhatsApp" ought to mean.

A green tick or a display name is not the same thing as compliance. Branding helps patients trust they have reached the right organisation. It does not replace a privacy notice, a lawful basis, or an off-switch.

Reply rate is your metric, not a slogan

You will see vendors quote a dramatic read rate for WhatsApp and a weak one for email. Treat those numbers as someone else's marketing, not as a forecast for your diary. What you can say, carefully, is that many patients notice a phone notification sooner than they open a practice email. Whether they reply depends on what you sent, whether they asked to be contacted, and whether the message gave them an easy next step.

Measure two things on your own pipeline. First, how quickly the practice sent the first reply after the enquiry arrived. Second, what share of those patients replied, and what share reached a booked consultation. Split the figures by channel. If WhatsApp is genuinely better for your patients, the pipeline will show it. If it is not, you will have spent a quarter polishing the wrong channel. Either result is useful. A borrowed percentage is not.

The 24-hour window, in plain English

At the time of writing, WhatsApp's customer care window runs for 24 hours from the patient's last message. Inside that window, the practice can reply in a normal conversational way about the thing the patient raised. Outside it, a business-initiated message generally has to use a pre-approved template. The exact product rules move, so check the current WhatsApp policy when you switch a workflow on. The principle is stable enough to design around: you cannot treat WhatsApp like an open email pipe whenever you feel like nudging someone.

Templates fall into broad types. Utility templates cover the task the patient already expects: an appointment reminder, a reply to an enquiry they started, a booking link they asked for. Marketing templates cover promotions and broadcasts, and they need a proper opt-in. Do not dress a promotion up as a utility message because the utility route was easier to get approved. Patients notice, and the platform's review process is there to notice too.

Design follow-up so the important human reply happens while the conversation is still open where possible. If you must message later, use an approved template that matches the reason you are writing, and stop when the patient asks you to stop.

Service messages and marketing are not the same thing

This section is operational guidance for a practice team, not legal advice. Confirm edge cases with your own data protection lead or adviser. The shape, though, is one UK clinics can work with.

If someone has just enquired about a consultation, a reply that helps them book is part of handling that enquiry. You still need a privacy notice that says what you collect and why, and you still need a lawful basis you can explain. You do not need to bolt a newsletter onto that reply.

Marketing is different. Offers, new treatment announcements, and "we have not seen you in a while" broadcasts sent to people who only asked a question are electronic marketing. Under PECR, that kind of message to an individual generally needs consent, recorded properly, with a simple way to refuse. UK GDPR still applies to the personal data underneath, including the right to ask what you hold and to ask you to delete marketing records where the law says you should.

Write down, for each template, which bucket it sits in. If the team cannot tell, do not send it. Store the opt-in on the lead: when it was given, what it covered, and the wording they saw. A screenshot in someone's camera roll is not a record.

What patients expect when a practice messages them

Patients expect the practice, not a glimpse of a staff member's private life. They expect a display name and a tone that match the website they just used. They expect speed, because the app has trained them to expect speed, which is why a slow WhatsApp reply feels ruder than a slow letter ever did. They do not expect a diagnosis in the thread. They expect to be able to say stop and be believed.

They also expect you not to surprise them. If the form said "we will WhatsApp you about this enquiry", a single useful reply is welcome. If you then start a weekly broadcast, you have changed the deal. Say what you will send, send that, and keep clinical detail out of it.

What to send

• An acknowledgement of the enquiry, with the treatment interest they mentioned and a human next step.
• A booking link, plus one plain question that moves a consultation forward, such as preferred days.
• Appointment reminders, how to rearrange, and what to bring, once the visit exists.
• A short chase if they went quiet after asking for information, inside the rules above.
• Directions and practical reassurance. Finance can be "the team will talk this through at the consultation" unless you are repeating a figure the practice has published and approved.

Keep the wording boring and specific. The best service message is one a receptionist would be happy to read aloud at the desk.

What not to send

• Clinical opinions, suitability claims, or a running commentary on someone's medical history. That belongs in the practice management system, discussed in the surgery.
• Photographs of other patients, before-and-after galleries dumped into a chat, or anything that identifies another person.
• A broadcast to your whole patient list because you happen to hold mobile numbers for recalls. A recall list is not a marketing opt-in.
• Messages from a staff member's personal account, even "just this once" when the platform is down. Once is how shadow records start.
• Anything you would not want forwarded to a complaint, a colleague, or the person whose data it is.

If a conversation turns clinical, move it. Tell the patient you will continue with the right person, by phone or in the practice, and stop adding detail to the thread.

Clinic controls that matter more than the badge

Give every thread an owner. Put the inbox where the whole reception team can work it, not on a single login nobody else knows. When someone leaves, remove their access the same day, and make sure the number and the history stay with the organisation. That is the failure mode of the personal phone, repeated one layer up, if you are careless with user accounts.

Keep an audit that shows what was sent, by which route, and whether it was a template. Have a data processing arrangement with the software vendor that sits between you and the platform. Know how you would export or delete an enquiry if someone asked. Link the thread to the CRM record so a later colleague can see the promise that was made, and so reporting is not a guess.

Denbot is one way to do that operational layer. It connects a practice WhatsApp number to the same pipeline as website chat, SMS, email, and Facebook leads, so replies are not trapped on a handset and opt-outs are visible to the team. It does not replace your clinical system, and it does not remove the need for the practice to decide which messages are service and which are marketing.

Frequently asked questions

Can we just use the free WhatsApp Business app on the reception mobile?

You can, and many practices do, but it is a poor fit for a clinic. History sits on a device, cover is fragile when people are away, and you will struggle to show a clean record of consent and access. The Business Platform plus a shared inbox is the setup to aim for.

Do we need consent to reply to an enquiry?

Replying to an enquiry the person started is different from sending marketing. You still need a privacy notice and a lawful basis you can explain. You need consent, recorded properly, before you send promotional broadcasts. This is general guidance, not a legal opinion on your last campaign.

What is the 24-hour window?

It is the period after a patient's message during which you can reply conversationally. After it closes, business-initiated WhatsApp messages usually need an approved template. Check the current platform rules before you automate a chase.

Can we put treatment details in the chat?

Keep the thread to logistics and reassurance. Diagnosis, plans, and medical history belong in the clinical record. A reminder that someone is due in on Thursday is fine. A narration of their health is not.

What should we do if a patient says stop?

Stop on that channel, record the request on the lead, and make sure the next chase (WhatsApp, SMS, email, or Facebook) does not ignore it. Train the team to treat "stop" as an instruction, not a prompt to try a different app.

Will WhatsApp guarantee a higher reply rate?

No. It often gets seen sooner than email. Your reply rate is a property of your list, your timing, and your message. Measure it in the CRM rather than borrowing a figure from a slide.