WhatsApp Business for HOF clinics: setup and LGPD
WhatsApp is now the main channel of contact between patient and aesthetic clinic: it is where questions are answered, appointments are booked and confirmed, photos are sent, aftercare is asked about and rescheduling is requested. That is great for speed and it brings risk: health conversations sit in a chat app, on someone's phone, mixed with personal life, with photos of faces and accounts of symptoms. In orofacial harmonization (HOF), where the data is sensitive and promising results is prohibited, organizing the channel is part of quality.
This guide shows how to set up WhatsApp Business, use labels and quick replies, what to automate, how to handle photos and clinical information, and which usage rules the team needs to follow. Ready-made message texts are in WhatsApp scripts for HOF clinics, which complements this material. The rules of Brazilian professional councils and the platform's rules change: always check them.
Why separate the clinic's number from a personal one?
| With a clinic number and device | With the professional's personal WhatsApp |
|---|---|
| Contacts and conversations stay with the clinic's assets | Patients and personal life get mixed |
| The team can answer in shifts, with controlled access | Only the owner answers, all the time |
| You can change professionals without losing the history | If the professional leaves, they take the contacts |
| Easier to apply LGPD and keep evidence | Hard to control who sees what |
| Professional profile with hours, address and catalog | Personal profile, no business features |
Use the WhatsApp Business app for the clinic's number. It offers a business profile, labels, quick replies, greeting and away messages, a catalog and simple statistics. Integration interfaces also exist for larger teams; evaluate them with caution, especially regarding data processing by third parties (see management software for HOF clinics).
How to set up the profile
The profile is your business card. Fill it in carefully:
| Field | Guidance |
|---|---|
| Name | The clinic's or professional's name, as registered |
| Photo | Logo or professional photo, no patient images |
| Description | One simple sentence about the clinic, with no promise of results |
| Address and map | Correct and identical to Google and the website |
| Hours | Real, so the away message works |
| Email and website | For those who prefer other channels |
| Catalog | Optional; if you use it, describe services without promotional prices and without promises, per the rules |
| Council registration number | When the rules require it or it is convenient to include |
Keep everything consistent with your Google Business Profile and your HOF clinic website.
How to organize conversations with labels
Labels turn the app into a simple funnel. Avoid too many labels; five to eight are enough.
| Label | Use |
|---|---|
| New contact | Asked a question, has not booked yet |
| Assessment booked | Already has a date |
| Post-procedure | Being followed up in the following days |
| Follow-up | Follow-up or reassessment scheduled |
| Quote sent | Waiting for a reply (see patients who disappear after the quote) |
| Pending | Waiting for a document, test or reply |
| Do not contact | Asked to stop receiving messages |
Avoid labels that record a sensitive diagnosis or procedure in an identifiable way, such as "treatment for X", since the device may be accessed by more than one person. Prefer stage labels (booked, post-procedure, follow-up) over condition labels.
Which quick replies to create
Quick replies save time and standardize communication, but they need a human voice and room for personalization. Some that tend to help:
| Shortcut | Purpose |
|---|---|
| /hello | First greeting and a question about what the person is looking for |
| /assessment | What the assessment is like, duration, fee, what to bring |
| /address | Address, map, parking, hours |
| /confirm | Appointment confirmation asking for a reply |
| /reschedule | Rescheduling and no-show policy (see cancellation and no-show policy) |
| /after | Link or text with instructions already agreed on at the consultation |
| /followup | Offer of a follow-up time slot |
| /documents | List of what to bring (ID, tests, medication list) |
What to automate and what not to
| Automate | Do not automate |
|---|---|
| Greeting and away message | Replies to post-procedure symptoms or concerns |
| Appointment confirmation | Personalized quotes |
| Sending the address and arrival instructions | Assessing a case from a photo |
| Satisfaction survey (see NPS in the HOF clinic) | Any clinical decision |
| Follow-up reminder with consent (see patient recall) | Sensitive billing and negotiation |
Automation is for logistics, not for care. A patient who reports severe pain, a change in skin color, vision loss or shortness of breath cannot get an automated message. Set it up so that, with these keywords, the conversation goes straight to a person, and make it clear in the away message: "In an emergency, call [phone] or go to the nearest emergency room".
Photos and clinical information: the highest-risk point
A face photo and an account of symptoms are personal data, and health information is sensitive data under LGPD. That requires a purpose, a legal basis, only the minimum necessary, security and a retention period. In practice:
- Agree beforehand: tell the patient that the photos received will be used for follow-up and recorded in the patient record, and for no other purpose without specific consent. See consent and LGPD for photos.
- Use the clinic's device, with a password, screen lock and, if possible, a protected backup. Avoid personal phones.
- Transfer clinical images to the patient record and delete them from the device according to the clinic's policy.
- Turn off automatic media download to the phone gallery, so patient photos do not show up alongside personal ones.
- Never forward a patient's photo to another patient, group or colleague without consent and need.
- Avoid groups with patients. Use broadcast lists only with those who authorized it, and never for sensitive data.
- Beware of disappearing messages: they may erase what should remain on record. Define what stays on WhatsApp and what goes into the patient record.
- If the patient asks for deletion, follow the clinic's procedure and Brazilian law on retention of patient records.
| Situation | What to do |
|---|---|
| A patient spontaneously sends a post-procedure photo | Thank them, check for warning signs, record it in the patient record and recommend an in-person assessment if needed |
| A patient asks you to assess a symptom from a photo | Direct them to a consultation or emergency care; do not "diagnose" by message |
| A patient sends a test result with personal data | Move it to the patient record and delete it from the device according to your policy |
| A third party (a relative) asks about the patient | Do not share anything without the patient's authorization |
| A colleague asks for a photo to discuss a case | Anonymize when possible and ask for consent (see partnerships between HOF professionals) |
Which clinical messages fit on WhatsApp?
In general, WhatsApp handles these well:
- Agreed instructions from the consultation (aftercare, scheduled follow-up), preferably also delivered in writing. See the templates for post-procedure instructions.
- Simple questions the professional has already answered before.
- Follow-up: "How are you feeling?"; if the patient reports a warning sign, call them in for care.
- Reminders for follow-up or reassessment, with consent.
And it does not handle these well: diagnosis, prescriptions, recommending a procedure without an assessment, discussing complex results, negotiating a complication. For those, call or book a consultation.
How to handle the patient who wants "just the price"
This is the most common question. Instead of a loose price list or silence, welcome the person and redirect:
"Hello! Fees depend on the plan we define at the assessment, because every face is different. The assessment with [professional] lasts about [time] and costs [amount]. Would you like me to check available times?"
This keeps the contact, shares what can be shared and moves to the point where the decision is clinical. The exact policy on quoting procedure prices by message is up to the clinic and must respect the council's rules.
What rules to write for the team
A one-page document, signed by everyone who uses the device, prevents a lot of problems:
- The clinic's WhatsApp is only for clinic business.
- Only people with permission access the device, with a password and lock.
- Reply hours and the person responsible for each shift.
- What the team may answer and what goes to the professional.
- No talking about other patients.
- No promising results, recommending procedures or commenting on symptoms.
- Photos and documents go into the patient record and are removed from the device.
- Emergency: always alert the professional and guide the patient.
- Promotional messages only to those who authorized them, with an option to opt out.
- When someone leaves the team, their access is deactivated the same day.
See also HOF clinic reception, which has scripts for patient service.
How to measure whether the channel works
| Indicator | What it shows |
|---|---|
| Average first response time | Speed of service |
| Contacts that become a booked assessment | Effectiveness of the first contact |
| Messages on the same topic | What deserves a place on the website or in quick replies |
| "Do not contact" requests | Possible excess of messages |
| No-shows after confirmation | Process quality (see no-shows) |
Hypothetical example: a clinic notices that many new contacts vanish after asking about price. It creates a quick reply that explains the assessment and offers times, and tags anyone who does not answer within two days as "New contact". A single follow-up message is sent, with no pressure. After three months, it compares how many contacts became assessments. The number is just an internal thermometer.
Summary
Use WhatsApp Business on the clinic's device and number, with a profile consistent with your website and Google, a few labels and quick replies with no promises. Automate logistics, never clinical decisions. Treat photos and accounts of symptoms as sensitive data under LGPD: tell the patient, record it in the patient record, limit access and delete from the device according to your policy. Have written rules for the team, a respected "do not contact" label and a clear path for emergencies.
Frequently asked questions
Is WhatsApp Business worth using in an aesthetic clinic?
Generally, yes. It offers a business profile, catalog, labels, quick replies and automated messages, and it keeps the clinic's number separate from a personal one. But it does not solve LGPD (Brazil's data protection law) or confidentiality on its own: it requires usage rules, controlled access and care with health data.
Can I receive patient photos on WhatsApp?
You can, if the patient sends them voluntarily and you have a clear purpose, but care is needed. Face photos are personal data, and health information is sensitive. Use the clinic's device, tell the patient, store the images in the patient record and delete them from the device according to your policy. Agree in writing on when photos are accepted.
Can I send automated messages to the clinic's patients?
Greeting, away and appointment confirmation messages are usually appropriate. Mass promotional messages require the data subject's authorization and compliance with health advertising rules and the platform's rules. Always give a simple way to opt out.
Can I use the professional's personal WhatsApp to see patients?
It is not recommended. Mixing personal and patient contacts on a device with no controls increases the risk of leaks and makes management harder. The ideal is a clinic number and device, with restricted access and a password.
Can I share clinical information on WhatsApp?
Instructions already agreed on during the consultation, such as post-procedure care, and answers to simple questions are common. Assessing symptoms, recommending a procedure or deciding on a course of action requires a consultation. When there are warning signs, direct the patient to seek care and record the conversation in the patient record.