LGPD in WhatsApp patient communication: what the clinic needs to have in order

WhatsApp became the default contact channel between clinic and patient, which means health data, one of the most sensitive categories under Brazil's data protection law, now flows through it on a daily basis.

The first point of attention is consent: does the patient know and agree that this channel will be used to handle health data, or did contact start informally and never get formalized?

The second is retention: how long is conversation history kept, and is there a process for the patient to request deletion, as the law requires?

The third is access control: if multiple team members respond from the same number, is there a record of who answered what, or does everything blend into a single history with no traceability?

None of this requires abandoning the channel. It requires taking it out of informality: a number dedicated to operations, a clear consent process, and a data retention policy the clinic can explain if questioned.

Formalizing this isn't just a matter of legal compliance. It's also what lets a clinic change systems, staff, or vendors without losing the history of the relationship with the patient, because that history now exists in a structured form, not stuck in the memory of whoever answered that day.