This article is for hospital marketing heads, patient-experience managers and compliance leads who plan to message patients on WhatsApp and need a defensible way to record permission. It covers three capture points common in Indian hospitals: the OPD registration desk, web and enquiry forms, and QR codes in physical spaces. It also explains where the consent record has to meet India's data protection rules.
Opt-in is the first thing Meta asks for and the first thing a regulator or patient will ask about. A hospital that cannot show when and how a number was collected has a weak position when a complaint, block or audit arrives. A reliable process costs little. A poor one costs the number's quality rating, and potentially more.
We separate three questions that teams often blur: what Meta requires, what Indian law requires, and what your own policy should require because a hospital deals with health information. Where a rule is still coming into force, we say so.
What Meta requires
Meta's opt-in documentation states the requirements in three parts. The person must be told clearly that they are agreeing to receive messages from your business. The business must be named. And the business must follow applicable law.
The page says you choose the method, with SMS, a website, an interactive voice response flow, and in-person or paper signatures given as examples. Under the policy update from November 2024 described there, opt-in may be general and does not have to mention WhatsApp specifically.
Two recommendations on the same page matter for hospitals:
- Collect separate opt-ins by message category, such as appointment updates and promotional offers, to reduce the chance of blocks.
- Give clear opt-out instructions and honour them.
The page also notes that people can block or report a business, and that sustained low quality can lead to rate limiting. That connects opt-in to account health; the broader programme is in our WhatsApp marketing guide for healthcare.
Meta's permission is a floor. It does not decide whether your use of the number is lawful under Indian rules, and it does not make a promotional message acceptable simply because the patient once gave their number for a booking.
What Indian law adds
The Digital Personal Data Protection Rules, 2025 were notified on 14 November 2025, according to a PIB explainer. The same document describes an eighteen-month phased compliance period. It says every data fiduciary must issue a separate consent notice that is clear and easy to understand, explaining the specific purpose for which personal data is collected and used. It also says people may withdraw consent at any time.
Most sources place the notice and consent obligations in the final phase, in the middle of 2027. The exact day depends on the gazette text, so confirm it with counsel instead of relying on this article. The practical advice is not to wait. A consent flow built now will not need to be redone later, and a hospital's own patients already expect clear handling of their phone number.
For the wider legal picture, see our article on the DPDP Act for healthcare marketing and the overview of compliance rules. Treat the templates below as drafting aids and have your legal adviser approve the final text.
Separate the purposes
The most common error is a single tick-box that covers everything. A hospital number can be used for at least four different purposes, and each needs its own permission or at least its own clear statement:
- Service messages about a booking the patient has made: confirmations, reminders, reschedules, report-ready alerts.
- Care follow-up that the clinical team has requested, such as a post-procedure check-in.
- Feedback and review requests tied to a visit.
- Promotional messages: health camps, packages, newsletters.
Tying the first purpose to registration is reasonable. Bundling the fourth purpose into the same tick-box is the practice that produces blocks and complaints. A patient who gave a number to get their blood report should not discover health-package offers on the same thread without having agreed to them.
Capture point one: the OPD desk
The registration desk is where most numbers enter the hospital. It is also where consent is most often implied rather than recorded.
Wording at the desk. Staff need a short script the patient can understand, in the patient's language. For example: "We will send your appointment and report updates on WhatsApp from this hospital's number. Do you agree? You can stop at any time by replying STOP." Promotional messages are a separate question: "Would you also like occasional health information and offers from us on WhatsApp?"
Recording. The registration software should hold two separate fields rather than a single flag. A tick-box recorded as yes for everything is hard to defend.
Paper forms. If paper remains in use, print the notice on the form, name the hospital, state the purposes and give a withdrawal route. Scan the signed form against the patient record or at least store a reference.
Attendants. Many numbers belong to a relative. Ask who the number belongs to and record the relationship. A message about a patient to a relative's phone raises its own privacy question that the hospital's data protection lead should decide.
