WhatsApp for clinics: the rules nobody explains before you sign up
WhatsApp is where MENA patients actually message clinics. It is also the channel with the most rules, and most of them only become visible after a template gets rejected.
Updated 1 September 2026 · 8 min read
In most of MENA, WhatsApp is not one channel among several. It is the default way a patient contacts a business, and for many clinics it already carries more enquiries than the phone. The awkward part is that the WhatsApp your clinic uses today — the green Business app on a phone at the front desk — cannot be automated, cannot be shared properly between staff, and cannot be audited. Moving to the Business Platform (the API) fixes those things and introduces a rulebook.
This guide is that rulebook, written for the person who has to run the clinic rather than the developer doing the integration. Meta’s policies change; the shape of them has been stable for years, and the shape is what you need to plan around.
The three WhatsApps, and which one you need
| Consumer app | Business app | Business Platform (API) | |
|---|---|---|---|
| Runs on | A phone | A phone | Servers, via a provider |
| Staff sharing | No | Limited, up to a handful of linked devices | Unlimited agents, proper queueing |
| Automation | No | Canned replies and away messages only | Full — this is the point |
| Audit trail | Whatever is on the handset | Whatever is on the handset | Complete and exportable |
| Cost | Free | Free | Per conversation, billed by Meta through your provider |
| Right for a clinic | No | Only the very smallest | Yes, once volume is real |
The 24-hour window, which governs everything
This is the single rule that shapes how clinics operate on WhatsApp, so it is worth stating precisely. When a patient sends you a message, a 24-hour service window opens. Inside it, you may reply freely: any text, any number of messages, no pre-approval. When the patient sends another message the clock resets.
Once 24 hours pass with no message from the patient, the window closes. From then on you may only send a template — a message whose exact wording was submitted to Meta in advance and approved. You cannot simply carry on the conversation.
- A patient asks about prices at 9pm and your agent answers at 9:01pm — inside the window, free text, fine.
- A patient asks on Monday, you reply, they go quiet, and on Wednesday you want to follow up — outside the window, template only.
- An appointment reminder for a booking made three weeks ago — always a template.
- A patient replies to your template — the window opens again and you can speak normally.
The operational consequence is unglamorous but decisive: speed inside the window is free, and delay is expensive. A clinic that answers within a minute pays for one conversation and keeps a live thread. A clinic that answers the next morning has to buy a template send to reopen a conversation the patient has already cooled on. This is a large part of why after-hours automation pays for itself — see the real cost of the message nobody answered.
Templates: how to write ones that get approved
A template is a fixed message with {{1}}-style variables. You submit it, Meta reviews it, and approval usually lands within a day. Rejections are common and are almost always for the same handful of reasons.
What gets rejected
- Variables doing all the work. A template of “Hi {{1}}, {{2}}” is a blank cheque and will be refused. Enough fixed text has to remain that a reviewer can tell what the message is.
- Promotional content submitted under a utility category. Categories matter and are priced differently. Do not label a discount campaign as an appointment update.
- Vague sender identity. The patient must be able to tell who is writing from the message alone.
- Anything that reads like it was written for a different patient. Placeholder text left in, mismatched variable counts, broken formatting.
The templates a clinic actually needs
| Purpose | Shape | Category |
|---|---|---|
| Appointment confirmation | “Your appointment at {{1}} is confirmed for {{2}} at {{3}} with {{4}}. Reply CHANGE to reschedule.” | Utility |
| Reminder, day before | “Reminder: {{1}} tomorrow at {{2}}. Preparation notes are in our earlier message. Reply if you need to move it.” | Utility |
| Missed-call follow-up | “We missed your call at {{1}}. Reply here and our team will help.” | Utility |
| Enquiry re-open | “Hello {{1}} — you asked about {{2}} earlier this week. Would you still like us to hold a slot?” | Marketing |
| Aftercare check-in | “It has been {{1}} days since your {{2}}. Reply here if you have any questions for the team.” | Utility |
Opt-in: the part that is your responsibility, not Meta’s
You need the patient’s permission before messaging them, and the obligation sits with you. Meta does not verify your consent records; it acts on the complaints that follow when you do not have them.
Valid opt-in is anything where the patient knowingly gave you the number for this purpose: a tick box on your intake form that names WhatsApp specifically, a message they sent you first, a click-to-WhatsApp ad they tapped, a QR code at reception. Not valid: a list of numbers from your practice management system that were collected for phone calls, a purchased list, or numbers scraped from Instagram.
- Add a WhatsApp-specific consent line to your intake form, in Arabic and English, naming what you will send (appointments, reminders, aftercare).
- Record the date, the wording shown, and the channel the consent came through — not just a boolean flag.
- Honour opt-out on the first request, in any phrasing and any language. “بس خلاص” is an opt-out.
- Keep clinical and marketing consent separate. A patient who wants appointment reminders has not agreed to promotions.
Quality rating, and how clinics lose it
Meta scores each number on how recipients react. Blocks and “report” taps drive it down; replies drive it up. Fall far enough and your daily sending limit drops, then templates stop going out. Recovery is slow and there is no appeal worth the name.
Clinics almost never lose their rating through the conversations patients started. They lose it through outbound campaigns to old contact lists — the promotion sent to every number in the system, most of whom never opted in to WhatsApp. The rule that keeps you safe is simple: high volume only to people who have messaged you, and low volume, high relevance to everyone else.
Verification and setup, in order
01Business verification with Meta
Legal entity documents — commercial registration, tax card, a utility bill matching the address. Start here, because it is the step with a queue and everything else waits on it.
02Pick a number
Use a number that is not currently on the Business app, or plan the one-way migration deliberately. A landline works if it can receive the verification call.
03Choose a provider
You connect through a solution provider rather than to Meta directly. What differs between them is per-conversation markup, whether you keep ownership of the WhatsApp Business Account, and how easily you can leave. Ask about all three.
04Display name approval
The name patients see must match your registered business. Creative names get rejected and the rejection costs days.
05Submit your first templates
Do this while other approvals are pending. Submit the confirmation and reminder templates first; they are the ones you cannot operate without.
06Then connect the automation
Only at this point does the agent, the routing and the knowledge base matter. The platform work above is a prerequisite regardless of which software you run on top.
What good looks like once it is running
A clinic operating WhatsApp well has a few observable properties. Every enquiry gets a substantive first reply inside the window, including at 1am. Clinical questions reach a human quickly with the thread attached rather than being answered by software. Templates are used for reminders and re-opens, not for broadcast. And the whole history is in one place your compliance officer can export, rather than on a handset that leaves with whoever was holding it.
Inside the window, after hours
Patientفي مواعيد بكرة للتنظيف العميق؟ وكام السعر؟
Agentأهلاً بك — التنظيف العميق ٩٠٠ جنيه للجلسة. بكرة متاح ١٢:٣٠ و ٥:٠٠ مساءً. أحجز لك موعد منهم؟
Answered from the knowledge base and the live slot list — no template needed, no cost beyond the open conversation.
Questions
Asked often enough to answer here
Not on the same number. A number lives in one place or the other, and migrating is one-way. Clinics that want to keep a front-desk handset usually keep it on a separate number for internal use and move the public number to the API.
Meta bills per conversation, priced by category and by country, and your provider adds a margin. Conversations the patient starts are cheaper than ones you start, which is another reason to answer quickly rather than follow up later. Ask any vendor to separate their software fee from the Meta pass-through — if they will not, assume the markup is the business model.
You still need consent, but a patient who booked an appointment and gave you their WhatsApp number for that purpose has given it in a form most regulators and Meta accept — provided your intake wording says so. Record the wording and the date. Marketing is a separate consent and should be collected separately.
Date, time, clinic name and practitioner name are normal and expected. The nature of the treatment is not — assume the message will be read by someone other than the patient, because sometimes it is.
There is no rule, only economics and patient behaviour. Inside the 24-hour window replies are free-form and cost nothing extra; outside it you are buying a template send to restart a conversation the patient has moved on from. Fast is cheaper as well as better.
Keep reading
Guide
AI receptionist for clinics: a practical guide
What an AI receptionist actually does in a clinic, where it must stop, how to evaluate one, and how to roll it out without putting patients at risk.
Article
The real cost of the message nobody answered
Most clinic enquiries arrive when the clinic is shut. Here is how to size that loss from your own inbox, and what actually changes when it is covered.
Guide
Deploying AI in patient messaging without creating a liability
A practical governance framework for clinics using AI on patient conversations: the clinical boundary, consent, retention, audit trails and vendor questions.
See it answer your patients
Bring forty real messages from your own inbox. We will run them live, show you the source behind every answer, and tell you which ones we would refuse to automate.