LGPD on your practice's WhatsApp: basic precautions for patient data

This article is for information only and does not replace legal advice. To bring your practice into compliance, talk to a lawyer or to the data protection officer (DPO).

1. Use the practice's number, not a personal phone

Patient conversations on the personal phone of a professional or someone at the front desk mix personal life and work, and stay out of the practice's control. Prefer a business number, ideally on WhatsApp Business, accessed only by those who need it.

2. Ask only for what you need

To book an appointment, name, phone number, date of birth and health plan are usually enough. Avoid asking for photos of documents, test results or a detailed description of symptoms over chat when that isn't necessary for the appointment.

3. Control who has access

• Define who on the team can see and reply to conversations.
• Protect devices with a password and turn on WhatsApp's two-step verification.
• When someone leaves the team, remove their access the same day.

4. Inform the patient

Explain, in simple terms and somewhere easy to find, how the practice uses the data: what it's for, how long it's kept and how the patient can request access or deletion. A link to the privacy policy in the first message already helps.

5. Be careful with forwarding and groups

Don't forward patient conversations to team groups or to personal numbers. If a case needs to be passed on, share only what's necessary, through the practice's official channel.

6. Choose vendors carefully

If patient service goes through a platform or automation, ask where the data is stored, who has access, how encryption is done and what happens to the data if the contract ends. These answers should be in the contract.

How Norvity handles data

Norvity was built for healthcare patient service. The security and privacy details are in the “Patient data” section of the home page.