Este sitio también está en español.
A WhatsApp assistant for a medical office books, confirms, reschedules and cancels appointments, and gives hours, address and visit preparation. What it does not do is touch clinical information: no symptoms, no diagnoses, no results. As soon as a message enters that ground, it goes to a person. FaroVivo draws that line on purpose, and explains why further down.
In a private office almost all the message volume is the same thing repeated: what time is my appointment, can I change it, where are you, do you take my insurance, do I need to fast. None of that needs anyone with clinical training, and yet it eats the day of the front desk person, who is also serving whoever is standing at the counter.
The temptation is obvious: move all of it to WhatsApp, where the patient already is. And that is where almost every vendor in the field looks the other way, because the honest answer makes the sale harder.
The honest answer is this: WhatsApp is not a channel fit for health information, and not because it lacks encryption. Meta does not sign a business associate agreement for WhatsApp, which is the document without which, in the United States, a practice cannot pass protected health information to a vendor. And WhatsApp Business's own messaging policy says so in so many words.
What can be done (and what we do) is design the assistant so clinical information never enters the channel. A patient can confirm they are coming Thursday at ten without anyone ever writing what the appointment is for.
The WhatsApp Business Messaging Policy says, word for word: "Don't use WhatsApp for telemedicine or to send or request any health related information, if applicable regulations prohibit distribution of such information to systems that do not meet heightened requirements to handle health related information."
In the United States, the rule requires a covered entity to obtain satisfactory assurances, by contract, before disclosing protected health information to a business associate. Without that signed contract, the channel cannot be used for that information, however encrypted it is.
All the administrative work, which is where the volume is. The assistant never needs to know what the visit is for to do its job.
Only to the scheduling side. The assistant does not need (or ask for) access to the patient's chart.
This is the difference from the other five industries on this list: each market has its own legal framework, and none is adapted from its neighbor. Nothing below is legal advice; check it with your advisor.
HIPAA rules. Since Meta does not sign a business associate agreement for WhatsApp, protected health information cannot travel through it, and no middleman fixes that: even if the API provider signs, the message still goes through WhatsApp. That is why the assistant is designed to stay administrative. Messaging consent also has to be handled with care.
The GDPR applies, with health data as a special category under Article 9, plus Spain's data protection law, the LOPDGDD. If a vendor processes data on the clinic's behalf, a data processing agreement is required under Article 28 of the GDPR. In a dental clinic the patient asks for a "cita previa", and that is the expression the assistant has to use.
Sensitive personal data, and health data is sensitive, requires express written consent. That changes how the first message is framed and what can be asked of a patient through this channel.
Law 1581 of 2012 regulates sensitive data and habeas data, with its own prior authorization regime. As in Mexico, the practical consequence is that the channel is used for scheduling and not for the content of the visit.
Not for protected health information. Meta does not sign a business associate agreement (BAA) for WhatsApp, and without that document the channel cannot be used for that information in the United States. WhatsApp Business's own messaging policy rules out using it for telemedicine or to request health information where regulations prohibit it. That is why the assistant is designed so that information never enters: scheduling yes, clinical no.
For the real volume, which is administrative: confirming, rescheduling and canceling appointments, reminding patients without saying what the visit is for, giving the address and preparation, and collecting contact details from new patients. That is most of what your front desk answers by hand today.
It looks like one in what it solves and differs in what it replaces. An AI virtual receptionist answers the message, books and confirms, same as here. The difference is that this does not come to replace the person at the front desk: it takes off their plate the five questions repeated a hundred times a day, so they can serve whoever is at the counter. Anything off script still reaches them, with the whole conversation.
No, and on purpose. A notification is read on the lock screen, on the subway or lying on a table. The reminder has date, time and address. The patient knows the reason.
No. Only to the calendar. The assistant does not ask for or need access to the chart, and that separation is part of the design, not a shortcoming.
From $350 USD setup and $99 USD/mo of operation, same as the rest. What sets this industry apart is not the price: it is that the setup includes reviewing what information enters the channel and writing the templates so a reminder does not reveal what the appointment is for. That work is included, not extra, and we say so up front so there are no surprises on either side.
No. We build the system; we are not lawyers or compliance officers. What we do is tell you clearly what information enters the channel and what does not, so your advisor can review it with concrete facts in hand.
Each industry has its own page, because the problems are not the same.
The first thing we do is draw the line: what enters the channel and what does not. That is decided with you before writing a single answer, and it stays in writing for your advisor to review.
Let's talk about my office →No obligation, in English or Spanish.
Luis · FaroVivo
Online
Talk on WhatsApp Typing…
