POPIA Consent for WhatsApp Review Requests in Healthcare

The Protection of Personal Information Act requires that healthcare practices obtain explicit consent from patients before sending any marketing communication via WhatsApp. For the purpose of Google review requests — which the Information Regulator treats as marketing communications because they promote the practice — consent must be obtained at the point of patient intake, before any message is sent. The most practical approach is a dedicated checkbox on your new patient intake form with wording along the lines of: "I consent to receiving WhatsApp communications from [Practice Name] regarding my experience as a patient." This satisfies POPIA Section 11's lawful processing requirement and creates a documentable record if consent is ever challenged during a compliance review.

The specific requirements for each outbound WhatsApp review request message are: a clear identification of the practice sending the message, a statement of the purpose, and a POPIA-compliant opt-out instruction. The standard opt-out clause is "Reply STOP to opt out" — this must appear in every outbound marketing message without exception. Once a patient responds STOP, they must be immediately and permanently suppressed from all future review requests. This suppression is not discretionary: continuing to message a patient who has opted out is a POPIA violation and can result in a formal complaint to the Information Regulator. An automated platform that tracks opt-outs and enforces suppression removes the risk of human error on this requirement entirely.

POPIA's data minimisation principle applies to how patient contact information is stored for review request purposes. Practices may not store a patient's WhatsApp number or full name in a review request platform beyond what is necessary — and that storage must be secured against unauthorised access. The correct approach is to store patient identifiers as cryptographic hashes (SHA-256 is the standard) rather than readable names and numbers. This means that if your review platform is ever compromised, patient identities cannot be reverse-engineered from the stored data. It also satisfies POPIA's requirement that personal information be processed in a manner that ensures its security and integrity, as required under Section 19.

The timing and frequency of WhatsApp review requests also fall within POPIA's scope. POPIA does not prescribe a specific numerical limit on outreach frequency, but the general principle is that you may only use a patient's contact information for the purpose for which consent was given — and only to the extent proportionate to that purpose. Sending multiple follow-up review requests to a patient who did not respond to the first risks being characterised as excessive processing rather than a legitimate communication. Best practice is one review request per consultation episode, sent within 24–48 hours of the appointment, with no automated follow-up if the patient does not respond. Most compliant platforms enforce a single-request rule per contact automatically.

Healthcare practices that collected patient contact information before POPIA came into full effect on 1 July 2021 need to be cautious about using that historical data for WhatsApp review requests without fresh consent. Pre-POPIA patient records do not automatically grant consent for marketing communications under the current framework. If your practice has been sending WhatsApp review requests to a historical patient list without a formal consent process in place, the lowest-risk path is to pause those sends and collect fresh consent through an updated intake form for new consultations. The Information Regulator has indicated that enforcement focus goes to practices with no consent process at all — but a documented, auditable consent workflow is the correct operational standard regardless of enforcement priority.

Guardian AI Reviews handles the POPIA compliance layer automatically. Opt-out language is embedded in every WhatsApp template and cannot be removed. Opt-out responses are tracked and the contact is permanently suppressed from future sends without manual intervention. Patient identifiers are stored as SHA-256 hashes rather than readable data. Every review request sent generates an audit log entry recording the send time, contact hash, and opt-out status — formatted to support a POPIA compliance review if one is required. The platform is priced at R299 per month in South African rand, with no annual contract, and all compliance features are included as standard — not as a paid add-on that a practice manager has to configure separately.