Patient communication that actually reaches the patient — without three reception calls.

WhatsApp Cloud API uses transport-layer encryption between Meta and your server, but compliance with HIPAA (US) or DPDP Act (India) depends on what you put into messages and how you handle audit trails. WhatsMark's recommendation for clinics handling sensitive PHI: send notifications and short-lived secure links rather than raw documents, log every conversation in your hospital management system, and run a Business Associate Agreement review with your legal team before going live with patient data. We can share our security architecture for that review on request.

Yes. Replies route to a shared clinic inbox where any authorized staff member can respond. Every reply is logged with the time, the responding staff, and full conversation history. Reception, doctors, and care managers can be assigned different access levels.

You can connect up to 2 WhatsApp numbers on Free, 10 on Professional, and unlimited on Reseller — for example one per clinic — each with its own named team inbox and role-based access. Being straight about today: these run in one workspace with shared reporting, not fully isolated per-clinic sub-accounts with per-clinic white-labeling; that broader capability is on the roadmap, not shipped.

Reminders send at the configured time relative to the appointment, independent of staff hours, and patient replies queue in the inbox for the next available staff member. One honesty note: the reminder capability is built and reads the real appointment time, but confirm with us that it's scheduled to run in your deployment before you rely on it as fully hands-off.

Yes — a WhatsApp message supports PDF documents up to 100 MB. For sensitive documents, the recommended pattern is a short-lived signed link to a file in your own store rather than a raw attachment, so the document is reachable only by the recipient and only for the window you set.

For marketing messages, yes. Utility messages tied to an active appointment (reminders, report-ready alerts) don't need a separate marketing opt-in, but the patient must have shared their number — usually in the booking flow. WhatsMark captures and tracks consent against every contact, and an opt-out reply blocks future marketing automatically.

A cancellation through the built-in booking system frees the slot and updates the appointment, so its reminder no longer applies. If cancellations live in your own HMS instead, that system calls the WhatsMark API to update the contact — WhatsMark doesn't receive arbitrary inbound webhooks, so the trigger comes from an API call, not a webhook into us.

Meta charges per conversation, billed directly to your own Meta Business Account at its published rates. Healthcare reminders and report alerts fall under Meta's cheapest (utility) category. WhatsMark adds 0% on top — you pay us only the flat subscription.

Automation earns its keep on the predictable, high-volume tasks: appointment confirmations and reminders, report-ready alerts, and routine FAQs like clinic timings, location, or what to bring. The bulk of non-clinical, scheduling-type queries can run without a human, which is why automated reminders cut no-shows 20–30% versus none (Dialog Health, 2024) and give reception hours back. What should never be automated is clinical judgement — symptoms, test interpretation, prescription changes. In WhatsMark, anything beyond logistics routes to a named staff member in the shared inbox, with the full conversation logged for your audit trail.