WhatsApp Review Requests: Are They Legal for UK Clinics? (GDPR Guide)

WhatsApp is the highest-converting channel for healthcare review requests — achieving 20-40% review submission rates versus under 5% for email. But UK clinic managers frequently ask: is it actually legal under GDPR to send patients a WhatsApp message asking for a review? The answer is yes — with the right setup.

The legality depends on three things: how you obtained the patient's phone number, what basis you're using under UK GDPR Article 6, and whether you provide a proper opt-out mechanism. All three are manageable with the right system.

The Three GDPR Requirements for WhatsApp Review Requests

To use WhatsApp legally for patient review requests, you must satisfy all three of these conditions.

• 1. Lawful basis: Legitimate interests (Article 6(1)(f)) or explicit consent (Article 6(1)(a))
• 2. Legitimate purpose: Review collection is a legitimate business interest — document this in your LIA
• 3. Opt-out mechanism: Every WhatsApp message must include 'Reply STOP to unsubscribe'

You must also not reference clinical information (e.g., the nature of their appointment) in the WhatsApp message.

Setting Up Compliant WhatsApp Review Requests

Legitimate Interests Assessment (LIA)

If using legitimate interests as your lawful basis (the most common approach), you must document a Legitimate Interests Assessment.

• Purpose test: Identify the specific purpose (collecting patient reviews for business improvement)
• Necessity test: Establish why WhatsApp is necessary and proportionate for this purpose
• Balancing test: Confirm the benefit to your clinic doesn't override patients' privacy rights
• Document the LIA and keep it on file — ICO may request it
• Review the LIA annually or when your review process changes

A template LIA for healthcare review collection can be downloaded from the ICO website or provided by a GDPR specialist.

Message Requirements

Your WhatsApp review request message must meet these requirements to be compliant.

• Sent from a number identifiable as your clinic
• Clearly states it's from your clinic by name
• Does not reference the clinical nature of their visit
• Includes opt-out instruction ('Reply STOP at any time')
• Contains a direct link to the review platform — no login required
• Under 160 characters where possible for maximum open rate

Example message: 'Hi [Name], thank you for visiting [Clinic Name]. We'd love your feedback — it takes 60 seconds: [Google review link]. Reply STOP to unsubscribe.'

Why WhatsApp Is Worth the Setup

Conversion Rates vs Other Channels

The data on WhatsApp conversion rates for review collection is clear — it dramatically outperforms every other channel.

• WhatsApp open rate: 98% vs email: 22%
• WhatsApp review submission rate: 20-40% vs email: 2-5%
• WhatsApp messages are read within 3 minutes on average
• Patients are more likely to click a link in WhatsApp than in email

For clinics seeing 30 patients per day, WhatsApp review requests can generate 200-400 additional Google reviews per month.

Competitive Advantage

Most UK clinics are not yet using WhatsApp for review collection. Early adopters build a review advantage that's hard to close.

• Build 50-100 reviews in the first month vs competitors taking 12+ months
• Higher Google Maps ranking improves organic patient discovery
• Review velocity signals activity to Google's algorithm
• First-mover advantage in review volume is compounding — more reviews attract more reviews

Curofyx handles all GDPR compliance requirements automatically, including opt-out management and LIA documentation support.