WhatsApp and therapy clients in India

• The Telemedicine Practice Guidelines of March 2020, written for registered medical practitioners, list "Chat Platforms like WhatsApp, Facebook Messenger etc." among the tools a doctor may use, and ask doctors to keep chat and text records of telemedicine interactions (section 3.7.2). They do not apply to psychologists or counsellors.
• The NIMHANS guidelines for tele-psychotherapy (2020, not binding) say appointments "could be fixed via text messages or email", ask both sides to agree not to share session content "via email, social messaging applications, social networking sites etc.", and say clients should not be added to any online group without discussion and explicit consent.
• The DPDP Act applies to client data whatever app carries it: you need the client's consent for the purpose, you must take reasonable security safeguards (section 8(5)), and you must be able to erase data when the purpose is served (section 8(7)).

If you use the WhatsApp Business app or the WhatsApp Business Platform, the WhatsApp Business Messaging Policy (last updated 23 September 2026) applies. It says:

• You may contact people only if they gave you their number and "you have received opt-in permission from the recipient confirming that they wish to receive subsequent messages or calls from you".
• You are responsible for the notices, permissions and consents the law requires, including a published privacy policy.
• Do not ask people to share full card numbers, financial account numbers, personal ID card numbers or other sensitive identifiers.
• "Don't use WhatsApp for telemedicine or to send or request any health related information, if applicable regulations prohibit distribution of such information to systems that do not meet heightened requirements to handle health related information."

India has no regulation of that kind for psychologists or counsellors today, so the last rule does not clearly bar therapy practices. It is still a good reason to keep health information out of WhatsApp where you can.

• Messages are end-to-end encrypted in transit, so WhatsApp says it cannot see personal messages (WhatsApp privacy). But once delivered, they can be read by anyone who can unlock either phone.
• Chat backups to cloud storage are secured by that cloud service, not by WhatsApp's end-to-end encryption, unless you turn on WhatsApp's end-to-end encrypted backup (Meta engineering). The client's backups are outside your control.
• Shared and family phones. A message about a session can be seen by a spouse, parent or employer who picks up the client's phone.
• Your personal number. Clients can message you at any hour, and it is hard to stop when the work ends.
• Records. Clinical decisions made in chat are hard to find later and hard to erase when the client asks.

1. Ask at intake whether the client wants WhatsApp messages at all, and record the answer. Offer email as an alternative.
2. Use WhatsApp for logistics only: times, changes, links and reminders. Keep symptoms, diagnoses and session content out of it.
3. Write messages as if someone else might read them. "See you Thursday at 5" is enough.
4. Never ask for Aadhaar numbers, card numbers or reports over WhatsApp. Use a secure upload instead.
5. Never add a client to a group without discussing it and getting explicit consent.
6. Use a separate number or the WhatsApp Business app for work, and turn on end-to-end encrypted backup.
7. Say in your intake information when you reply to messages and that WhatsApp is not for emergencies, with the Tele MANAS helpline (14416) for urgent help.
8. Move anything clinical from a chat into your notes, then delete it from the chat.