Last updated: 25 September 2026
1. About this policy
This policy explains how Picanse collects, uses, discloses and protects personal data when clinics send and receive WhatsApp messages through Picanse WhatsApp Messaging. It applies to clinics using Picanse and to patients and other people who exchange WhatsApp messages with those clinics.
Picanse is operated by Picanse Ltd, a company registered in England and Wales (company number 17329285), with registered office at Unit 16 The Mead Business Centre, Mead Lane, Hertford, Herts, United Kingdom, SG13 7BJ. We are registered with the Information Commissioner's Office (ICO) under registration number ZC251978.
Picanse WhatsApp Messaging lets a clinic connect its WhatsApp Business account to Picanse and message patients from within Picanse — for example appointment reminders, booking confirmations, aftercare instructions and replies to patient enquiries. Messages are sent through Meta's WhatsApp Business Platform, and message charges are paid from the clinic's Picanse Wallet.
This policy sits alongside the main Picanse Privacy Policy and our Terms of Service. If they conflict on anything relating to WhatsApp messaging, this policy applies.
2. Who is responsible for your data
| Party | Role | What that means |
|---|---|---|
| The clinic | Controller of patient data | Decides which patients to message, what to say and why. Responsible for having a lawful basis and patient opt-in. |
| Picanse | Processor of patient data | Stores and sends messages only on the clinic's instructions, under a data processing agreement. |
| Picanse | Controller of clinic account and billing data | Responsible for data about the clinic and its staff users, wallet top-ups and usage records. |
| Meta (WhatsApp) | Provider of the WhatsApp Business Platform | Delivers messages and processes them under Meta's own terms and privacy policy. |
If you are a patient and want to know how your clinic uses your information, contact the clinic first. We will help the clinic respond to your request.
3. Data we collect
We collect only what is needed to send, receive, record and bill WhatsApp messages.
| Category | Examples | Whose data |
|---|---|---|
| WhatsApp Business account details | Clinic business name, WhatsApp phone number, WhatsApp Business Account ID, display name, access tokens | Clinic |
| Clinic user data | Name, email, role, which staff member sent a message | Clinic staff |
| Patient contact data | Name, mobile number, WhatsApp profile name, opt-in status and date | Patient |
| Message content | Text, message templates, images or documents sent or received, appointment details included in a message | Patient and clinic |
| Message metadata | Timestamps, message IDs, delivery and read status, conversation category, error codes | Patient and clinic |
| Wallet and billing data | Top-up amounts, message charges, balance, invoices, transaction references | Clinic |
| Technical data | IP address, device and browser data, audit logs of actions in Picanse | Clinic staff |
Messages may contain health information, such as treatment or appointment details. We treat this as special category data and protect it accordingly. Clinics should include only the minimum health detail needed in any message.
We do not collect card numbers directly. Wallet payments are handled by our payment provider.
4. How we use data
We use WhatsApp data only to provide the messaging service to clinics. We do not use message content for advertising, profiling or to train AI models.
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Sending and receiving messages on the clinic's behalf, and showing conversation history in Picanse | Clinic's instructions under our processing agreement (the clinic's own lawful basis applies) |
| Connecting and managing the clinic's WhatsApp Business account and templates | Contract with the clinic |
| Charging message costs to the Picanse Wallet and issuing invoices | Contract; legal obligation (tax and accounting records) |
| Recording opt-ins and opt-outs so patients are not messaged without permission | Legal obligation; legitimate interests |
| Security, fraud prevention, audit logs and fixing faults | Legitimate interests |
| Complying with law, regulators and Meta's WhatsApp Business policies | Legal obligation; legitimate interests |
Where messages contain health data, the clinic relies on Article 9(2)(h) UK GDPR (provision of health care) and the related condition in the Data Protection Act 2018, or on the patient's explicit consent.
5. Who we share data with
We never sell personal data or share it for marketing. We share it only with the parties below, and only as far as needed.
| Recipient | What they receive | Why |
|---|---|---|
| Meta Platforms (WhatsApp Business Platform / Cloud API) | Recipient phone numbers, message content, templates, business account details | To deliver and receive WhatsApp messages |
| IONOS (hosting, UK) | All data held in Picanse, encrypted | To store and run the service |
| Stripe | Clinic billing details and top-up transactions | To process Picanse Wallet top-ups |
| Professional advisers, auditors, insurers | Limited data where needed | To run our business and meet legal duties |
| Regulators, courts, police | Only data we are legally required to disclose | To comply with the law |
All service providers act under written contracts that require confidentiality and security. If Picanse is sold or merged, data may transfer to the new owner under the same protections, and we will tell affected clinics first.
6. Picanse Wallet and message charges
WhatsApp message charges are deducted from the clinic's prepaid Picanse Wallet, priced in pounds sterling. To do this we record, for each message or conversation, its date, type, category, cost and the wallet balance after the charge.
These billing records are linked to the clinic account, not used to profile patients. Patient phone numbers and message content are not shared with our payment provider. We keep billing records for 6 years to meet UK tax and accounting rules.
7. Opt-in, opt-out and clinic responsibilities
Patients are only messaged on WhatsApp after they have opted in with the clinic. Picanse records the date and method of each opt-in.
Patients can opt out at any time by replying STOP, by asking the clinic, or by blocking the clinic's number in WhatsApp. Picanse marks the patient as opted out and prevents further non-essential messages.
Clinics using the service must:
- get and record a clear opt-in before messaging a patient on WhatsApp;
- tell patients, in their own privacy notice, that they use WhatsApp and Picanse;
- send marketing messages only where the patient has separately agreed to marketing, as required by PECR;
- keep health detail in messages to the minimum needed; and
- follow the WhatsApp Business Messaging Policy and Meta's Commerce Policy.
8. Transfers, security and retention
International transfers
Picanse stores data in IONOS data centres in London, UK. Meta may process WhatsApp messages outside the UK, including in the United States. Where data leaves the UK, it is protected by the UK–US Data Bridge, the UK International Data Transfer Addendum, or other safeguards approved under UK GDPR.
Security
WhatsApp messages are encrypted in transit. Within Picanse, data is encrypted in transit (TLS) and at rest, access is role-based and limited to authorised clinic staff, and staff actions are logged. WhatsApp access tokens are stored encrypted and never shown in full. We will notify affected clinics without undue delay if a data breach affects their data.
Retention
| Data | How long we keep it |
|---|---|
| Messages and conversation history | While the clinic's account is active, or as the clinic instructs; deleted within 90 days of account closure unless the clinic exports it or asks us to keep it for clinical records |
| Opt-in and opt-out records | For as long as the patient is on the clinic's list |
| Wallet and billing records | 6 years from the end of the financial year |
| Audit and security logs | 12 months |
| WhatsApp Business account connection data | Until the clinic disconnects WhatsApp, then deleted within 30 days |
Clinics remain responsible for keeping medical records for the periods their professional rules require.
9. Your rights, data deletion and contact
Under UK GDPR you can ask to access, correct, delete, restrict or move your personal data, and object to how it is used. We respond within one month.
How to request deletion of your WhatsApp data
- Patients: contact your clinic, or email info@picanse.com with your name, mobile number and the clinic's name. We will pass the request to the clinic and delete the data when the clinic confirms, unless the law requires it to be kept.
- Clinics: disconnect WhatsApp in Settings → Integrations → WhatsApp, or email info@picanse.com to delete all WhatsApp data held for your account.
- We confirm deletion by email within 30 days.
You can also remove your data from Meta's systems through WhatsApp's own settings; see WhatsApp's Privacy Policy.
Contact us: Picanse Ltd, Unit 16 The Mead Business Centre, Mead Lane, Hertford, Herts, United Kingdom, SG13 7BJ.
Email: info@picanse.com
Complaints
If you are unhappy with how we handle your data, please contact us first at info@picanse.com. We will try to resolve your concern or explain anything that is unclear. If you would prefer to complain in writing, email us and we will post you a complaint form.
If you are still not satisfied, you can complain to the Information Commissioner's Office (ICO) on 0303 123 1113. The ICO usually expects you to have raised your complaint with us before it will investigate it.
Changes to this policy
We will post any update on this page and notify clinics by email before material changes take effect.