Can pharmacies message patients on WhatsApp and SMS?

Can you text a patient that a prescription is ready without consent?

Yes. A prescription-ready text, a collection reminder or an appointment confirmation is a message about the patient's own care. NHS England's guidance on texting, emailing and messaging patients puts it plainly: "You do not need the consent of patients and service users to send them texts, emails or other messages about their individual care". The guidance identifies public task under Article 6(1)(e) and the provision of health care under Article 9(2)(h) of UK GDPR as the lawful bases for NHS-funded care. A private pharmacy relies on its contract with the patient or on legitimate interests for Article 6, and on Article 9(2)(h) for the health data.

The common law duty of confidentiality is satisfied the same way. NHS England says it is appropriate to rely on implied consent to communicate with people about their care, because patients reasonably expect it. The GPhC's guidance on confidentiality, updated in November 2025, says explicit consent is needed only where the reason for sharing is one the person "would not reasonably expect".

Three practical conditions still apply. Confirm the mobile number and let the patient state a contact preference; NHS England calls this good practice at registration and asks you to respect it where practical. Keep the content minimal: the guidance says to include confidential information only where necessary, unless the platform is one your organisation has approved for sensitive data. "Your prescription is ready to collect" gives nothing away. "Your sertraline is ready" does. And write the message from a system that records it, which we come to below.

When does a message become marketing?

The moment it promotes something. The ICO defines direct marketing as "the communication (by whatever means) of advertising or marketing material which is directed to particular individuals". Its guidance says messages that confirm or remind people about appointments, or update them on terms and conditions, are service messages and not direct marketing. The test is purpose: "the focus is on why you are doing something rather than the activity itself".

Mixed messages fail that test. The ICO's own example is a gym calling about a failed payment and mentioning personal training on the same call. Because the gym is also promoting its services, the call "now falls within the definition of direct marketing". The pharmacy equivalent is a prescription-ready text that ends "ask about our new weight management clinic". The whole message is now marketing, and it needed PECR consent before it was sent.

NHS England treats invitations to NHS-commissioned care, such as a flu vaccination for an eligible patient, as care messaging. Its guidance notes that the duty of confidentiality still applies when staff search records to decide who to message. Promotion of a private service to people who have not asked about it is marketing, whatever the clinical merit. If you are unsure, ask whether the message would still be sent if the patient never bought anything again. A reminder would. An offer would not.

What consent do marketing texts and WhatsApps need?

PECR consent, to the UK GDPR standard. Regulation 22(2) of the Privacy and Electronic Communications (EC Directive) Regulations 2003 is the rule. A person shall not send unsolicited direct marketing "by means of electronic mail" unless the recipient has previously told the sender that they consent. Regulation 2 defines electronic mail as "any text, voice, sound or image message" sent over a public network and stored until collected. It adds that the term "includes messages sent using a short message service". The ICO's list covers email, SMS, picture and video messages, voicemail, in-app messages and private messages on social media. A marketing WhatsApp is caught in the same way as a marketing text.

The ICO describes the consent standard as a "freely given, specific, informed and unambiguous indication" of the person's wishes. People "must take a positive action to consent", so pre-ticked boxes, silence or inactivity do not count. The one exception is the soft opt-in in regulation 22(3). The table summarises the rules as the ICO's guidance on direct marketing using electronic mail sets them out.

The penalty line is new. The Data (Use and Access) Act 2025 substituted PECR's enforcement provisions from 5 February 2026, applying the Data Protection Act 2018 penalty regime to marketing breaches. The ICO's PECR guide still quotes the old £500,000 ceiling while its guidance is under review, so do not take the old figure from a search result. The soft opt-in is also narrower than it looks for a pharmacy. It covers "similar products or services", and the ICO requires a special category condition where marketing draws on health information. A list of patients who bought a particular medicine is health data. Marketing to it needs explicit consent, not an inference from a purchase. Our guide to marketing emails under PECR covers the consent mechanics in detail.

Is WhatsApp secure enough for patient information?

Not as most pharmacies use it. The question is not whether the messages are encrypted in transit. It is who controls the device, the backups, the account and the record. NHS England's guidance for professionals is direct: "You should not use any app, service, platform or device which has not been approved by your organisation, except for in emergencies". Its guidance for IG leads requires a data protection impact assessment before a new platform is adopted. It also requires staff policies, multi-factor authentication, encryption of data at rest and a rule that staff do not share devices or passwords.

A consumer WhatsApp account on a personal phone fails on every count. The pharmacy has no contract with the platform as its processor, no control over cloud backups, no way to retrieve the thread when the staff member leaves and no audit trail. The ICO's reprimand to NHS Lanarkshire on 31 July 2023, for "the sharing of personal data of patients via unauthorised means", is the reference case for staff messaging outside approved systems. The GPhC frames the same duty for individuals. Standard 7 requires pharmacy professionals to respect and maintain confidentiality and privacy. Its confidentiality guidance asks them to "take all reasonable steps to protect the confidentiality and security of information they receive, access, store, send or destroy". Its January 2024 guidance on professionalism online lists "share information about patients or their care" under the things not to do.

That leaves two lawful routes. The first is a business messaging service, whether SMS, a patient app or a WhatsApp business integration, contracted as your processor, assessed in a DPIA and connected to the record. The second is the NHS App, which NHS England names as a secure platform through which confidential information may be sent. What does not work is the responsible pharmacist's own handset. Our guide to protecting patient data covers the controls a DPIA will expect to see.

Should messages be saved in the patient record?

Yes, all of them. NHS England's guidance says: "You should keep a record of all the emails, texts or other messages you send to patients and service users in their health or care record". Its IG guidance adds that relevant messages must be retrievable, for example by entering them into the record. The GPhC's February 2025 guidance for pharmacies providing services at a distance requires records of the advice given and the key points behind every decision to supply or refuse. A message that changed a decision is part of that record.

Software does this for you; phones do not. A reminder sent from the PMR is logged against the patient with a timestamp and a sender. A WhatsApp sent from a handset exists only on that handset until someone copies it in. Inbound messages matter as much as outbound ones. A patient replying "I've stopped taking it" or "I've had a reaction" has told you something you must act on and record. Our guide to recording patient notes on a PMR explains how to structure that entry, and our companion piece on record retention periods sets out how long it must be kept.

Can patients send photos for a consultation?

Only through an approved platform that writes to the record. A photo of a rash, a wound, a medication box or a set of bathroom scales is confidential patient information, and often special category data. On a personal phone it sits in the camera roll, syncs to a personal cloud account and outlives the consultation with no audit trail. Every rule in the previous two sections applies to it.

The clinical governance point is separate. The GPhC's distance-selling guidance requires a means of "timely two-way communication between the prescriber and the person", and records showing the basis for each supply. For weight-management medicines it goes further. The prescriber must independently verify the person's weight, height or BMI, and the guidance states that a phone call is not an appropriate way to do it. A photo the patient took of their own scales is not independent verification either. Our guide to the verification duties for weight-loss supply sets out what inspectors accept. Photos can support a consultation. They cannot replace the parts of it the regulator has told you to do properly.

Which channel should you use for what?

Match the channel to the sensitivity of the content and the need for a record. The table below is a working rule set drawn from the ICO, NHS England and GPhC documents above. It is not a list of approved products.

What should your messaging policy say?

Write it before the next inspection or the next complaint, whichever comes first. NHS England expects an organisation to have approved platforms, a DPIA for each, staff procedures and device controls. The GPhC expects the superintendent to be able to show that confidentiality is protected and that records exist. The checklist below turns those expectations into a one-page policy.

Key takeaways

FAQs