A WhatsApp message reaches a clinic: “Can I book Thursday for my mother?” Reception creates the appointment under the sender's name, then replies with details of the mother's previous visit. Two different things went wrong: the patient identity was confused with the contact identity, and private information was disclosed without checking the recipient's authority.
The practical rule: a WhatsApp number identifies a contact channel, not necessarily the patient. Keep the patient record separate from the person arranging the appointment, and keep appointment confirmation separate from medical disclosure.
Start with the appointment, not a medical questionnaire
When someone is booking for a parent, partner or child, answer the practical scheduling question first. Then ask only what the booking process needs: Who is the appointment for? Is the sender the patient or helping them? What name should the appointment use? How will the clinic confirm details with the patient or an authorized representative?
Do not ask for a diagnosis or laboratory reports in an open chat merely because someone requested an appointment. If the specialty needs health information before a visit, use the clinic's approved secure channel and procedure. This is operational guidance, not a universal legal ruling.
Two people may need two separate records
The patient owns the appointment and medical record. The booking contact is the person asking for a slot or receiving an appropriately limited reminder. They may be the same person, but not always. Never merge identities just because they share a phone number. Family relationship alone is not proof that the sender can receive visit history or test results.
Consider a daughter booking a follow-up visit for her mother. The team may collect the minimum booking details allowed by clinic policy. But sharing treatment details, results or prior appointments requires checking the recipient's authority and the applicable privacy rules. The World Health Organization emphasizes protecting patient information against unauthorized access. This is an international confidentiality principle, not a statement of Egyptian law.
Three messages with different risk levels
General inquiry: “What are the dermatologist's hours?” This can be answered from approved public clinic information.
Booking request: “Book Tuesday for my brother.” This needs minimum necessary identifiers and a clear contact arrangement.
Medical disclosure request: “Send me my brother's test result.” This should not follow the routine booking script. Stop automated disclosure and hand the case to an authorized staff member who follows verification procedures. For comparison, the UK Information Commissioner's Office guidance discusses verifying the authority of someone requesting information on another person's behalf in a UK rights-of-access context. It is foreign guidance, not an Egyptian legal requirement.
A small reception scenario
Someone writes, “I'd like to book for my father.” The assistant can explain approved appointment availability, clarify who the patient is, and collect only booking fields the clinic permits. If the sender asks to change an earlier treatment plan or access the father's record, the normal booking flow stops and an authorized employee takes over. Before a reminder is sent, the team checks whether that number is allowed to receive it and how much detail it may contain.
Test the workflow for children, older patients and patients without their own phone. Do not assume one authorization process fits every case. The clinic should review its policy and relevant Egyptian rules with qualified advisers.
Where AI can help, and where it must stop
Mr. AI's published product information describes knowledge-based replies, follow-up, conversation summaries and human handover. A clinic can prepare reception questions and escalation rules for sensitive cases. This does not establish that Mr. AI verifies medical identity, accesses patient records or automatically manages a medical chart. Any clinical-system integration and permissions require separate verification.
To start, review ten bookings made for someone else after removing personal identifiers. Did the patient have a separate identity from the WhatsApp sender? Was any private detail shared with the wrong contact? Was there a clear escalation point? Read our clinic confirmation and rescheduling guide, then test your reception flow with staff.
