Security, privacy and WhatsApp: frequently asked questions

Wazzy is built to work with patient data behind technical and organisational measures: encryption, access controls, traceability, backups and monitoring. The handling of that data sits inside the GDPR and whatever each clinic is obliged to do.

Yes. From the very start of the first exchange, Wazzy tells the patient they are talking to an artificial intelligence assistant.

It says so plainly, for example by introducing itself as the clinic’s AI assistant, which is what the transparency obligations of the European AI Act require.

As a general rule the clinic is the data controller.

That means it decides why and how its patients’ data is handled, and it carries whatever obligations the law puts on it.

As a general rule Wazzy acts as the data processor when it handles personal data on the clinic’s behalf.

The relationship is set out in the corresponding terms and agreements.

Yes. The relationship between the clinic and Wazzy includes the contractual documents needed to govern the processing of personal data on the clinic’s behalf.

Yes. The contractual paperwork covers the handling of health information and sets out the terms that apply to that kind of data.

Yes. The main infrastructure Wazzy uses to store your data sits in the European Union.

Wazzy also relies on third party services, such as WhatsApp and Meta, which run under their own terms and their own infrastructure.

No. Wazzy does not use clinic or patient data to train public artificial intelligence models.

No. Wazzy does not sell patient data as a product.

Yes. The clinic keeps control of the information it handles through Wazzy, and carries the responsibilities that come with being the data controller.

Yes. The clinic can export its data if it stops using Wazzy.

What happens to the data at the end of the service follows the contract, the clinic’s instructions and the law.

The clinic can ask to export its information before the service ends.

Yes. Wazzy has automated monitoring running 24/7, which raises alerts for the technical team when it spots something.

That does not mean somebody is watching the system by hand around the clock.

Wazzy keeps uptime above 99.9%.

Like any technology service, there can be the odd incident, and there are dependencies on outside services.

Yes. Wazzy uses encryption to protect information, both while it travels and for certain sensitive data at rest and in backups.

It depends on the users and permissions the clinic itself sets up.

Wazzy lets you set different levels of access for what each member of the team does.

Yes. The clinic can set different levels of access by role, and limit certain features or clinical information to the people allowed to see them.

Yes. The clinic can use permissions to keep clinical information to authorised users.

Yes. Wazzy keeps a trail of what users do on the platform and can tie it to the person who did it.

No. Internal access is limited to what running the service, fixing things or supporting a clinic requires, and it sits behind controls and confidentiality obligations.

Wazzy applies technical and organisational measures aimed at protecting the personal and clinical information it processes, including access controls, traceability, backups and monitoring.

These measures are there to reduce risk and protect information, although no technology can promise zero risk.

No. No technology can promise zero risk.

Wazzy applies security measures and procedures aimed at reducing risk and handling anything that does happen.

Wazzy has monitoring and technical procedures for spotting and handling incidents.

If an incident affects personal data, Wazzy handles it under the legal and contractual obligations that apply.

Yes. Wazzy provides the access controls and permissions; the clinic manages its own users, roles and internal access.

No. Wazzy does not use clinical data to diagnose, recommend treatments, or stand in for a practitioner’s judgement.

No. Wazzy is built to run on the official WhatsApp Business Platform infrastructure.

Yes. Wazzy operates as a Meta Tech Provider.

Not necessarily. Wazzy can work on the number the clinic already uses, as long as the technical conditions for connecting it to the official WhatsApp infrastructure are met.

Yes. Wazzy can use WhatsApp Business coexistence, so the clinic keeps using the WhatsApp Business app on the same number while the official infrastructure runs through Wazzy.

Yes. With coexistence switched on, the team can keep using WhatsApp Business within what the platform allows.

Yes. The team can step in from the Wazzy inbox whenever it wants to take over a conversation.

The team can take over whenever it wants.

Wazzy is built to work alongside people stepping in, and to keep the context of the conversation.

Because the patient should know from the start that they are dealing with an artificial intelligence system.

On top of that, the transparency obligations in article 50 of the European AI Act apply from 2 August 2026 to certain systems that deal with people directly.

Yes. The first message can give the patient a way to reach the clinic’s data protection information.

Not exactly.

Telling the patient they are dealing with an artificial intelligence system, and data protection obligations, are related but separate legal questions.

Putting data protection information within reach in the first message is a practical way of being clearer with the patient.

Yes. Conversations handled through Wazzy can be read from the inbox in the reception panel.

Yes. Conversations can be tied to the patient inside Wazzy, depending on the setup and the policies that apply.

Yes. The WhatsApp number is the main way a contact is recognised.

When several people share the same number, the medical CRM can use sub-records to tell them apart.

No. Using the official infrastructure cuts the risks that come with unauthorised workarounds, but the clinic is still subject to Meta’s policies and decisions.

Wazzy cannot promise a number will never be restricted.

Wazzy works within whatever terms apply on WhatsApp Business Platform at the time.

Meta’s rules and requirements can change.

Yes. Certain messages started by the clinic go through WhatsApp Business Platform templates, under Meta’s current rules.

Meta reviews the templates that need approval and checks they meet its policies.

Yes. Wazzy can help prepare what your clinic’s messages need, within the WhatsApp Business Platform rules.

Yes. Like any WhatsApp user, the patient keeps the controls the platform gives them, including blocking a contact.

Wazzy cannot stop them.

Yes. WhatsApp Business Platform can incur messaging costs, at Meta’s current rates and terms.

Meta bills the clinic directly for WhatsApp Business Platform costs.

The automated monitoring alerts the technical team so they can look into it and deal with it.

Not simply because WhatsApp is down.

The Wazzy schedule is separate from the WhatsApp channel, so an incident at Meta can hold up conversations or messages for a time without the booked appointments being affected.