UK Opticians 2026: 5 GOC + PECR Checkpoints Before WhatsApp Automation

For a very small practice sending fewer than a handful of messages a week to individual named patients from a single device, the app can be a starting point. It becomes unsuitable as soon as the practice needs automated sends, message archiving to the patient record, a data processing agreement covering health data, or evidence for an ICO or DSPT audit. Most practices doing recall and appointment reminders at scale will need the Cloud API accessed through a Business Solution Provider.

No — a reminder that a booked appointment is coming up is a service message under the ICO's 2021 Direct Marketing Code, not direct marketing. It does not need PECR opt-in. However it does still need a lawful basis under UK GDPR Article 6 and, because it processes health data, an Article 9 condition. Marketing messages — anything promoting something the patient has not asked for — do need PECR opt-in that is separate from any general consent line.

No. End-to-end encryption addresses transport confidentiality between the sender's and recipient's devices. The Data Security and Protection Toolkit covers the practice's whole processing environment — the practice management system, the BSP, the archive of messages, the consent records, staff access controls, and the incident-reporting workflow. A practice cannot rely on Meta's encryption to short-circuit the DSPT self-assessment if it does NHS-funded work.

No. The General Optical Council's Standards of Practice and the Association of Optometrists' clinical guidance both make clear that clinical assessment is the responsibility of a registered practitioner. A WhatsApp automation may confirm appointments, notify that spectacles are ready, or capture a booking request, but any inbound message describing symptoms — particularly sudden vision loss, pain, flashes and floaters, or trauma — must be escalated to a human immediately and, where the presentation could be sight-threatening, the automation should direct the patient to phone the practice or attend a local eye casualty service.

The starting point is GOC Standard 11 on record-keeping, which requires records to be accurate and retained for as long as they may be needed. For adult patients, the widely-followed convention in optical practice (mirroring NHS guidance) is a minimum of 10 years after the last consultation; for patients seen as children, until the patient's 25th birthday or 10 years after the last consultation, whichever is later. WhatsApp messages that form part of the patient record inherit this retention obligation. A separate, shorter retention applies to marketing-consent audit logs — typically retained for the duration the consent is relied on plus a limitation period.