AI for clinics and aesthetics practices, South Africa
A practice can use an AI assistant. Where it stops is the whole answer.
Health is one of the verticals Meta excludes from its own business agent platform, and information about a patient is confidential in South African law long before any platform's terms come into it. Neither fact stops an assistant answering the enquiry nobody could get to, booking into your diary, taking a deposit and collecting intake. This page is about where the line sits, and about what is genuinely not settled.
Written for the practice manager, not the compliance officer. The regulatory part is two sections and it is short. The rest of the page is the front desk.
online, replies in seconds
Hi, is there anything open for a consultation this week?20:47
There is. Thursday 09:20 or Friday 14:40 are both open for a first consultation.20:47
Thursday 09:20Held for you. The practice asks for a deposit to confirm it, and it comes off the consultation fee. Here is the link, and I will send the intake questions once it is paid.20:48
An illustration of the pattern. The times come out of the practice's own diary, the server checks the slot is still free before it is offered, and the deposit is the practice's to set.
The first question, answered carefully
Meta's own eligibility rules exclude health.
Every practice that asks us about this has heard some version of it, usually second hand and usually overstated. So here is the document itself, quoted rather than summarised, and then the part that gets left out.
all verticals are supported except Finance, Government, Health, Alcohol, Gambling, over-the-counter drugs, and matrimony servicesMeta, Business Agent eligibility documentation, updated 28 August 2026. Read the page yourself
Health is on that list. What the sentence does not do is settle every practice's position, because the same page scopes itself to accounts managed through the WhatsApp Business Platform, where the account uses the Cloud API rather than the WhatsApp Business app. Whether the same vertical exclusions bind the free in-app version is not documented anywhere we have been able to find.
So the honest position is the narrow one. Meta's published eligibility rules exclude health from its business agent platform, the page is linked above, and a practice should read it and check its own position against it rather than take our word for it or anybody else's.
What is settled
Meta Business Agent is live in South Africa, so availability is not the question for a practice. Eligibility is. Health sits on Meta's own published exclusion list, and that is the line that decides it, not the price.
What is not documented
Whether the free WhatsApp Business app carries the same vertical exclusions as the platform that eligibility page describes. If somebody tells you it definitely does, or definitely does not, ask them where that is written.
The licence, which is the material part
Meta's Business Agents Terms of Service take a perpetual, worldwide licence to conversation content that survives termination, and Meta's help centre says collection continues even when the agent is muted. For a practice whose conversations may carry health information, that is the fact to weigh.
Confidentiality
The part no platform's terms can change.
This is the argument that does not depend on Meta at all, and it is the one worth understanding properly, because it is also the reason a practice cannot simply run its enquiries through whichever assistant is cheapest this month.
Nothing on this page is legal advice or medical advice. It is a plain summary of published rules, written so that a practice manager can ask better questions. Take your own advice on your own position.
National Health Act, section 14(1)
Information about a user's health status, treatment or stay in a health establishment is confidential. Disclosing it needs the user's written consent, or a court order, or the situation where not disclosing poses a serious threat to public health. That sits above any supplier's terms and no supplier can vary it.
POPIA treats health as special
POPIA lists health as special personal information, a narrow defined category that also covers race, religion, biometrics and criminal behaviour. Financial information is not in that category. Health is. Processing special personal information is prohibited unless a specific exception applies.
Together those say something quite specific. The question is not whether software may touch a patient's information at all. It is what the practice collects, what it tells the patient, what it has agreed in writing with everyone who handles that information afterwards, and whether anybody can actually answer those three when asked. Compliance is a property of how a practice operates. No product is compliant on its own, and ours is not either.
The part that pays for itself
The phone rings while you are with a patient.
Set the regulation aside for a moment, because it is not why a practice buys this. The reasons are far more ordinary, and they are much the same in a dental practice, an aesthetics clinic and a physio room: the enquiry that arrives while the practitioner is in with somebody, the slot that empties at nine on a Tuesday because a patient forgot, the intake form filled in badly in the waiting room, and the annual recall nobody has time to chase.
Nobody gets to the phone
An enquiry that rings out at 16:20 is not a patient who waits. They phone the next practice on the list. An assistant answers on the channel they already used, in the same minute, and either books them or hands the conversation to your team with everything already asked.
A no-show costs the whole slot
It is the most expensive thing that happens in a diary and it happens quietly. A deposit at the point of booking reduces it, and a reminder on the channel the patient actually reads catches more of the rest. Neither needs anybody at the desk to remember.
Recalls never get chased
The six month check, the annual review, the follow up that was meant to happen. Everybody intends to do it, and it is the first thing to fall off a busy desk. A scheduled message on the interval you set is the cheapest way to stop losing them.
Intake, before they arrive
Asked in the chat, not in the waiting room.
A new patient has to give you a set of details before the appointment is worth much. Done at reception it eats the first ten minutes of the slot, and some of it comes back illegible. Done in the conversation that booked them, it is typed by the patient, it arrives before they do, and it is attached to the appointment your team already has open.
The practice decides what is asked and how it is worded. The assistant asks it, records the answer in the patient's own words, and never invents a field or an answer nobody gave. Somebody who would rather not answer a question in a chat is recorded as having declined it, not guessed at, and your team picks it up in the room.
Ask for less than you think you need, tell the patient what happens to it, and keep the clinical detail for the consultation.
online, replies in seconds
Thursday 09:20 is confirmed. Two quick things the practice needs before you come in. What name should the file be in?20:52
Nomsa Dube20:53
Thank you. And is this on a medical aid, or a private consultation?20:53
Private for now20:54
Noted, and that is everything from my side. You will get a reminder the day before.20:54
An illustration. The questions are the practice's own wording, and the answers are stored as the patient typed them.
One enquiry, end to end
What happens between the message and the chair.
This is a real sequence rather than a feature list, which is why it is numbered. Every step is something the server did and can show you afterwards, not something the assistant said it would do.
- The enquiry arrives, at any hour On WhatsApp or on the practice's own website, as one conversation, so somebody who starts on the site and carries on over WhatsApp is not made to begin again.
- Times come out of the real diary Availability is read from the practice's own calendar, per practitioner and per treatment length. Two people tapping the same 09:20 in the same second is settled by the database, and the second one is offered the next time immediately.
- A deposit holds it A payment link into the practice's own account, or bank details with a reference. An unpaid hold releases the slot again, so the diary is never blocked by somebody who changed their mind.
- Intake is collected in the chat The practice's own questions, answered before the appointment, attached to it, in the patient's own words.
- A reminder goes out On the channel they already used, at the interval the practice sets, with a move or a cancellation handled in the same conversation rather than by another phone call.
- The recall comes round Months later, on the same thread and in the same voice, because it is a scheduled message rather than somebody remembering. It is the cheapest appointment a practice ever books and the one most often left unbooked.
Where it stops
It books. It does not advise.
An assistant in front of a practice's patients must never give medical advice, never discuss symptoms diagnostically, and never recommend a treatment. It books, reminds, collects and hands off. That is the whole job description, and everything else on this page depends on it holding.
In our build that is a design principle rather than a feature with a switch. The refusal is written into the assistant, and a question reaching for clinical ground is handed to a person with the whole conversation attached, so nobody has to ask the patient to start again. A patient who wants to know whether something is normal is asking a practitioner, whatever channel they happened to type it into.
The same rule is what keeps the confidentiality question manageable. An assistant collecting a name, a slot and a medical aid answer is doing administration. An assistant drawn into a conversation about symptoms is doing something else entirely, and no amount of careful hosting makes that a good idea.
online, replies in seconds
Quick question, is it normal for it to still be swollen on day four? Should I take something for it?07:12
That is one for the practice rather than for me. I am not able to give clinical advice, so I have flagged this now and somebody will come back to you this morning. If it is urgent, please phone the rooms.07:12
Would you like me to put you in for the first opening today while you wait to hear back?07:12
An illustration. The hand off files the whole conversation and alerts the team, and the assistant can be paused while a person takes the thread over.
- It never answers a clinical question Not symptoms, not dosage, not whether a result is normal, not whether a treatment is right for somebody. Those go to a person qualified to answer them.
- It never pretends to be a person It says what it is when it is asked. A patient who works it out for themselves, later, has already stopped trusting the practice.
- It never promises what the server cannot show If it says a slot is held, a deposit is received or a reminder is set, there is a record behind it. It does not say reassuring things.
- It never carries one patient into another conversation Each practice runs on its own instance with its own database, and a conversation belongs to the person who had it.
Before you sign anything
Five questions worth asking whoever you buy from.
Including us. If a supplier cannot answer these in writing, that is itself the answer. None of them needs a lawyer to ask, and the vague reply tells you more than the confident one.
- Which product is this, exactly? Is the assistant Meta's own business agent, or software running on our own WhatsApp Business number? Show me where the eligibility rules that apply to it are published.
- What licence does anyone take over our conversations? What rights does the platform take over the content, do they survive us leaving, and does anything keep collecting while the assistant is switched off?
- Where do the records live and who can read them? Which country, which company, which staff, and what is written down about moving any of it across the border.
- What happens when a patient describes a symptom? Show me the actual reply. If the answer is a paragraph about model safety rather than a screenshot of a real conversation, ask again.
- What can we take with us, and what gets deleted? Can we export every conversation and have it erased on request, and how long is it kept if we do nothing.
FAQ
Fair questions.
So can a South African clinic use a WhatsApp assistant?
We cannot answer that for your practice, and anybody who answers it in one sentence is guessing. What we can set out is what is published: Meta's eligibility documentation excludes Health from its business agent platform, the National Health Act makes information about a user's health status, treatment or stay in a health establishment confidential and requires written consent to disclose it, and POPIA treats health as special personal information that may not be processed unless a specific exception applies. Read those, then take your own advice on your own position.
Does that exclusion apply to the free WhatsApp Business app?
It is not documented, so we will not tell you either way. The eligibility page scopes itself to accounts managed through the WhatsApp Business Platform, using the Cloud API rather than the app. We have found nothing published that says whether the same vertical exclusions reach the app. That is a real gap rather than a technicality, and it is worth putting to Meta or to your own advisor rather than to a salesperson.
Does patient information have to stay in South Africa?
No. POPIA has no data-localisation requirement, and section 72 permits transfer across the border under a binding agreement. We host each practice's records in Johannesburg because it is a sensible default and it is where our infrastructure is, not because the law demands it. We do not claim your data never leaves the country: replies are generated by an AI provider outside South Africa, under terms that say content is not used to train their models.
Is IndunAI POPIA compliant?
No product is, ours included. Compliance is a property of how a practice operates: what it collects, what it tells patients, what it has agreed with its suppliers, and what it does when somebody asks for their information. A product can make that easier or harder, and we will tell you in writing what ours does and does not do so that your own answer can be an honest one.
Will it answer a patient's medical question?
No. Clinical advice is refused by design: no symptoms discussed diagnostically, no dosage, no view on whether a treatment suits somebody. The question goes to a person with the conversation attached, and your team is alerted. If that boundary is not absolute, everything else on this page falls over.
Can it take deposits?
Yes, into the practice's own account, either through a payment link or with your bank details and a reference. A card payment is confirmed when the gateway confirms it, and a proof of payment for an electronic transfer goes to you, because you are the only person who can see your bank account. An unpaid hold releases the slot again.
What does it cost, and how long does setup take?
Talk to us, because a practice with several practitioners, different treatment lengths and a deposit rule is a different setup from a single room. What we will not do is put a number on this page before knowing what the diary looks like. You get the scope and the price in writing before anything is built.
Where we come into it
What we can say about our own build, plainly.
Each practice runs on its own isolated instance with its own database, not a row in a shared table. Records are hosted in Johannesburg. Conversations are not used to train models. It books into the real diary, takes deposits, sends reminders and collects intake, and clinical advice is refused by design. What we will not tell you is that your data never leaves South Africa, because replies are generated offshore, or that any of this makes a practice compliant, because that is not something a product can be.
Ask us the hard versionWhich leaves a practice in a straightforward position. The free agent inside WhatsApp is not available to you, so the choice was never IndunAI against Meta. It is an assistant built for a practice, or a front desk carrying it by hand.
That is what we build. Enquiries answered on WhatsApp and on your website, appointments into your real diary with a deposit held, reminders and recalls sent, and a hard boundary the assistant will not cross: no diagnosis, no dosage, no clinical advice, and anything close to it goes to a person. Your patients' messages stay on a server in Johannesburg under your own POPIA notice, and are never used to train anybody's model.
Tell us what your front desk is drowning in.
A paragraph is enough: how the enquiries arrive, what happens to the ones nobody gets to, and what the no-shows are doing to the diary. You will get a straight answer, including the answer that this is not worth doing yet.
The rest of the plain-English guides, written the same way: what is documented, what is not, and how to check it yourself.