In most Egyptian clinics, work happens on WhatsApp. Reception answers patients from their own phone, the doctor sends a prescription or a lab result from a personal number, and the staff group fills up with photos of reports and scans. It is fast and easy, and nearly every clinic does it.
The problem is that all of it is health data, and Egyptian law treats health data as sensitive. This post covers what Personal Data Protection Law No. 151 of 2020 says on the subject, why casual WhatsApp use creates risk, and how to fix it in your clinic in a few practical steps.
What the law says about patient data
Law 151 of 2020 is Egypt's first comprehensive data protection law, and it took effect in October 2020. According to PwC's summary, it prohibits processing personal data without the person's explicit consent, and gives people rights such as restricting access to their data, withdrawing earlier consent, and being told if their data is breached.
What matters most for us: the law classes data that reveals physical or mental health as sensitive, and data about children is sensitive in all cases. So a patient file in a pediatric or dermatology clinic is not just paperwork. It sits under stricter rules. According to a Nilex Digital Systems guide, the 2025 executive regulations set tighter conditions for health data, including explicit written consent.
Why personal phones are the weak spot
A research paper on WhatsApp use for professional medical communication in Egyptian hospitals concluded that relying on unmanaged informal tools can undermine digital health efforts and create problems with legal and ethical standards, including Law 151. That was about hospitals, but the logic applies just as well to a clinic with three staff.
Here is what it looks like on a normal day:
- A staff member leaves: the chats and photos stay on their phone, and you cannot shut off their access.
- A phone is lost or sold: it holds prescriptions, lab results and patient numbers.
- The doctor's personal number: patients message it, and the clinic has no record. If the doctor is away, nobody knows where a conversation stands.
- The staff group: one patient's result goes to ten people when only two need it.
Fix it in 5 steps
You do not have to drop WhatsApp, because your patients are on it. The goal is to move it from individual phones to something the clinic owns and controls.
- One clinic number: a WhatsApp Business number that belongs to the clinic, not to an employee. With several branches, one number per branch.
- Who sees what: reception sees bookings, doctors see their own patients, the owner sees the money. Write it down, even if you have no system for it yet.
- Fast access removal: when someone leaves, you should be able to cut their access in minutes, not wait for them to delete things.
- Patient consent: tell patients the clinic will send prescriptions and results on WhatsApp, and get their agreement. The registration form or the first message is the natural place.
- A rule for groups: no patient data in large groups. If you must, use a name and one piece of information only.
How this works in Kashfy
Kashfy is built around the same idea. The clinic connects its own WhatsApp Business number on Meta's official Cloud API, and there is no shared Kashfy number. Every chat lands in one inbox and is logged on the patient's profile, so nobody has to dig through a phone.
Access follows roles. On the Team and Roles page you will see that reception can book without seeing revenue reports, and doctors read their own notes. When someone leaves, the owner removes them once and access is cut on every branch and device. An audit trail shows who did what and when.
Patients who ask for their file see a PIN-protected page with their visits, prescriptions and results, without the doctor's private notes. You can also export a full PDF of a patient's history. Details are on the Patients and Medical Records page.
The limits
No tool makes a clinic compliant on its own. Consent, how paper files are stored, and how your team handles data are still the clinic's job. For specific legal questions about the executive regulations, talk to a lawyer who works in this area. And Kashfy does not supply a WhatsApp number: the clinic connects its own.
