How do you build an AI WhatsApp funnel for a clinic without losing patients or exposing health data?

An AI WhatsApp funnel for a clinic combines a landing page, a triage form, automatic replies, a dashboard that records every contact and follow-up reminders, so no message is left without an owner. The AI organizes, answers what is administrative and hands anything involving health to a person on the team, without diagnosing anything and without asking for more sensitive data than necessary.

Have you ever messaged a clinic on a Monday morning and only heard back on Wednesday, after you had already booked somewhere else? On the clinic's side, the scene is usually the same: one phone, many open chats, people asking about times, fees and insurance, and nobody knowing who answered what. This article shows how we design this funnel and which WhatsApp and LGPD rules change the project.

When we put together the AI WhatsApp funnel offer at DOUVRAS, we started from four concrete problems for anyone who serves clients by message: contacts get lost, replies are slow, the patient who asked for time to think is forgotten, and there is no funnel, meaning there is no way to know how many contacts became appointments.

None of these problems is a lack of AI. It is a lack of structure. The message arrives on a personal phone, is not recorded anywhere and depends on the memory of whoever was on chat duty. AI only helps once every contact has a clear path, which is why the project starts with the flow, not the bot.

In Blade Runner, Ridley Scott's 1982 film based on Philip K. Dick's novel Do Androids Dream of Electric Sheep?, the hunters use the Voight-Kampff test: a series of questions designed to tell replicants from humans by their emotional responses. In one of the film's best-remembered scenes, the replicant Leon shoots the examiner on the second question. The test exists to sort, not to cure anyone.

Triage in a clinic funnel plays the same role, with a much kinder goal. It asks the minimum needed to route the contact: which service the person is looking for, whether it is a first visit or a return, the best time and which channel they prefer. It does not ask about symptoms to judge severity, does not suggest treatment and does not say whether something is urgent. When the conversation turns to health, the AI's right answer is to call a person.

In our design, the minimum delivery has seven parts.

Landing page. One landing page per service or campaign, with clear information and a button that opens the WhatsApp chat already identifying where the person came from.

Triage form. A few fields, only the ones that help route and schedule.

Automatic replies. The AI answers administrative questions, such as address, opening hours, documents to bring and how to reschedule, based on answers approved by the clinic.

Contact dashboard. Every conversation becomes a record in a simple CRM, with a status: new, in progress, scheduled, no reply.

Follow-up reminder. Anyone who asked for time to think or did not reply goes into a follow-up queue, so the team can decide on the next contact.

Handoff to a human. Any clinical question, complaint or off-script request goes to a person, together with the conversation history.

Weekly report. How many contacts came in, where they came from and what stage they are at. This is what tells you whether a campaign brought people or just noise.

You can start with a link and a form, without heavy integration, and move to the official WhatsApp Business API when the volume calls for it.

The WhatsApp Business Messaging Policy has rules that directly affect a clinic funnel.

Only message people who asked. A business may only contact a person on WhatsApp if they gave their number and opted in to receive messages. The policy also recommends getting separate opt-in by message category and explaining how to opt out.

The 24-hour window. Outside the 24-hour customer service window, a business may only send messages using approved message templates. This changes the follow-up reminder: it needs to be an approved template, short and respectful, not free text generated on the spot by the AI.

Automation with a way out to a person. The policy allows automation within the 24-hour window, but requires prompt, clear and direct escalation paths, such as transfer to a human agent in the conversation, phone, email or support on the website.

Health information. The policy says not to use WhatsApp for telemedicine or to send or request health information if applicable law prohibits that information from passing through systems that do not meet the requirements to process it. In practice, the funnel stays administrative, and clinical matters go to the channel the clinic defines with its advisors.

Brazil's LGPD, the general data protection law, defines in art. 5, II, that health data is sensitive personal data, and art. 11 limits the cases in which this kind of data may be processed. Art. 6, III, requires processing to be limited to the minimum necessary, and art. 46 requires security measures from the design of the service onward.

For the funnel, this turns into design decisions. The form does not ask for symptoms, tests or diagnoses. The AI is instructed not to bring up the subject and to hand off when the patient raises it on their own. The dashboard shows each team member only what they need to see. And the automatic replies come from a knowledge base approved by the clinic, with a declared origin. The legal basis and the consent wording are defined by the clinic with its legal advisors; our role is to build the system so that these rules actually work.

The DOUVRAS clinics and aesthetics page sums up the goal: turning attention into organized customer journeys without improper clinical or commercial claims.

It can: answer administrative questions with approved text, collect scheduling details, record the conversation in the dashboard, suggest available times and remind the team who is waiting for a reply.

It cannot: tell people what they have, recommend treatment, promise the results of a procedure, decide whether something is urgent or keep messaging someone who no longer wants messages.

This separation is what makes the assistant auditable. Every automatic reply has a source, every handoff to a human is logged, and there is a clear criterion for switching the automation off if it starts getting things wrong.

Can the AI answer questions about symptoms? No. In our design, any clinical question goes to a person on the team. The AI handles the administrative side and keeps the queue organized.

Do I need the official WhatsApp API to get started? Not necessarily. You can start with a page, a link and a form, and move to the official WhatsApp Business API when volume and integration needs justify it.

Does it work for a small practice with only one person handling messages? Yes, and it may make even more of a difference, because that is exactly where messages get lost most. The size of the project follows the operation.

DOUVRAS Labs builds this funnel by combining three fronts: websites and landing pages for the entry point, automation and integrations to connect the form, WhatsApp, CRM and reminders with logs and alerts, and AI agents and assistants for the automatic replies, with a knowledge base of declared origin, tests and a human escalation flow. We have already delivered, for example, the Adrielle Beauty landing page, for beauty services and contact capture, and NeuroAvalia, a platform for organizing assessment workflows in clinical and educational settings.

And at your clinic, if someone sends a message right now, do you know who will answer, how fast, and where that conversation is recorded?

Douglas Henrique, DOUVRAS Labs.

WhatsApp. WhatsApp Business Messaging Policy. business.whatsapp.com

Brazil. Law No. 13,709 of August 14, 2018 (General Personal Data Protection Law, LGPD), arts. 5, 6, 11 and 46. planalto.gov.br

Scott, Ridley (dir.). Blade Runner. Warner Bros., 1982. Based on Dick, Philip K. Do Androids Dream of Electric Sheep?, 1968. wikipedia.org

DOUVRAS Labs. Clinics and aesthetics. douvras.com