Acceptable use policy

Version 1.0, in force from 11 November 2026

This policy forms part of the terms of service. A practice is responsible for making sure everyone who signs in on its behalf follows it.

Messaging patients

A practice uses Hello to message its own patients and people who have contacted it, and nobody else. It does not upload bought, borrowed or scraped lists of numbers, message people who have not given the practice their number, or keep messaging someone who has asked it to stop. It sends promotional messages, including recalls, review requests and birthday greetings, only to patients who may lawfully receive them under section 69 of POPIA. It follows the WhatsApp Business Messaging Policy and Meta's Commerce Policy.

What messages say

Messages are truthful, professional and in line with the practice's professional council's rules on advertising, canvassing and testimonials. A message that may appear on a patient's lock screen says no more about their health than it needs to. Messages never contain identity numbers, medical aid numbers, results or diagnoses unless the patient has asked to receive them that way and the practice has judged it appropriate. Nothing sent through Hello is offensive, misleading, defamatory or unlawful.

Emergencies

Hello is not monitored for emergencies and must never be presented to patients as a way to get urgent help. A practice tells its patients where to go in an emergency.

Sign-ins and access

Every person signs in with their own email and never shares a sign-in. Access is given only to people who work for the practice and removed the day they leave. No one tries to see information their role does not allow, another practice's information, or any part of Hello's systems they have not been given.

The service itself

No one may copy, resell or reverse-engineer Hello or its message libraries, probe or load-test it, bypass its limits or safety checks, run automated tools against it, or introduce anything harmful. Someone who believes they have found a security weakness reports it as our security page describes, and does nothing further.

Connected systems

A practice connects only systems it is entitled to use, with credentials it is entitled to give, and only through the routes Hello offers: an API key, or the calendar link the provider itself generates.

If this policy is broken

We may hold messages, pause a practice's sending or suspend a user while we look into a breach, and will tell the practice why. Serious or repeated breaches may end the practice's subscription under clause 14 of the terms of service. Where Meta restricts a number because of how it was used, the practice bears the consequences.