Lesson 7 · 18 min
The candidate you picked is not ready to go into the report yet. First, four questions: how much can it do on its own, what personal data passes through it, who answers if it makes a mistake, and whether the channel is the official WhatsApp. In a small business, WhatsApp sits in the middle of almost everything, and its rules changed in 2025 and 2026.
Start the lesson
Goal: check the chosen candidate for automation level, personal data, who answers if it makes a mistake, and WhatsApp rules before you recommend it.
The more risk and judgment involved, the lower the level. Click each one.
Showing where the person still approves answers the owner's fear before they ask.
Rules with dates and sources. This is not legal advice: when in doubt, consult a specialist.
A customer's name, phone number, and conversation are personal data. Health data is sensitive data (LGPD — Brazil's data protection law, Law 13.709/2018, art. 5, II): at a clinic, almost every patient message is sensitive.
Sensitive data can only be processed under the cases in art. 11, such as specific and highlighted consent. And the person can ask for human review of a decision made only by a machine (art. 20).
ANPD Resolution CD/ANPD No. 2/2022 simplifies obligations for micro and small businesses: simplified record-keeping (art. 9), data protection officer waived if there is a channel for the data subject (art. 11), and double deadlines (art. 14).
But anyone carrying out high-risk processing loses these simplifications (art. 3). High risk = one general criterion (large scale or significantly affecting rights) and one specific criterion, such as new technology or sensitive data (art. 4). AI reading patient messages can get there: confirm with a specialist before recommending it.
Since July 1, 2025, Meta charges for the WhatsApp Business API per delivered message, with a rate by category (marketing, utility, authentication, service) and by country; service messages have a free tier each month. Check the current rate table before estimating cost.
Free-form messages only within 24 hours after the customer wrote; outside that, only an approved template. And you only message people who agreed to receive messages.
Since January 15, 2026, the API terms prohibit general-purpose AI chatbots (an open assistant, like free conversation with a model) as the main function.
AI for service, scheduling, orders, and sales for the business itself is still allowed. Meta decides what counts as "main," so the assistant's scope must be the business, not chat about any topic.
A tool that connects to WhatsApp without being Meta's official API (or an official provider, that is, a company partner authorized by Meta) goes against WhatsApp's terms of use, and the company's number can be blocked. Don't recommend it. In the diagnosis, mark the channel as official or unofficial and, if it's unofficial, write down that risk.
One sheet for the candidate chosen in lesson 6. Replace what is between < > with your own.
# Risk checklist — <candidate> — <business> — <date> 1. Automation level: <1 / 2 / 3> Why: <what happens if it gets it wrong; who approves> 2. Personal data involved: - Types: <name, phone, conversation, health data, financial> - Is any of it sensitive (health, religion, biometrics...)? <yes/no: which> - Basis for processing: <consent / contract / other; confirm with a specialist> - Vendor that receives the data: <which tool; where it stores it; does it use it for training?> 3. Who answers if it gets it wrong: - Person: <name/role> - How the customer asks for a person: <word, button, hours> - Human review of automated decision: <how> 4. Channel: - WhatsApp: <official API / official provider / unofficial / not used> - Messages outside the 24-hour window? <yes/no: which templates> - Did the customer agree to receive messages? <how it was recorded> - Does the assistant stay within the business scope (not free conversation)? <yes/no> Conclusion: <recommend as is / recommend at level 1 / do not recommend now> — <reason> Sources checked on <date>: <links to the rules>
# Risk checklist — after-hours questions on WhatsApp — Clínica Vila Serena (fictional) 1. Level: 1 in the first weeks (the front desk approves in the morning the replies prepared at night) 2. Data: name, phone number, conversation; health data shows up (pain, surgery) → sensitive Basis for processing: specific consent from the patient or another case under art. 11; confirm with a specialist High risk (ANPD Res. 2/2022, art. 4)? assess with a specialist: there is sensitive data and new technology Vendor: <to be defined>; check where it stores data and whether it uses it for training 3. Who replies: the receptionist; the owner in exceptions; R02 calls the physical therapist 4. Channel: today it's regular WhatsApp on the front desk's phone; to automate, only the official API Scope: hours, insurance plans, initial assessment; no free-form conversation Conclusion: recommend at level 1, after writing the rules (lesson 5)
Platform rules change. Per-message pricing started on July 1, 2025 and the ban on general-purpose chatbots on January 15, 2026. Before each diagnosis, open the official pages (links at the end of the lesson) and note the date you checked.
Use the candidate recommended in your lesson 6 matrix.
Fill in the risk checklist for the recommended candidate at Vila Serena (fictional).
Done when: the 4 questions have answers, the channel is marked official or not, and the conclusion states the automation level with the reason.
Open the WhatsApp Business pricing page and Resolution CD/ANPD No. 2/2022 (links at the end) and note in the checklist the date you checked and whether anything changed.
Done when: the checklist has both sources with today's date and one "changed / did not change" line.
Question 1 of 4
An assistant will prepare payment reminder messages. What level does it start at?skill
Question 2 of 4
At a clinic, the message "I've had lower back pain since my surgery" is:skill
Question 3 of 4
What changed on WhatsApp Business on January 15, 2026?
Question 4 of 4
Since July 1, 2025, how does Meta charge for the WhatsApp Business API?
Pick an answer. The explanation shows up after you try.