WhatsApp alternative for care homes

Why care homes look for an alternative

Regulation 17(2) of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 requires a registered provider to “maintain securely an accurate, complete and contemporaneous record in respect of each service user” and “such other records as are necessary to be kept in relation to” the “persons employed in the carrying on of the regulated activity” and “the management of the regulated activity”. CQC’s guidance on what good digital social care records look like says Regulation 17 “applies to paper and digital records”.

These rules apply to every registered care home, with or without nursing. They apply to those records wherever they are first made, including in an instant message, and a staff WhatsApp group makes them hard to meet, through no fault of the people in it:

• The provider does not hold the messages. In an end-to-end encrypted consumer app, messages are held on the phones of the people in the conversation. The provider cannot search them, keep them to its own schedule or produce them when a family, a safeguarding enquiry or an inspector asks what was known and when.
• Residents’ health information is on personal phones. It is “data concerning health” under Article 9 of the UK GDPR, and the provider is the controller for it wherever it sits. A photograph of a pressure area in a carer’s camera roll is a data protection question as well as a dignity one.
• Everyone sees everything. The Caldicott principles ask for “the minimum necessary” and access “on a strict need-to-know basis”. One group for every shift and role fails both by design.
• Leavers take the history with them. Removing a carer from the group does not remove years of messages from her phone.
• Every member’s number is shared with every other member, including bank and agency staff who joined for one shift.
• Work and home blur. The rota, a resident’s fall and a family photograph arrive in the same consumer messaging app, which makes professional boundaries harder to keep and pressures staff to answer on days off.

Our guide to care home staff WhatsApp groups covers the rules in detail and what a staff policy should say. This guide is about the replacement.

The alternatives, and what each is for

Four kinds of product are offered as a WhatsApp alternative for care homes, and they answer different questions:

• The messaging inside your care management system. Many digital social care record products include messaging in their mobile app. If every carer uses it and the messages are kept with the care record, start there: it may be all you need. Check whether bank and agency staff can use it, and whether it reaches the manager on call at night.
• Office software you already pay for. If staff have Microsoft 365 or Google Workspace accounts, the chat that comes with them is managed by the provider. Most care workers do not have one, which is usually why the WhatsApp group started.
• A secure staff messaging tool. Built for health and care teams without desks: channels the provider controls, people added by mobile number, removal on the day someone leaves. The checks below separate the ones that keep a record from the ones that only look like they do.
• An end-to-end encrypted messenger sold to organisations. Strong confidentiality, with the same trade-off as WhatsApp: the provider holds a copy only if the product adds an archive or someone exports it.

Family communication is a separate decision. A family portal or a private line for relatives answers different questions from a staff group, and mixing relatives into a staff group is the one arrangement every option should end. Our guide to staff communication apps for care homes compares the product types in more depth.

Check one: does the provider hold the record?

This is the test WhatsApp fails, so it is the first one to put to any replacement, and the one with the most legal risk if it is skipped. Ask the supplier, in writing:

1. Where is the record made? A record captured on the provider’s side as each message is sent survives a lost, broken or wiped phone; one that depends on collecting handsets afterwards fails when it is needed.
2. Who controls membership? The provider should be able to add people, decide who sees which channel, and remove a leaver from every conversation on their last shift.
3. Who sets retention? The provider’s retention schedule, not the app’s default, should decide how long messages are kept.
4. Can the provider find and export a conversation? A subject access request from a resident, their attorney or a member of staff covers work messages about them, must normally be answered within one month, and the ICO’s right of access guidance makes clear that it includes information held in emails and messages.
5. Can a message be changed or deleted without trace? An edit history matters for anything that may become evidence.
6. Is everyone told? Staff accept a work channel that is on the record when they are told plainly at the start. A channel that is quietly kept is a different thing.
7. What happens if we stop paying? Ask how the record is returned, in what format, and how long the supplier keeps it.

Then decide the rule that links messages to the care record: a fall, a refused medicine or a safeguarding concern is written into the care record, and the message stays as the evidence of how it was first reported.

Check two: the people, the data and the night shift

A replacement that leaves out the people WhatsApp included will not replace it, and staff communication will drift back to the old group. Test it against the team you actually have:

• Bank and agency staff. Can they be added on their first shift without a work email account, and removed at the end of it?
• Night staff and the manager on call. Does a message at three in the morning reach the right person, and can that person act on it from a phone?
• Personal phones. Most carers will use their own. Require a tool that keeps work messages separate from personal apps, can be signed out remotely, and does not leave photographs of residents in the phone’s own camera roll.
• Relatives. If the tool also carries conversations with families, each family should have its own private conversation with the home, with the approved contacts your own policies decide, and staff numbers should stay private.
• Working hours. Can staff silence notifications when they are off shift, so the group that once pinged at midnight does not follow them into the new tool?

A supplier that holds messages for the provider is a processor, and Article 28 of the UK GDPR requires a written contract covering security, sub-processors and deletion. Read where each sub-processor handles data, not only where messages are stored. Do a data protection impact assessment: the ICO’s guidance on when to do a DPIA lists “sensitive data or data of a highly personal nature” and “data concerning vulnerable data subjects” among its indicators, and says “in most cases, a combination of two of these factors indicates the need for a DPIA”. A care home messaging tool has both. If the home has access to NHS patient data or systems, the Data Security and Protection Toolkit also applies, and its site says “all organisations that have access to NHS patient data and systems must use this toolkit”.

Check three: can you make the switch stick?

The commonest way a WhatsApp alternative fails is not information security but implementation: the old group carries on beside it. Within a month the care home has two systems, and the important messages are in the one it does not control. Plan the switch as carefully as the purchase:

1. Choose with the seniors who run the current group. They know what it is used for. Pilot the tool on one unit or one shift pattern with them before deciding.
2. Give every job a home. Rota changes, handover, the manager on call, maintenance, family visits: name the channel for each, so staff are told where to go, not only where not to.
3. Set a closing date for the old group and keep to it. Ask the administrator to post the date, then close it.
4. Decide what happens to the old messages. Changing tools does not move them. Anything that should be in the care record or an investigation has to be dealt with through your own records process, under your retention policy.
5. Count the full cost. Per user, per site or flat; set-up and training; and whether the tool needs anything the home does not have, such as particular office software.
6. Review it after three months. Ask staff what still goes elsewhere and why. Each answer is a risk to close, and a sign of what the tool must do better for the quality of care, not only for compliance.

Test the result with one ordinary night: at twenty to three a night carer finds a resident on the floor, uninjured, and wants to tell the senior on the other unit and the manager on call. Which channel does she use, where is the first record made, and how does the day team know by eight? If the answer is still “the WhatsApp group”, the switch has not happened yet.

Where ComplyChat fits, and where it does not

Start with what it is not. ComplyChat is not a care-record system, safeguarding case management or an emergency route: formal care records and urgent escalation stay in your established systems and procedures. There is no integration with Microsoft Planner, To Do or Shifts, and it does not connect directly to care management software. If your care management system’s messaging already reaches everyone, including bank staff, start there.

ComplyChat replaces the staff WhatsApp group with channels the provider controls. A mobile number verified by SMS is the identity, so bank and agency carers without a work email can be added by mobile number, and on paid plans removing someone from your organisation also signs them out and removes their passkeys. Everyone added to a channel is told it is on the record and can object or leave, and messages are written into the record as they are sent, not gathered from phones afterwards. Tasks with a due time and updates people confirm show who has still to act, and the person doing a task doesn’t need a Microsoft 365 licence. Each person can choose the days and hours they work, so notifications stay quiet outside them. On paid plans, relatives your service approves join a private family line by texted invitation, and each gets their own private thread, with phone numbers private from other members.

ComplyChat cannot read or retrieve anything from staff members’ existing WhatsApp groups; it replaces the group, it does not import it. On a connected paid plan, conversations are kept in the provider’s own Microsoft 365 subscription, under the retention schedules it already runs, and the filed archive stays there if you leave. That needs the provider’s own Microsoft 365. Core messages are stored and processed in the UK, and the supporting services that may process data elsewhere are named on the service providers and locations page. ComplyChat is working towards Cyber Essentials and ISO 27001 certification and holds neither yet; our Why us page says so.

Prices are flat per tier. Foundation: £199/month or £1,990/year, 2 channels. Governance: £599/month or £5,990/year, 10 channels. Enterprise: from £1,500/month or from £18,000/year, unlimited channels. Yearly plans are invoiced in advance. All prices exclude VAT where applicable. No per-person or per-message charges. Setup included. Free is for personal conversations: one private group channel, direct messages and up to 25 people, three calendar months of recent history and no Microsoft 365 archive or Replay, so it is not a way to keep the home’s record. If your organisation needs to meet its retention schedules, that needs a paid plan and your own connected Microsoft 365 subscription.

Whatever you choose, take one question to the next managers’ meeting: if a family asked tomorrow what staff said about their mother on the night she fell, where would the home look, and who would it have to ask?

Questions people ask

What is the best WhatsApp alternative for care homes?

The best WhatsApp alternative for a care home is a messaging tool the provider controls and holds the record of, because Regulation 17 requires a registered provider to “maintain securely an accurate, complete and contemporaneous record in respect of each service user”. Test any candidate on whether the provider can search, retain and produce messages, remove leavers on the day, and include bank and agency staff.

Can care home staff use WhatsApp for work?

No law names a messaging app, but the provider stays responsible for what is said in it: residents’ health information is special category data under Article 9 of the UK GDPR, and the provider is its controller wherever it is held. A group on personal phones that the provider cannot control, search, retain or remove leavers from makes those duties hard to meet, which is why many homes move staff messaging to a tool they control.

Do care homes need the Data Security and Protection Toolkit?

A care home must complete the Data Security and Protection Toolkit if it has access to NHS patient data or systems: the toolkit’s website says “all organisations that have access to NHS patient data and systems must use this toolkit to provide assurance that they are practising good data security and that personal information is handled correctly”.

Do we need a DPIA before changing staff messaging app?

A care home should expect to need one: the ICO says “in most cases, a combination of two of these factors indicates the need for a DPIA”, and its factors include sensitive data and data about vulnerable people, both of which care home messages carry. Where a provider decides a DPIA is not needed, the ICO says “you should document your reasons”.

Official guidance and your next step

The primary sources are the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, Regulation 17 in particular, CQC’s guidance on good digital social care records, the National Data Guardian’s Caldicott principles, the ICO’s guidance on the right of access and on DPIAs, the Data Security and Protection Toolkit, and the Digital Care Hub’s guidance and template policies for adult social care providers. The Data (Use and Access) Act 2025 has amended UK GDPR and the Data Protection Act 2018 in stages, so check the date on any ICO page you rely on.

This is a buying guide for care providers in England, not legal advice, and not an assessment of any particular product.

Then do one thing: ask your seniors, without blame, which WhatsApp groups exist for work in your home, who is in each and what each is used for. That list is the specification for the replacement.