WhatsApp lead tracking in health tourism: source, CRM stage and response time

In health tourism, a large share of prospective patients message the clinic on WhatsApp instead of filling in a form. The conversation often starts on a patient coordinator's screen, moves between several languages and lasts for weeks. In the end, the clinic makes budget decisions without knowing which ad actually brought in appointments.

This post covers the clinic side of tying WhatsApp inquiries from prospective patients to their source, following them through the right CRM stages and measuring response time. We explained the general method (the click ID from Click-to-WhatsApp ads, the GA4 event, wa.me links with a reference code) in detail in our post on WhatsApp tracking, so we do not repeat it here.

First, the boundary: this is source measurement

WhatsApp lead tracking means recording which ad, page or campaign each WhatsApp conversation with the clinic started from. Monitoring people, reading an employee's or anyone else's messages, or tracking locations is not part of this work, and we do not offer such a service.

The measurement is about where the conversation started, not about what the messages say. What goes into the source fields is marketing information such as "which campaign, which language version, which date." The patient's health condition, complaint or the documents they send do not go into these fields. This separation is the foundation of the setup, both for accurate measurement and for KVKK (Turkey's personal data protection law).

Why WhatsApp inquiries are different at a clinic

At a general service company, a WhatsApp inquiry can turn into a sale after a short exchange. Health tourism is different:

• Decisions take a long time. There can be weeks between the first message and the visit to the clinic. If the ad platform only sees the first message, it cannot learn which campaign brought real patients.
• There are several languages. The same campaign runs in different languages, and conversations are routed to coordinators who speak those languages. The source information must not get lost in this routing.
• Messages contain health information. Even unprompted, a patient may send photos, medical reports or describe their complaint. This information needs separate care from marketing data.
• Response time is measured across time zones. A message a patient sends at night may not fall within the clinic's working hours.

Source: which ad did each conversation start from?

Every new WhatsApp conversation should open a record in the CRM and fill in these source fields:

For Click-to-WhatsApp ads, Meta passes a click ID called ctwa_clid in the first message of a conversation that starts from an ad. Meta's documentation describes this ID as a unique, personal identifier per click (so it should itself be protected like personal data) and recommends storing it with the conversation and sending it back through the Conversions API when a conversion happens. For buttons on the site, page- and language-specific reference codes are used. The detailed setup is in the WhatsApp tracking post.

An important rule for clinics: the source information is written once, on the first message, and later messages do not change it. If the patient writes again from the same number months later through another campaign, it is recorded separately as a new inquiry.

CRM stages for prospective patients

The value of source information shows when it is combined with stages that show what became of the inquiry. The structure below is a starting point; each clinic adapts it to its own process.

The loss reason should be a required field. If a campaign's inquiries keep closing as "not a fit," the problem lies in the ad copy or targeting, not with the coordinator team.

Shifting the goal from message volume to confirmed appointments is an approach also seen in our published cases. In the Serkan Hezar Clinic case, the published metric is "150% Approved appointment increase"; the case's method note reads "Approved appointments entering the clinic's system; advertising budget unchanged," and the period is a "3-month optimization period." This case is not specific to WhatsApp; we mention it to show that what is measured is not form or message volume but confirmed appointments entering the clinic's system.

Measuring response time

In health tourism, a patient may message several clinics at once. That makes response time an operational metric worth tracking. The measurement is simple: the difference between the time of the first incoming message in the conversation and the time of the team's first reply. In Meta's webhook examples, every incoming message carries a timestamp field; the CRM integration writes this field to the record.

Read the report with breakdowns, not as a single average:

• By language: If response time is long in one language, the cause is often the number of coordinators who speak it.
• By campaign: A newly launched campaign can bring in more messages than the team can handle.
• Inside and outside office hours: If night-time messages are not measured separately, daytime performance looks worse than it is.
• Mean and median: A few very late replies skew the mean; the median shows the typical experience.

Each clinic sets its own target time based on team capacity and its patients' time zones. We do not give a general target figure here; what matters is that the time is measured and read together with stage outcomes. If an automatic greeting is used outside office hours, the first response time should be calculated from the first reply by a person.

KVKK: health data is a special category of personal data

On a clinic's WhatsApp, a patient may share health information even when not asked. That is why the relevant articles of Turkey's Personal Data Protection Law (KVKK, Law No. 6698) should be read before the setup. We quote the articles below from the text of the law; review how they apply to you with your legal counsel.

• Health data is a special category of personal data (Law 6698 Art. 6(1)). The article lists data relating to a person's "health" among special categories of personal data.
• Prohibition on processing and exceptions (Law 6698 Art. 6(3)). Article 33 of Law No. 7499 repealed the second paragraph of Article 6 and amended the third (Resmî Gazete, the Official Gazette, March 12, 2024, issue 32487). Under the new text, processing special categories of personal data is prohibited, but it is permitted in the cases listed in the article, including (a) where the data subject has given explicit consent and (e) where it is necessary for purposes such as providing medical diagnosis, treatment and care services by persons under a duty of confidentiality or by authorized institutions and organizations. Under Law No. 7499 Art. 40(1)(a), this amendment entered into force on June 1, 2024.
• Adequate measures (Law 6698 Art. 6(4)). Processing special categories of data also requires taking the adequate measures set by the Board (the Personal Data Protection Board).
• Definition of explicit consent (Law 6698 Art. 3(1)(a)). Explicit consent is consent on a specific matter, based on information and given freely.
• Proportionality and retention (Law 6698 Art. 4(2)(ç) and (d)). Data must be relevant to, limited to and proportionate to the purpose of processing, and kept only as long as necessary.
• Notice (Law 6698 Art. 10(1)). When data is collected, the data subject must be told the identity of the data controller, the purpose of processing, to whom the data may be transferred, the method of collection and the legal basis, and their rights.
• Security (Law 6698 Art. 12(1)–(2)). The data controller must take the necessary technical and administrative measures; if data is processed by someone else on its behalf, it is jointly responsible with them for these measures.
• Transfers abroad (Law 6698 Art. 9(1), as amended by Law 7499 Art. 34). If the WhatsApp provider or the CRM stores data outside Turkey, the transfer depends on one of the conditions in Articles 5 and 6 being met and on an adequacy decision or one of the appropriate safeguards listed in Art. 9(4).

In practice, these articles turn into the following setup decisions:

1. Separate source data from health data. No diagnosis, treatment or complaint is written into the source and stage fields in the CRM. Health information is kept in a separate system that only the clinic's authorized staff can access.
2. Limit access by role. The marketing team sees the source and stage report; it does not need to see conversation content.
3. Prepare the privacy notice in the patient's language. Link to it in the first reply or in the automatic greeting.
4. Set a retention period. Decide how long conversations for lost inquiries are kept.

What goes to ad platforms, and what does not?

The last step of source measurement is reporting qualified inquiries or appointments back to the ad platforms. Meta's Conversions API for Business Messaging documentation lists events such as LeadSubmitted, QualifiedLead and Purchase for this interface and states that messaging events should only represent interactions that take place within the chat.

In healthcare the line is clear: the platform receives "this inquiry is qualified" or "an appointment was booked," not sensitive details about the diagnosis or type of treatment, and not the complaint. Meta's advertising standards prohibit ads from asking for health information, including physical and mental health, medical treatments and medical conditions, without Meta's prior permission. Google's personalized advertising policy also lists health among sensitive interest categories and restricts advertisers promoting products and services in these categories from using advertiser-curated audiences. Plan your campaign setup around these rules; for Turkey's promotion rules, see our post on the health advertising regulation.

Setup order

1. List the entry points: ads, WhatsApp buttons on each language version of the site, QR codes.
2. Write down the source fields and the naming convention: channel, campaign, language, landing page.
3. Settle the legal framework: the privacy notice, where health data will be kept, access roles, the retention period, the provider's data location.
4. Connect your WhatsApp Business Platform provider to the CRM: write the referral data and timestamp of the first message to the record.
5. Define the stages and a required loss reason.
6. Build the response-time report with its breakdowns.
7. Connect qualified-inquiry and appointment events to the ad platforms.
8. Send a test message for each channel and language.

Measuring WhatsApp, phone and forms with the same source model lets you compare channels fairly. We handle this setup in our call tracking and WhatsApp integration service, and the CRM side under CRM consulting. For demand generation as a whole, see our lead generation agency page.

Sources

• Law No. 6698 on the Protection of Personal Data (KVKK) (Arts. 3, 4, 6, 9, 10, 12): https://www.mevzuat.gov.tr/mevzuatmetin/1.5.6698.pdf (accessed October 2026)
• Law No. 7499 Amending the Code of Criminal Procedure and Certain Laws (Arts. 33, 34, 40), Resmî Gazete March 12, 2024, issue 32487: https://www.resmigazete.gov.tr/eskiler/2024/03/20240312-1.htm (accessed October 2026)
• Meta for Developers, Conversions API for Business Messaging: https://developers.facebook.com/docs/marketing-api/conversions-api/business-messaging (accessed October 2026)
• Meta for Developers, WhatsApp Cloud API webhook components: https://developers.facebook.com/docs/whatsapp/cloud-api/webhooks/components (accessed October 2026)
• Meta Transparency Center, Introduction to the Advertising Standards: https://transparency.meta.com/policies/ad-standards/ (accessed October 2026)
• Google Ads Policy Help, Restricted targeting in Personalized advertising: https://support.google.com/adspolicy/answer/143465 (accessed October 2026)
• Roicool, Serkan Hezar Clinic case study: https://www.roicool.com/vaka-calismalari/saglik-pazarlamasi-randevu-artisi (accessed October 2026)