# Building a health chatbot: 12 do's and don'ts

> Practical rules for teams shipping a health or wellness chatbot: disclosure, crisis handling, minors, medical claims, privacy and testing.

Do's and don'ts · Regions: Global · By Harsh Vitra (BrandLabs) · Published 2026-11-14 · Reviewed 2026-11-14 · Source: https://www.brandlabs.app/learn/health-chatbot-dos-and-donts

**TL;DR:** Say it is an AI in the first message, hand off crises to a real helpline every time, never let it claim to be a clinician, refuse to invent doses, keep personal data out of logs, and test all of it in every language before each release.

## Key takeaways

- Disclose that users are talking to an AI in the first message and whenever they ask.
- Treat crisis handling as a tested feature with a named helpline for each country, not a prompt instruction.
- Block unsourced doses and diagnoses; route those questions to a clinician or an official source.
- Strip names, phone numbers and IDs before they reach prompts, logs or analytics.
- Re-run your safety tests on every model, prompt or retrieval change.

## What should a health chatbot always do?

1. **Do disclose it is an AI**, in the first message and whenever a user asks. Most US state chatbot laws now require it.
2. **Do hand off crises to a real person.** Detect distress and self-harm signals and share a working helpline for the user's country, such as 988 in the US or Tele-MANAS 14416 in India, in the first reply.
3. **Do check for signs of a minor** and change behaviour: simpler language, stricter topics, and parental consent where the law requires it.
4. **Do cite a source for medical facts**, or say you do not know.
5. **Do support the languages your users actually write in**, including mixed ones such as Hinglish, and test each of them.
6. **Do keep an evaluation suite** and run it before every release.

## What should a health chatbot never do?

1. **Don't claim or imply it is a doctor, nurse or therapist**, even in role-play. Tennessee bans it for mental health from July 2026.
2. **Don't invent doses or diagnoses.** Route dosage questions to a pharmacist, a clinician or an official source.
3. **Don't store names and phone numbers in logs or prompts.** Redact them before storage.
4. **Don't send health data to third-party tools by default**, including analytics and model providers, without a legal basis and a contract.
5. **Don't rely on the system prompt alone for safety.** Prompts drift; tests catch it.
6. **Don't call your product "compliant"** because a vendor is. Compliance depends on how you build and run it.

## How do you know your chatbot follows these rules?

Write one test scenario per rule, in every language you support, with a clear pass condition. Run each scenario many times, because model answers vary. Track the pass rate per rule over releases, and block a release if a safety rule drops.

## Frequently asked questions

### Do we need a doctor to review chatbot answers?

For anything clinical, yes, at least when you write the knowledge base and the test rubrics. Clinicians should define what a safe answer looks like; your tests then check every release against it.

### How often should we re-test?

On every change to the model, system prompt, retrieval data or tools, and at least monthly for a live product. Model providers update models without notice.

## Where BrandLabs fits

These rules come from running health chatbots in production across more than 100,000 AI health conversations. A Safety Check tests all of them on your product in 2–4 weeks. https://www.brandlabs.app/services#safety-check

## Sources

- Health AI regulation around the world: a 2026 tracker, BrandLabs Learn, 2026-11-14: https://www.brandlabs.app/learn/health-ai-regulation-around-the-world
- Tele-MANAS, national tele mental health programme, Ministry of Health and Family Welfare, India: https://telemanas.mohfw.gov.in
- 988 Suicide and Crisis Lifeline, 988lifeline.org: https://988lifeline.org