Almost every small operation has one. A group with everyone in it, where the rota gets posted as a photo on a Thursday, shift swaps get arranged, and someone asks at 11pm whether anyone can cover Saturday.

It is worth starting by saying why: it is free, everybody already has the app, and messages get read. Those are real advantages and most alternatives have historically been worse. Nobody chose this out of carelessness.

But there are four problems with it, and one of them has already been decided by a regulator.

1. You cannot show what anyone was told

This is the operational one, and it bites long before anything else does.

A message in a group has no record of who read it. Messages can be deleted for everyone, edited, or sent privately in a way that leaves no trace in the group. Six weeks later, "I never saw that I was on Saturday" is unanswerable - not because anyone is lying, but because the medium genuinely cannot tell you.

The same gap matters more when it is a shift swap that was agreed in a side conversation, a change to someone's hours, or an instruction that turns out to have safety significance. What you need is the ability to show that a specific person was told a specific thing at a specific time. A chat thread does not provide that, and the photograph of a spreadsheet posted above it is not a record of anything either.

2. Personal data on personal phones

This is the one with a decision behind it.

The Finnish Data Protection Ombudsman examined a cleaning company that used WhatsApp to send its staff their work assignments. The assignments contained what assignments contain: customer names, addresses, phone numbers - and, in some cases, the security codes to their homes.

The Ombudsman found the arrangement unlawful, on data security grounds, and the company was reprimanded and ordered to put a suitable system in place.

The detail worth taking from that is not "WhatsApp is illegal", because it is not, and saying so would be overclaiming. What failed was the combination: sensitive operational data, distributed to personal devices the employer does not control, with no assessment of the risk and no way to withdraw the information afterwards. Anyone dispatching work to client addresses - cleaning, domiciliary care, maintenance, delivery - is running the same pattern.

Two things follow immediately. Client and patient information should not be in a chat group at all. And a phone that leaves with a departing employee still has everything that was ever posted to it.

3. The group itself discloses something

Adding someone to a group shares their phone number with everyone else in it. For a work group that includes people who have never met, and for anyone with a reason not to have their personal number circulating - which is more people than you would guess, and they will rarely tell you why - that is a disclosure they did not choose.

It also does not reverse. Numbers collected from a group persist after somebody leaves.

4. It does not stop

A group used for the rota is a group that pings at 23:00. Several of the markets this blog covers have introduced or are introducing rules on being contactable outside working hours, and beyond any legal question there is a simpler one: a team whose scheduling lives in the same app as their family photos never fully finishes a shift.

The predictable result is that people mute it. And then the notice you thought you gave was not given.

What to do instead, in order of cost

Take client and patient data out of it today. This costs nothing and removes the sharpest edge. Assignments referencing a job number rather than a name and a door code are a large improvement on their own.

Separate the rota from the conversation. The rota needs to be somewhere it can be published, versioned and seen - where "posted" and "read" are distinct and both recorded. The chat can carry on being chat.

Make swaps and cover requests go through the same place. These are the changes most likely to be disputed and the ones most likely to be arranged in a side conversation today.

Write down what may not go in the group, and tell people. Most breaches here are helpfulness, not carelessness: someone sends the door code because the colleague covering genuinely needs it.

Then decide what the group is for. Kept deliberately as a social and quick-question channel, with none of the above in it, it is fine and people like it. The problem was never the app. It was that the app quietly became the system of record for things that need one.