Secure WhatsApp recruitment system built to reach Black men in prostate cancer research

Researchers at Cardiff University have built and tested a secure, WhatsApp-based digital recruitment system designed to share prostate cancer risk information with Black men in southeast Wales, and a new paper published in Frontiers in Digital Health on 28 October 2026 describes in detail how the system was engineered, governed and protected. In the study, the term Black men refers specifically to men of Somali and African Caribbean heritage, two communities whose members face a markedly elevated burden of prostate cancer yet remain persistently underrepresented in research on the disease. The work is a methodological paper: it reports how a community-engaged pilot study was run safely, rather than presenting clinical outcomes.

The clinical backdrop is stark. Prostate cancer is a frequently occurring cancer and a leading cause of cancer-related death in men, and while it is common in men over 70, black men and men with a family history carry the highest risk of all men. The reasons for the increased incidence in black men remain unclear, although recent evidence suggests that, compared with other ethnicities, black men without prostate cancer have higher levels of prostate-specific antigen, a protein secreted by the prostate that can indicate prostate disease, whether benign or malignant. That elevated PSA could contribute to overdiagnosis in this group, defined as the detection of cancers that may never become clinically significant, alongside exposure to the unpleasant and occasionally harmful effects of prostate biopsy.

Despite that elevated biological risk signal, the burden of disease is greater among black men, who present at a younger age and with later-stage and higher-grade disease relative to other ethnicities. The authors attribute this diagnostic discrepancy to intersecting influences of genetics, social deprivation, individual capability to engage with healthcare services, and lifestyle. Social deprivation is associated with poorer health outcomes through socioeconomic factors that can increase engagement in health-risk behaviours and delay cancer diagnosis. Barriers to timely diagnosis may include lower levels of health literacy, competing life demands that affect attendance at appointments, and limited access to services, and in some cultural groups stigma attached to this male-specific disease may further suppress engagement with healthcare.

There is currently no population-based screening for prostate cancer in the United Kingdom, and in November 2025 the UK National Screening Committee published a draft recommendation proposing targeted screening for men with confirmed BRCA1 or BRCA2 gene variants while further research continues into safe and effective screening approaches. Against that uncertain policy landscape, the research team turned to the communities themselves. Two separate research involvement groups, comprising African Caribbean and Somali men, met in 2023 to explore meaningful ways of sharing prostate cancer risk information within their communities. Both groups identified WhatsApp as their most trusted instant messaging platform and reported feeling confident using it to share risk information and culturally relevant messages within their peer networks.

The recruitment strategy that followed centred on two community co-applicants, each selected for their trusted standing and established connections within their respective communities. The co-applicants were provided with smartphones and acted as gatekeepers to recruit participants into WhatsApp groups. A research assistant set up WhatsApp Business accounts on project-funded devices, a configuration that supports broadcast messaging, secure one-to-one communication for consent and follow-up, and easy sharing of rich media. Each co-applicant contributed a list of 25 men from their community networks who met the inclusion criteria and had given permission for their anonymised phone numbers to be shared, giving a total of 50 potential participants. One WhatsApp group was created for each co-applicant, each serving two interconnected functions: disseminating study materials and enabling secure consent and survey data collection.

Inclusion criteria required participants to be men aged 45 years or older, of Somali or African-Caribbean heritage, belonging to the same community and known to the co-applicant leading the group, and to have access to WhatsApp. The sample size was guided by the co-applicants themselves, based on how many men they felt could realistically be recruited through convenience sampling within their existing networks. Dissemination of study materials, including peer-developed prostate cancer risk messages, a link to the study survey and a link to the Prostate Cancer UK online risk checker, occurred during in-person meetings with the Principal Investigator and research assistant, with materials reposted two weeks later to support ongoing engagement. Notably, after data collection the team learned that one co-applicant had established a separate WhatsApp group for twelve men who had left the main group because they felt uncomfortable participating alongside unfamiliar people; eight of them subsequently took part, and because they had already been issued access codes, the verification process was unaffected. No research or conversation data were collected from either group.

The technical workflow reveals the layered security architecture at the heart of the paper. Participants reached a landing page developed with a team of computer science researchers, entered their mobile number and completed a CAPTCHA to verify they were human. A secure access code was then sent via TextGlobal, a bulk SMS service procured and configured by the Principal Investigator and research assistant. Initially both UK and Somali dialling codes were offered, but since all participants had UK numbers, authentication was restricted to simplify access and mitigate malicious requests. After receiving the code, participants chose between English and Somali language options, which determined which culturally and linguistically adapted participant information sheet and consent form they saw, both refined after being piloted by the African-Caribbean and Somali groups. Consent required ticking all boxes, entering a name and providing a valid date; completed forms containing personally identifiable information were then encrypted using Python encryption libraries, with keys generated by a cryptographically secure random generator, master keys held in a key management system and data-encryption keys protected through envelope encryption. Specific details of algorithms and key lengths cannot be disclosed for security reasons.

Survey access was controlled with equal rigour. After consent, participants were redirected to an evaluative survey hosted on Microsoft Office Forms, which provides encryption in transit and at rest under institutional data governance agreements. Early testing identified potential security risks, prompting a double-verification system in which participants had to be pre-authorised by mobile number and then use a unique access code. Mobile numbers from the original WhatsApp groups were securely stored and hashed so they could not be used without permission, numbers not on the approved list were automatically blocked from requesting a code, and code requests were initially limited to five per participant, later reduced to three. During testing, a small number of attempts were made to submit data from phone numbers not registered in the WhatsApp groups, involving three IP addresses; the team could not determine whether these were distinct individuals or repeated attempts by one person, but inspection suggested the activity was limited to reconnaissance, with no evidence the system had been successfully exploited, so the event was not referred to the university’s central IT teams.

Privacy protection was formalised through a structured review using the LINDDUN GO threat modelling framework, chosen over the more exhaustive LINDDUN MAESTRO variant because the pilot system was not complex enough to warrant that depth of analysis, and over LINDDUN PRO because the team lacked access to the implementation details of WhatsApp and Microsoft Forms. The review addressed all seven LINDDUN categories, including linkability, identifiability, non-repudiation, detectability, disclosure of information, unawareness and non-compliance, and yielded concrete mitigations: no error messages reveal whether an account exists, only minimum necessary data are collected, data are processed solely for the research aims, encrypted archives will be permanently deleted after five years, WhatsApp messages are automatically deleted after 24 hours, and ethnicity data are processed as special category data under UK GDPR Article 9(2)(j) for scientific research purposes alongside Article 6(1)(e). The project received full approval from the Cardiff University School of Healthcare Sciences Research Ethics Committee before commencement.

Throughout recruitment and live data collection, the authors report, no breaches of participant confidentiality or data integrity occurred, and personally identifiable information was successfully separated from survey responses using unique participant identifiers. The study’s limitations are candidly stated: it was a small, community-based pilot using convenience sampling, it did not generate outcome data allowing feasibility, engagement or impact to be assessed directly, participation required smartphone access, WhatsApp and sufficient digital literacy, and the system was never subjected to independent penetration testing or security review because the small grant budget could not cover the cost, an area the team identifies as future work. The authors argue the approach could be adapted by research teams and public health organisations with appropriate technical and data-governance expertise, offering a replicable template for combining trusted community intermediaries with privacy-by-design engineering in digital health research.

Subject of Research: Development and security evaluation of a WhatsApp-based digital recruitment system for prostate cancer research with Somali and African Caribbean men in southeast Wales

Article Title: Using secure WhatsApp-based digital recruitment as an intervention in prostate cancer research with black men

Article References: Wakeham, K., Theodorakopoulos, G., Li, S., Liu, Y., Wang, X., Courtier, N., Quinn-Scoggins, H., & Fry, S. (2026). Using secure WhatsApp-based digital recruitment as an intervention in prostate cancer research with black men. Frontiers in Digital Health, 8, Article 1786070. https://doi.org/10.3389/fdgth.2026.1786070

Image Credits: AI Generated

DOI: 10.3389/fdgth.2026.1786070

Keywords: prostate cancer, WhatsApp, digital health, data security, privacy-by-design, Black men, community engagement, LINDDUN GO, encryption, pilot study, Cardiff University, health inequalities