DPDP for hospitals, clinics, diagnostics, pharmacies and health apps

Health care cannot happen without personal data. A diagnosis needs a history, a lab needs a sample linked to a name, a pharmacy needs a prescription, and a claim needs all three. The DPDP Act has no separate “sensitive data” class, but a leaked HIV result or pregnancy scan can cost a person a job, a marriage or their safety, and the Board must weigh “the type and nature of the personal data” when it sets a penalty (section 33(2)).

The risk rarely sits in the treatment itself. It sits around it: reports forwarded on WhatsApp, patient lists handed to pharma “patient support” programmes, health-camp leads pushed to sales, app data sent to ad SDKs, and research datasets nobody de-identified. This guide applies the Data Fiduciary playbook to health care.

Are you a Data Fiduciary, a processor, or both?

• Hospital, nursing home or clinic: you are the Data Fiduciary for patients, attendants and visitors. Your hospital information system (HIS), PACS, cloud host, billing software, SMS and WhatsApp providers and call centre are your Data Processors. A visiting consultant who keeps a private-practice record of the same patient is a separate fiduciary for it.
• Diagnostic lab or imaging centre: you are a fiduciary for walk-in and home-collection patients. When a hospital refers a sample and you report only back to it, you may be its processor; say so in the referral agreement. A franchise collection centre is usually your processor.
• Retail pharmacy: you are the fiduciary for customers and prescriptions. The Act’s own section 7(a) illustration is a pharmacy sending a payment receipt to the mobile number the customer gave. Using that number for offers needs consent.
• E-pharmacy or health marketplace: you are a fiduciary for buyers. Partner pharmacies and prescription-validating doctors are separate fiduciaries for their professional records, and may be your processors for the order. Write down each role.
• Telemedicine platform: you are a fiduciary for patients who sign up. The doctor is a fiduciary for the clinical record they must keep. Decide in the doctor agreement who holds notes and prescriptions, and who answers rights requests.
• Health, fitness and wearable apps: you are a fiduciary for users. A white-label app run only on a hospital’s or insurer’s instructions makes you their processor; using the data for your own product makes you a fiduciary for that use.
• Corporate health check-ups: the employee is your patient. The paying employer should receive only what the employee agrees to share, usually a fitness outcome.

The data you hold

Data category	Where it usually lives	Typical purpose	Sensitivity	Typical retention
Patient registration: name, age, sex, mobile, address, UHID, ABHA number	HIS, front-desk software, ABDM-linked systems	Identification, appointments, billing	Medium	As medical record rules require; confirm with counsel
Clinical records: history, notes, diagnoses, discharge summaries	EMR, paper files later scanned	Treatment, continuity of care	High	Medical council and state rules set minimums
Lab results and samples linked to identity	LIS, reference-lab portals, report links	Diagnosis	High (HIV, genetic, pregnancy results are the highest)	As lab accreditation and law require
Imaging: X-ray, CT, MRI, ultrasound	PACS, CDs, cloud viewers	Diagnosis	High; prenatal ultrasound is regulated by PCPNDT	PCPNDT and other records as the law requires
Prescriptions and dispensing records	Pharmacy software, e-pharmacy order system	Dispensing, legal records	High	Drugs and Cosmetics rules for certain schedules
Payment, insurance policy, TPA claim files	Billing, TPA portal, insurer systems	Payment, cashless and reimbursement claims	High	Accounting and insurance rules
Telemedicine consultations: chat, audio, video, uploaded files	Platform servers, video vendor	Consultation, the doctor’s record	High	Per telemedicine guidelines and your policy
Wearable and app data: heart rate, steps, sleep, cycle tracking, glucose	App backend, phone, cloud analytics	The feature the user turned on	High in aggregate (reveals conditions and routines)	Short; erase on account closure
Attendant and emergency contact details	HIS, visitor logs	Contact during care	Medium	Until discharge plus a short period
CCTV and visitor logs	Security vendor, NVRs	Safety	Medium to high in wards and ICUs	Short, rolling
Health camp and lead data	Spreadsheets, CRM, marketing agencies	Outreach, appointment booking	Medium to high	Short; consent-based
Research and registry datasets	Research servers, sponsor systems	Studies, quality improvement	High unless de-identified	As the protocol and ethics approval allow
Children’s records (paediatrics, vaccination, school health checks)	HIS, vaccination apps	Treatment	High	As medical record rules require
Staff and doctor credentials	HR, credentialing system	Employment, empanelment	Medium	See the employers guide

Risk hotspots

1. Reports on WhatsApp and personal phones. Staff forward reports and images from their own phones because it is fast. Failure: uncontrolled copies, wrong-number sends, and no way to erase anything. Control: send reports through expiring, OTP-protected links from a business account, ban forwarding from personal numbers, and give clinicians a sanctioned secure messaging tool.
2. Treating every health purpose as “care”. Pharma-sponsored adherence calls, camp follow-ups and package upselling are not treatment. Failure: marketing and third-party sharing with no consent. Control: tag every purpose as care, legal duty or consent, with a separate opt-in for consent purposes.
3. Stretching 7(f) and 7(g). Section 7(f) covers responding to a medical emergency involving a threat to life or an immediate threat to health; 7(g) covers treatment and health services during an epidemic, outbreak or other threat to public health. Failure: using “emergency” to justify routine processing, or keeping emergency data in marketing lists. Control: a written emergency-processing note, automatic return to normal bases once the patient is stable, and no reuse of emergency data for other purposes.
4. Insurers, TPAs and corporate clients. Cashless claims need clinical details shared with a TPA and insurer; employers paying for check-ups ask for full reports. Failure: over-sharing, or reports sent to an employer without the patient’s agreement. Control: share only what the claim form or the patient’s request needs; send employers a fitness outcome, not the report, unless the employee agrees.
5. Ad SDKs in health apps and portals. Period trackers, diabetes and pharmacy apps embed SDKs that send events such as “viewed HIV test” or “ordered insulin”. Failure: disclosing health conditions to ad platforms without consent. Control: an SDK inventory, no ad SDKs on health screens, server-side analytics with event allow-lists, and consent for anything beyond running the service.
6. Pathology and imaging portals. Guessable report URLs, shared doctor logins and reports online for years. Failure: a large breach from one enumeration bug. Control: unguessable, expiring links, OTP or login, rate limits, and audit logs of every download.
7. Specially protected records. HIV status, termination of pregnancy, prenatal diagnostic records, psychiatric notes and genetic results have their own confidentiality laws. Failure: one disclosure can breach the HIV Act, the MTP Act or the Mental Healthcare Act as well as DPDP. Control: tighter access groups, break-glass logging, and no use in general analytics or research extracts without specific approval.
8. Research and AI on patient data. Hospitals share data with start-ups, sponsors and academic partners. Failure: identifiable data leaves without consent, and section 17(2)(b) does not apply because the standards were not met. Control: an ethics committee review, de-identification before sharing, a data-sharing agreement, and a record showing how the rule 16 standards were met.
9. Vendors with full access. HIS, LIS and PACS vendors often have remote admin access to production for support. Failure: a vendor engineer’s laptop becomes your breach. Control: named, time-bound vendor access, MFA, session logging, and section 8(2) contract clauses.
10. Children and adolescents. Paediatric care, adolescent health apps and school health check-ups involve children. Failure: assuming the health exemption covers marketing or app analytics too. Control: apply the Fourth Schedule exemption only to health services to the extent necessary, and treat everything else as section 9 processing.

Legal basis, purpose by purpose

Purpose	Basis	Notes
Registration, appointment booking, OPD consultation	Consent, or 7(a) where the patient voluntarily gives data to get care	Keep registration fields minimal. Notice at the front desk and on the booking page.
Diagnosis, treatment, nursing, in-patient care	Consent or 7(a)	Medical consent to treatment is a separate legal requirement under medical law; do not merge the two forms into one signature.
Emergency care when the patient cannot consent	7(f)	Only while there is a threat to life or an immediate threat to health. Return to consent or 7(a) once the patient can decide.
Testing, treatment and tracing during an epidemic or outbreak	7(g)	Limited to measures to provide treatment or health services. Not for marketing or later unrelated use.
Reporting notifiable diseases and other statutory returns	7(d) / retention required by law	Share only what the reporting law asks for.
Billing, receipts, GST and accounting	7(a) and retention required by law	The Act’s pharmacy illustration covers a receipt sent to the mobile number the customer gave.
Cashless and reimbursement insurance claims	7(a) on the patient’s request, or consent	The insurer is a separate fiduciary for its part; the TPA usually acts as the insurer’s processor. Share only what the claim needs.
Dispensing and prescription records in a pharmacy	7(a) and retention required by law	Keep the records the Drugs and Cosmetics rules require for scheduled drugs.
Telemedicine consultation	Consent	The section 6(1) illustration: consent is limited to what telemedicine needs, so a contact-list permission is not covered.
ABHA creation and linking records through ABDM	Consent, through the ABDM consent flow	Follow ABDM’s own consent artefacts for health information exchange.
Health tips, offers, package promotions, refill reminders with offers	Consent, per channel	A plain refill reminder on a prescription the patient asked you to manage can rest on 7(a) if the notice says so; offers in it need consent.
Sharing with pharma “patient support” programmes	Consent, naming the recipient	The pharma company becomes a fiduciary in its own right.
Research, registries and AI training	Consent, or section 17(2)(b) where the data is not used for decisions about the person and the rule 16 standards are met	Ethics approval and de-identification are still expected under research guidelines.
Wearable and app analytics beyond running the feature	Consent	Offer the core feature without analytics or ad sharing. Checks for forged prescriptions can rest on section 17(1)(c); do not reuse that data for marketing.

Children, emergencies and the narrow exemptions

Children (under 18). The Fourth Schedule, Part A lifts the parental-consent and tracking restrictions of sections 9(1) and 9(3) for clinical establishments, mental health establishments and healthcare professionals, but only where “processing is restricted to provision of health services to the child … to the extent necessary for the protection of her health”. Allied healthcare professionals get a similar exemption for supporting a treatment and referral plan. In practice:

• Treating a child, keeping her record and sharing it with the referring doctor fall within the exemption.
• Marketing health packages using the child’s data, app analytics on the child’s use, or a case study featuring her record do not. These need verifiable parental consent under rule 10, and tracking, behavioural monitoring and targeted advertising directed at her are barred (section 9(3)).
• A wellness or fitness app is usually not a clinical establishment or healthcare professional, so the exemption does not reach it.
• Section 9(2) still applies to everyone: no processing likely to harm a child’s well-being.

Emergencies and epidemics. Sections 7(f) and 7(g) let you act without consent in the moment. They do not cover later reuse, and they do not displace medical confidentiality law.

Persons with disability. Where a patient has a lawful guardian, verify that the guardian was appointed by a court, a designated authority or a local level committee before relying on their consent (rule 11).

Notices and consent: getting the screens right

Channel	Do	Don’t
Front desk and registration counter	Show a short notice in the local language and record consent in the HIS with the notice version. Put marketing opt-ins in separate ticks.	Bundle treatment consent, the privacy notice and marketing into one signature.
Emergency department	Treat first. Give the notice once the situation allows, and record that 7(f) was relied on.	Ask a patient in distress to sign privacy forms before triage.
Appointment app and website	Show an itemised notice at booking. Ask for OS permissions only when used. Keep marketing toggles off by default.	Ask for contacts, SMS or call-log access (see the section 6(1) illustration).
Telemedicine video and chat	Say whether the session is recorded, who sees the record, and for how long.	Record by default or leave recordings with the video vendor indefinitely.
Home sample collection and field phlebotomists	Give a QR code that opens the notice and lets the patient choose report delivery and marketing preferences.	Let field staff photograph prescriptions and IDs on personal phones.
Pharmacy counter and e-pharmacy checkout	Collect only what dispensing and delivery need. Ask for refill-reminder and offers consent separately.	Require marketing consent to fill a prescription.
WhatsApp and SMS	Send reports and reminders from a verified business number with a one-tap STOP for promotions.	Send full reports as attachments to numbers you have not verified.
Call centre	Read a short notice before recording and explain how to withdraw. Verify the caller before discussing results.	Read out results to anyone who knows the patient’s name and date of birth.
Health camps and kiosks	Use a QR code or tablet notice, and record consent for follow-up calls separately from the screening itself.	Hand camp registers to a sales team or a sponsor.

Every notice must stand on its own, itemise the data and each purpose, and give a link or other means to withdraw, exercise rights and complain to the Board (rule 3). Patients must be able to read it in English or any of the 22 Eighth Schedule languages (section 5(3)). Start with Hindi and the languages of your catchment area, and have a staff member who can read it aloud to patients who cannot read.

Other laws you must line up with

• Clinical Establishments (Registration and Regulation) Act, 2010 and state equivalents: standards include maintaining medical records and giving them to patients. The Fourth Schedule uses this Act’s definition of “clinical establishment”. Confirm the current requirement with counsel.
• Medical council professional conduct regulations (IMC Regulations 2002 and the NMC’s regulations): a minimum period for keeping in-patient records, and records on request. Confirm the current requirement with counsel.
• Telemedicine Practice Guidelines, 2020: patient identification, consent and the doctor’s record-keeping. A guideline’s implied consent to a consultation is not DPDP consent for non-clinical purposes.
• Ayushman Bharat Digital Mission (ABDM) and the Health Data Management Policy: ABHA creation and record sharing through ABDM use ABDM’s own consent manager and consent artefacts, alongside your DPDP duties. Do not make ABHA a condition of treatment where ABDM makes it voluntary.
• Medical Termination of Pregnancy Act, 1971: strict confidentiality of the woman’s identity and limits on disclosure.
• PCPNDT Act, 1994: mandatory records for every prenatal diagnostic procedure, kept for a prescribed period and open to inspection, so not erasable on request. Confirm the current requirement with counsel.
• HIV and AIDS (Prevention and Control) Act, 2017: informed consent for testing and treatment, and confidentiality of HIV status with limited exceptions.
• Mental Healthcare Act, 2017: a right to confidentiality of mental health information.
• Drugs and Cosmetics Act, 1940 and Rules: prescription and sale records for certain drug schedules. E-pharmacy rules have long been in draft. Confirm the current requirement with counsel.
• New Drugs and Clinical Trials Rules, 2019 and ICMR ethical guidelines: informed consent, ethics approval and confidentiality in trials and research.
• IRDAI regulations on health insurance and TPAs: what insurers and TPAs may collect and how claims run. Match your contracts to them.
• IT Act, 2000 and CERT-In Directions (2022): cyber incidents must be reported to CERT-In on a much shorter clock than the DPDP 72 hours. Confirm the current requirement with counsel.
• Medical Devices Rules, 2017: a wearable or app that claims to diagnose or monitor a condition may be a regulated device.

Retention and erasure

1. When the purpose ends (section 8(7)): treatment ends, but medical record rules usually require you to keep the record. Separate the clinical record (kept for the legal period) from everything around it: marketing preferences, app analytics, call recordings, camp leads, report links. Erase those when the purpose ends.
2. The one-year minimum (rule 8(3)): keep personal data, traffic data and processing logs for at least one year from the processing, then erase them unless another law requires longer. This covers HIS, LIS and PACS access logs (rule 6(1)(e)).
3. Legal holds: MTP, PCPNDT and scheduled-drug records, medico-legal files, records under a court order, and open claims or disputes. Mark them so no retention job touches them, and tell the patient what you kept and why.
4. The Third Schedule: it does not apply to hospitals and clinics. It can apply to an e-pharmacy or health marketplace that is an e-commerce entity with 2 crore or more registered users in India. Such a platform must erase a user’s data three years after they last engaged, after warning them at least 48 hours before (rule 8(2)). Data needed to access the account and virtual tokens such as wallet balances are excluded, and data you must keep by law (prescription records) stays.
5. Processors and backups: make your HIS, LIS, PACS, cloud, video and messaging vendors erase on instruction and confirm it. Document backup retention, and make sure restored backups replay erasures.

Rights requests and grievances

• Channels: a patient-portal or app “Privacy” section, a web form, the front desk and an email address. Publish them with the identifier you need: UHID, lab ID, order number or registered mobile (rule 14(1)).
• Identity: use an OTP to the registered mobile, or check the UHID at the counter. Do not ask for an Aadhaar copy or other ID you do not already hold. Be careful with requests from relatives; only a nominee, parent of a child, or lawful guardian may act for the patient.
• Access (section 11): give a summary of the data and processing, and list the other fiduciaries and processors you shared with: insurers, TPAs, reference labs, partner pharmacies, ABDM-linked facilities and vendors. The duty to give a copy of the medical record comes from medical law and runs alongside.
• Correction (section 12): correct demographic errors quickly. Do not overwrite a doctor’s note; add a dated addendum, as medical record practice requires.
• Erasure (section 12(3)): erase marketing data, app data and anything outside the legal record. Refuse erasure of records you must keep by law, and say which law.
• Grievances: publish a response period inside the 90-day ceiling (rule 14(3)); 15–30 days is good practice. Mention your DPO or contact person in every reply (rule 9).
• Nomination (section 14): let patients nominate someone to act on death or incapacity, which matters for elderly and long-term patients.

Breach readiness

Likely scenarios:

• a report portal exposing other patients’ reports through guessable links
• ransomware that takes the HIS or PACS offline (loss of availability is a breach too)
• staff photographing a well-known patient’s records
• an ad SDK sending health events from an app
• a TPA or reference-lab vendor compromise

Run-book:

1. Contain within hours: disable the exposed link or account, isolate infected systems, revoke vendor access, and switch to downtime procedures so care continues.
2. Assess: which records, how many patients, and which consequences: discrimination, extortion and stigma, especially for HIV, MTP, psychiatric and genetic records.
3. Notify affected patients without delay through their account or registered contact, covering every point in rule 7(1): what happened and when, the likely consequences, what you are doing, what they can do (for example, ignore calls demanding payment to “release” reports), and a contact.
4. Notify the Board without delay, then send the detailed report within 72 hours (rule 7(2)).
5. Report to CERT-In where its directions apply, and inform insurers, TPAs and other partners whose data or systems are involved.
6. Learn: fix the root cause, re-train staff, and update vendor contracts if a processor caused it.

The checklist

Phase 1: discover (days 0–30)

• [Leadership] Appoint a DPDP owner and a working group: medical superintendent or clinical lead, IT, legal, billing, nursing, pharmacy and marketing.
• [Clinical] List every collection point: registration, emergency, OPD, IPD, lab counters, home collection, pharmacy, teleconsultation, health camps and kiosks.
• [Eng] Inventory every system that holds patient data: HIS, EMR, LIS, PACS, pharmacy software, billing, apps, report portals, data warehouse, backups.
• [Ops] Find the shadow systems: WhatsApp groups, personal phones, spreadsheets of camp leads, shared drives of scanned files.
• [Legal] List every party that receives patient data: insurers, TPAs, reference labs, partner pharmacies, pharma programmes, ABDM, vendors. Collect their contracts.
• [Product] List every SDK and tracker in your apps and websites, and what each sends.
• [Legal] Map the records other laws make you keep (medical council rules, Clinical Establishments Act, MTP, PCPNDT, Drugs and Cosmetics, HIV Act) and their periods, with counsel.
• [Clinical] Identify where you treat or serve children, and where persons with disability have lawful guardians.
• [DPO] List all research, registry and AI projects using patient data, with their ethics approvals.
• [Clinical] Identify where specially protected records (HIV, MTP, PCPNDT, psychiatric, genetic) are created and stored.
• [Leadership] Assess the likelihood of SDF status, given the volume and sensitivity of your data.

Phase 2: design and build (days 31–90)

• [Legal] Assign a basis to every purpose using the table above, and stop purposes without one.
• [Legal] Write an emergency-processing note for 7(f) and 7(g): who may rely on it, for what, and when it ends.
• [Legal] Write itemised notices for registration, emergency, lab, pharmacy, teleconsultation, apps and health camps.
• [Ops] Translate notices into Hindi and the main languages of your catchment area; make all 22 available on request.
• [Clinical] Separate the medical consent-to-treatment form from the DPDP notice and any marketing opt-ins.
• [Product] Rebuild app and booking flows: minimal fields, OS permissions only when used, marketing toggles off by default, no contact-list access.
• [Eng] Remove third-party ad SDKs from health screens; move analytics server-side with event allow-lists.
• [Eng] Move report delivery to OTP-protected, expiring links; turn off guessable URLs.
• [Security] Create restricted access groups in the HIS for HIV, MTP, PCPNDT, psychiatric and genetic records, with break-glass logging.
• [Security] Enforce MFA for HIS, PACS and portal admins, and named, time-bound vendor access.
• [Eng] Keep access logs for clinical systems for at least one year.
• [Ops] Give clinicians a sanctioned secure messaging tool and write a rule against forwarding reports from personal phones.
• [Legal] Add DPDP clauses to HIS, LIS, PACS, cloud, video, messaging and call-centre contracts: security, breach notice, erasure, one-year logs, sub-processors, audit.
• [Legal] Agree data-sharing terms with insurers, TPAs and reference labs: minimum data, purpose, security, breach notice.
• [Finance] Change corporate check-up contracts so employers get fitness outcomes, not full reports, unless the employee agrees.
• [Clinical] Document the Fourth Schedule health exemption for children: what it covers and what still needs parental consent.
• [Product] Add verifiable parental consent under rule 10 for children’s accounts in apps, and switch off tracking and targeted ads for them.
• [DPO] Set a research data procedure: ethics review, de-identification, data-sharing agreements, and a record of the rule 16 standards.
• [Eng] Build retention jobs for non-clinical data (camp leads, call recordings, app analytics) and legal holds for statutory records.
• [Eng] If you are an e-pharmacy with 2 crore or more registered users, build the three-year inactivity erasure with the 48-hour warning.
• [Product] Publish the privacy page: contact person, request channels, identifier needed, grievance period.
• [Ops] Set up the rights workflow with UHID or OTP verification and a clinical-record correction procedure.
• [Security] Write the breach run-book, including ransomware downtime procedures and Board report templates.

Phase 3: operate (ongoing)

• [DPO] Review new apps, partners, research projects and campaigns before launch.
• [Security] Review HIS access logs every month for access to restricted records and to records of well-known patients.
• [Clinical] Train doctors, nurses, technicians and front-desk staff every year on confidentiality, WhatsApp rules and verifying callers.
• [Product] Re-scan app SDKs and website tags every quarter.
• [Security] Run a penetration test every year on the portal, apps and APIs, and a ransomware tabletop drill against the 72-hour clock.
• [Ops] Review rights and grievance timelines every month.
• [Legal] Review vendor, insurer, TPA and lab contracts every quarter.
• [DPO] If notified as an SDF, run the DPIA and audit every 12 months and send the Board the significant observations (rule 13).
• [Clinical] Audit a sample of report and discharge-summary deliveries every quarter for wrong-recipient sends.
• [Ops] Check every quarter that camp leads, call recordings and expired report links are actually erased.
• [Legal] Re-check medical-record, PCPNDT, telemedicine and e-pharmacy rules with counsel every year.
• [DPO] Keep evidence: consent records, emergency-processing records, erasure confirmations, training records.

Where myconsentapp comes in

You need to	With myconsentapp	You still own
Separate care from marketing and research	Define purposes (registration, teleconsultation, report delivery by WhatsApp, health offers, research) once, each tagged consent or legitimate use, with sensitivity and retention.	Deciding the basis for each purpose.
Capture consent at the front desk and in the app	The hosted consent page (by QR code at the counter), the widget in the booking flow, or the SDKs in your app. Each purpose is a separate toggle, off by default.	Choosing the moment in the patient journey.
Record paper forms and phone consents	Record consent captured elsewhere, marked as not verified by the person, in the same ledger.	Keeping the paper form.
Prove consent if a patient complains	Every choice is signed and hash-chained against the exact notice version, with a receipt and an evidence pack.
Stop health offers after a withdrawal	The verify API returns not permitted immediately; signed webhooks reach your CRM; acknowledgement deadlines flag delays.	Stopping the campaign in your tools.
Notices in the patient’s language	English and all 22 Eighth Schedule languages, with machine-translation drafts flagged for review.	Reviewing the translations.
Make vendors and partners stop and erase	A processor registry with contract dates and expiry flags; processors confirm withdrawals and erasures.	Signing the contracts.
Keep statutory records while erasing the rest	Retention obligations (legal holds) shown in the notice; a retention job and erase-on-withdrawal per purpose.	Deleting rows in your HIS and other systems.
Handle patient requests	A rights inbox with SLA timers, nomination and nominee claims, and erasure closed with a structured proof.	The answers and the medical record.
Children and guardians in apps	An age gate, guardian verification through DigiLocker, and lawful-guardian links for persons with disability. Tracking and ad purposes can never be marked child-safe.	Deciding what falls within the health exemption.
Manage a breach	A breach register with the 72-hour clock, Rule 7 notices to patients (English and Hindi) and Board documents.	Detecting and investigating.

Not included: myconsentapp does not connect to ABDM or your HIS out of the box (integration is through the API and webhooks), and it does not provide a security programme, data discovery or a full DPIA workflow.

Common mistakes

• One admission signature covering treatment, data processing, marketing and research.
• Using “medical emergency” to justify routine processing or follow-up marketing.
• Reports and images circulating in clinicians’ personal WhatsApp chats.
• Sending full check-up reports to employers who paid for them.
• Assuming a wellness app enjoys the same children’s exemption as a hospital.
• Handing patient lists to a pharma “patient support” programme without consent naming the company.
• Sharing identifiable data with a research or AI partner and calling it “anonymised”.
• Running an erasure job across the HIS without legal holds for MTP, PCPNDT and other statutory records.

Frequently asked questions

Do we need DPDP consent to treat a patient? Usually the patient voluntarily gives data to get care, so section 7(a) can apply, or you can ask for consent. Give a notice and respect rights either way. Medical consent to a procedure is a separate requirement and form.

What counts as a medical emergency under section 7(f)? A situation involving a threat to the life, or an immediate threat to the health, of the patient or another person. It covers responding to that emergency. Once the patient is stable and can decide, go back to your normal basis.

Can we treat a 16-year-old without a parent’s DPDP consent? For health services to the extent necessary to protect her health, the Fourth Schedule lifts the parental-consent requirement for clinical establishments and healthcare professionals. Consent to the treatment itself is a medical-law question. Anything beyond health services needs verifiable parental consent.

Our telemedicine app asks for contacts to “invite family”. Is that allowed? Not as part of the telemedicine consent. The Act’s own illustration says contact-list access is not necessary for telemedicine, so consent to it is limited to the telemedicine purpose. If you want an invite feature, make it optional and ask separately when the user uses it.

Can we share data with the insurer or TPA for a cashless claim? Yes, when the patient asks for the cashless claim, share what the claim needs. The insurer is a separate fiduciary and answers for its own processing, including what its TPA does on its behalf. Do not send more than the claim form asks for.

Does the research exemption let us use patient records freely? No. Section 17(2)(b) applies only where the data is not used to take a decision about the person and the processing meets the Second Schedule standards (rule 16): lawful, necessary, accurate, retained only as needed, and secured. Ethics approval still applies.

Is ABDM consent the same as DPDP consent? No. ABDM’s consent artefact governs sharing records through the ABDM network. Your DPDP notice and consent govern your own processing, such as reminders, marketing and analytics.