- Home
- Industries
- DPDP for healthtech companies
Industry
DPDP for healthtech companies
Teleconsultation, diagnostics, pharmacy and health record apps hold some of the most personal data there is. DPDP gives health data no separate category, and no slack either.
Short answer
Healthtech companies are Data Fiduciaries for the patient data they decide to process, so notice (Rule 3), consent or a legitimate use (s.6, s.7), security safeguards (Rule 6) and breach intimation (Rule 7) apply from 13 May 2027. The Act does not define a sensitive personal data category; health data is personal data and the full Act applies. Rule 12 exemptions for clinical establishments and allied healthcare concern children's data only, and only within the Fourth Schedule's conditions.
Where personal data sits in healthtech
- Patient profiles: name, age, mobile number, address, and family members booked through the same account.
- Clinical records: consultation notes, prescriptions, lab reports, discharge summaries and scans uploaded by patients or doctors.
- Health identifiers: ABHA numbers and ABHA addresses where your product links to them.
- Teleconsultation: video, chat and call records, and doctors' own personal data such as registration and bank details.
- Pharmacy and diagnostics: prescriptions sent for fulfilment, home sample collection addresses, and details of collection and delivery staff.
- Insurance and payments: claim documents and cashless requests shared with insurers or third-party administrators.
- App and device data: symptoms, vitals and activity that users log or sync from wearables.
Patient data also leaks into places nobody planned: support tickets with prescriptions attached, chat exports, and spreadsheets used to reconcile lab orders.
DPDP duties that bite hardest
| Duty | Section or rule | What it means in this sector |
|---|---|---|
| Specific, informed consent | s.6, Rule 3 | Separate purposes: the consultation, sharing reports with a lab, research, and marketing. One bundled tick does not make consent specific. |
| Emergencies | s.7(f), s.7(g) | Processing to respond to a medical emergency threatening life or health, or to an epidemic or threat to public health, is a legitimate use. It is not a general basis for routine product features. |
| Children's data | s.9, Rule 10, Rule 12 | Patients under 18 need verifiable parental consent unless a Part A exemption for clinical establishments or allied healthcare applies, within its conditions. |
| Accuracy | s.8(3) | Records used for clinical decisions or shared with other providers must be complete, accurate and consistent. |
| Security safeguards | s.8(5), Rule 6 | Encrypt or mask records, restrict who can open them, log and review access, keep those logs for a year, and put security terms in processor contracts. |
| Erasure and retention | s.8(7) | Erase when the purpose is served, unless a law requires you to keep the record. Set a period per record type. |
| Breach intimation | Rule 7 | Tell affected patients and the Board without delay, with a detailed report to the Board within 72 hours. |
Roles: fiduciary or processor
A platform that runs its own consultations or pharmacy decides the purpose and means, so it is a Data Fiduciary. A software vendor that hosts records for a hospital and uses them only on the hospital's instructions is usually a Data Processor, bound by a contract (s.8(2)).
Labs, clinics and doctors on a marketplace are often fiduciaries in their own right for the care they provide. Decide each relationship on who determines purpose and means, write it down, and agree who answers patients' rights requests.
Rule 12 lifts s.9(1) and s.9(3) for classes in Part A of the Fourth Schedule, such as clinical establishments and allied healthcare, only within the conditions stated there. It concerns children's data only and does not exempt adult patient data from anything. Read the conditions with counsel, and check your regulator's directions, including any ABDM requirements, alongside DPDP.
A 90-day starting plan
- 01Days 1 to 30: find patient data
Scan record stores, file buckets and support tools for ABHA identifiers, mobile numbers and uploaded reports. List every lab, clinic, pharmacy and software partner that receives patient data.
- 02Days 31 to 60: rebuild consent
Write a Rule 3 notice for each purpose and separate care from research and marketing. Add a parental consent flow for minors unless counsel confirms an exemption applies.
- 03Days 61 to 90: secure and respond
Restrict and log access to records, set retention per record type, publish the Rule 9 contact, and rehearse a Rule 7 breach with your clinical and engineering leads.
How TruePrivacy helps
- Classification detects ABHA numbers and ABHA addresses, Aadhaar, Indian mobile numbers and names, including names in Devanagari, with samples masked before they leave the source.
- Consent management records consent per patient and purpose, with receipts and an event log of every grant and withdrawal.
- Parental consent sends the guardian a request by email, records the decision with a timeline and evidence, and lets it be revoked.
- Vendors and processors keeps records, assessments and contracts for labs, software vendors and other partners.
- Breach management runs the Rule 7 clocks, and retention applies rules per data category with a log of every execution.
Does DPDP treat health data as sensitive personal data?
The Act does not define a sensitive personal data category; the older SPDI Rules did. Health data is personal data under DPDP, and every duty applies to it.
Are clinics exempt from parental consent for children?
Rule 12 says s.9(1) and s.9(3) do not apply to clinical establishments and allied healthcare in Part A of the Fourth Schedule, but only within the conditions stated there. Read them with counsel before relying on them.
Can we process patient data in an emergency without consent?
Yes. Responding to a medical emergency threatening a person's life or health is a legitimate use under s.7(f). Record the event and the reason.
Is a diagnostic lab our processor?
Only if it processes data on your instructions. If the lab decides why and how it uses the data, it is a fiduciary for that processing.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin