The personal data you hold
- Patient names, ages, phone numbers and addresses
- Medical history, prescriptions, reports and images
- Payment and insurance details
- Appointment reminders sent on WhatsApp or SMS
- Data of children (paediatric patients)
What to do
- Publish a short notice at reception and online in English and Hindi, and link it on appointment slips.
- Take separate consent for reminders and marketing messages; treatment-related processing may be a legitimate use, but marketing is not.
- Limit who can open patient records; use individual logins, not one shared password.
- Agree data terms with your lab partners, billing software and SMS provider.
- Keep medical records for the period required by medical regulations, then delete.
- Get a parent’s consent for patients under 18.
- Write a breach plan: lost laptop, wrong WhatsApp forward, hacked email.
See the full 13-step DPDP checklist or set up your notice and consent log free.
Frequently asked questions
Do I need patient consent to treat them?
Processing needed to provide the treatment a patient asked for, or in a medical emergency, can fall under legitimate uses. Marketing, feedback requests and newsletters still need clear consent.
Can I send appointment reminders on WhatsApp?
Yes, if the patient gave their number for that purpose and was told so in your notice. Promotional messages need separate consent.
Get DPDP-ready without a lawyer’s bill
ConsentKaro writes your privacy notice in English and Hindi, logs consent, and handles customer data requests. 14-day free trial, no card.
Start free trial → Take the free DPDP check