The Act
What the DPDP Act means for a clinic
The Act concerns personal data — information about an identifiable person. A clinic or hospital holds a great deal of it: patient names, phone numbers and appointment details. Because that data moves through everyday tools, the Act reaches further than a policy document. It covers the reminder message, the WhatsApp chat and the enquiry form as much as the clinical record. Three ideas run through it: consent, using data only for the purpose it was given for, and giving people a way to access, correct or erase their data and raise a grievance.
Consent
Patient data is collected and used with the patient's agreement, taken at the point of contact.
Purpose
Data is used for the purpose it was given for. Details shared to book an appointment are used for that appointment.
Access, correction and grievance
People should have a way to ask to see, correct or erase their data, and to raise a complaint about how it was handled.
In practice
Where patient data shows up in daily work
In most clinics the data is not sitting in one secure place waiting to be reviewed. It is being created constantly, by ordinary work: a form filled in on the website, a number typed into a phone, a reminder sent before a visit, a list built for a campaign.
Enquiry forms and call logs
A name and phone number entered on your website, or written down after a call, is patient data from the moment it arrives.
WhatsApp conversations
Chats with patients — on an official number or a staff handset — are records of communication with them.
Appointment reminders and follow-ups
Messages sent before and after a visit use contact details for a particular purpose.
Marketing campaigns and lead lists
Lists built from enquiries are personal data, and messaging from them relies on the agreement given when the details were collected.
Shared inboxes and personal phones
When conversations sit on a personal device, it is harder to know what was collected, who can see it, and what happens when someone leaves.
First steps
Practical first steps
Readiness usually begins with a handful of habits rather than a new system. These are good places to start.
Ask for and record consent
Take consent before messaging a patient, and keep a record of when and how it was given.
Use data only for its purpose
Patient data is used for the purpose it was collected for. Anything else needs a fresh agreement.
Avoid sending clinical records over chat
Reports, prescriptions and diagnoses stay in your existing systems and are shared through the channels your clinicians already use.
Keep conversations in official channels
Patient chats sit in a shared, official number and inbox rather than on a personal phone.
Know who handles requests
One named person or team handles requests to access, correct or erase data, and any grievance.
Working with 1flo
How 1flo can help
1flo is a TTBS Authorised Channel Partner based in Hyderabad. We assess your current patient communication and security baseline, then plan practical improvements with you in order of what matters most. Where specialist expertise is needed, we work with qualified specialist partners.
1flo provides readiness support. This is not legal advice or certification. Please consult a qualified legal adviser for your obligations.
FAQ