ConsentKit DPDP
Free readiness check Book a demo

For clinics, dental and specialist practices, and doctors

DPDP compliance for clinics and doctors

A clinic may be small, but the DPDP Act has no size threshold. Your appointment app, practice software and WhatsApp reminders all hold patient data. ConsentKit gives you a compliant booking notice, reminder consent and a simple way to answer patient requests.

Check your clinic’s readiness See where DPDP applies
Size threshold
None
WhatsApp reminders
Need consent
Full compliance
13 May 2027
drmehtasclinic.inBook an appointment

Dr Mehta’s Clinic asks for your consent

Choose how we may use your details. You can change this anytime.

Withdraw consent anytime
Consent logRecording

    Where the DPDP Act touches a clinic visit

    Most clinic data moves through booking apps, practice software and phones. Pick a stage to see what applies.

    What changes for your clinic on 13 May 2027

    Clinics don’t need an enterprise programme, but they do need the basics in place.

    A clear notice at bookingSections 5 and 6

    Patients should know what you collect and why when they book, whether online, by phone or at the desk.

    A booking notice for your website and a QR-code notice for the reception desk.

    Separate consent for reminders and marketingSection 6

    Appointment reminders and health-camp promotions are different purposes. Patients can say yes to one and no to the other.

    Per-purpose choices with a one-tap opt-out in every message.

    Before-and-after photos need consentSection 6

    Using treatment photos in ads or on social media is a separate purpose from keeping them in the record.

    A photo-use consent recorded per patient, with easy withdrawal.

    Patients can ask for their dataSections 11 to 14

    Patients can request a summary, correction or erasure where the law allows, and raise grievances.

    A simple request form and a queue with due dates.

    Basic security is mandatorySection 8(5) and Rule 6

    Individual logins, encrypted devices, backups and access logs kept for at least a year.

    A security checklist sized for small practices.

    A breach means telling patientsRule 7

    A stolen phone or hacked practice software must be reported to the Board and to affected patients.

    Breach templates ready to send within 72 hours.

    What the healthcare exemptions cover

    The DPDP Act lets you process data without consent to respond to a medical emergency. The Rules also exempt clinical establishments and healthcare professionals from verifiable parental consent when treating a child, to the extent needed to protect the child’s health. Neither is a blanket exemption.

    Usually coveredEmergency care, treating a minor, records the law requires you to keep.
    Usually not coveredMarketing health packages, sharing with pharma or insurers beyond the claim, reviews and testimonials.

    This is general guidance, not legal advice. Confirm how it applies to you with your counsel.

    A plan for a busy practice

    Most clinics can be compliant in a few weeks of part-time work.

    1. List your tools

      Booking apps, practice software, WhatsApp numbers, labs and pharmacies you share with.

    2. Put notices live

      Add booking and reception notices, and split reminders from marketing.

    3. Lock devices and software

      Individual logins, encrypted phones and a backup routine.

    4. Publish a contact

      Name who handles data questions and train your front desk.

    For every kind of practice

    Simple templates for small teams.

    Single-doctor clinics

    Set up in an afternoon.

    Polyclinics

    Several doctors, one patient record.

    Dental practices

    Imaging, treatment plans and photo consent.

    Dermatology and cosmetic clinics

    Before-and-after photos and marketing.

    Physiotherapy centres

    Session tracking and home visits.

    Teleconsultation practices

    Video consults and e-prescriptions.

    DPDP compliance for clinics near you

    Local guidance and onboarding in these cities, with support from our team in Kolkata.

    Related sectors

    HospitalsPatient records, insurer sharing, and access requests from patients and nominees.Diagnostic labsSample and report data, home collection, report delivery on WhatsApp.Gyms and fitness studiosMember details, body measurements and trainer access.

    Questions doctors are asking

    For the full picture, read our DPDP Act guide or compliance checklist.

    Does the DPDP Act apply to a single doctor’s clinic?

    Yes. There is no size threshold. If you hold patient data digitally, in software, on a phone or in WhatsApp, you are a data fiduciary.

    Can I send appointment reminders on WhatsApp?

    Yes, with the patient’s consent for reminders. Keep promotional messages as a separate choice.

    Can I post before-and-after photos?

    Only with the patient’s specific consent for that use, and you must remove them if they withdraw.

    What about the booking platform I use?

    For your patients’ data, the platform may be your processor. Check its terms and what it does with the data, and tell patients in your notice.

    Do I need a data protection officer?

    No, unless you are notified as a Significant Data Fiduciary. You do need to publish a contact for data questions.

    Get your clinic ready in a few weeks

    The readiness check takes about ten minutes and gives you a short, practical gap report for your clinic.

    Check your clinic’s readiness Book a demo