DPDP Act checklist for clinic and hospital websites

Clinic websites collect more personal data than most: names, phone numbers, symptoms typed into appointment forms, sometimes reports and prescriptions uploaded as files. Under India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, the clinic is the Data Fiduciary for all of it, including what its website vendor or booking app collects on its behalf.

Appointment and enquiry forms

• Show a short notice next to each form: what you collect, why, and how to withdraw consent or raise a grievance.
• Ask for consent with an unticked checkbox the patient ticks themselves. A box ticked in advance isn't consent.
• Collect only what the appointment needs. A booking form rarely needs date of birth, address or an uploaded report.
• If parents book for children, the Act requires verifiable consent from a parent or guardian for a child's data.

Trackers, ads and chat

• Analytics and ad pixels on a page where people describe symptoms can reveal health information. Load them only after the visitor agrees.
• Check what your WhatsApp or chat widget sends to its provider, and name that provider in your notice.
• Don't send patients' names or phone numbers to ad platforms for remarketing without their consent.

Behind the website

• Make sure enquiries reach a mailbox or system with access control, not a shared inbox everyone uses.
• Decide how long you keep enquiries and booking details, and delete them after that.
• Name a person who answers privacy questions and publish how to reach them.
• Know what to do in a breach: inform the Data Protection Board and affected patients, and report cyber incidents to CERT-In within 6 hours.

Most of the Act's duties apply from 2027 under the Rules' phased timeline, so there's time to fix these in an orderly way. This guide is a summary, not legal advice.