Clinics hold some of the most sensitive data there is. The Digital Personal Data Protection Act, 2023 (DPDP) sets out how personal data must be handled in India, and it applies to the clinic down the road as much as to a large hospital.
Consent with a clear notice
Patients should be told, in plain language, what data is collected and why, and agree to it. MargDoc Pro keeps versioned consent notices, records which version each patient agreed to, and asks again when the wording changes.
Use data only for its purpose
Data collected for treatment should be used for treatment. Sending health tips, sharing records or recording a teleconsultation are separate purposes, and MargDoc Pro checks the matching consent before each one.
Patient rights
- To know what data the clinic holds about them.
- To have mistakes corrected.
- To have data erased when it is no longer needed, subject to the records the law requires a clinic to keep.
- To raise a grievance and get an answer.
Requests are logged, tracked to a deadline and answered from one screen, so nothing slips.
Breaches and accountability
If something goes wrong, the clinic must be able to show what happened and who was affected. Every access to patient data in MargDoc Pro is written to an append-only, tamper-evident audit log, and sensitive fields are masked unless a user's role allows them.
This article is general information for clinics, not legal advice. Confirm the details that apply to your practice with your legal adviser.