Who is responsible
Your clinic decides why and how patient data is used, so under the Act it is the data fiduciary. Software companies that store and process records for you, like DentoBlaze, are data processors: they act only on your instructions, under a contract. The fiduciary stays responsible, which is why the processor you choose matters.
Notice and consent
- Tell patients, in plain language, what personal data you collect, why, how they can exercise their rights and how to complain to the Data Protection Board of India.
- Consent must be free, specific, informed and unambiguous, and as easy to withdraw as to give. Treating a medical emergency is a recognised exception.
- Keep a record of consent for things patients can say no to, such as WhatsApp reminders.
Children
For anyone under 18, verifiable consent of a parent or lawful guardian is generally required. The Rules include exemptions for healthcare providers to the extent needed to provide health services; check how they apply to your clinic.
Security and breaches
- Take reasonable security safeguards: access by role, encryption, logs, backups and staff awareness.
- If a personal data breach happens, the Board and affected patients must be told. Have a plan before you need it.
- Don't keep personal data longer than you need it, subject to the clinical records you must keep by law.
Patients' rights
Patients can ask what you hold about them, ask for corrections or erasure, withdraw consent, nominate someone to act for them, and complain. Publish a contact for these requests and answer them within the time the Rules allow.
Your software vendor
Ask any clinic software vendor:
- Where is the data stored, and who else processes it?
- Is each clinic's data kept separate, and can staff access be limited by role?
- Is consent recorded, and is there an audit trail?
- How quickly will they tell you about a breach?
- Can you export everything and leave, and what happens to your data when you do?
DentoBlaze's answers are on our Security & privacy page and in our draft data processing terms.
A starting checklist
- Put a short privacy notice at the front desk and on your booking page.
- Record consent for WhatsApp messages and keep that record.
- Give each staff member their own login, with only the access their job needs.
- Name a person to handle patients' data requests and complaints.
- Agree data processing terms with every software vendor.