Security & Compliance

Patient Consent Under the DPDP Act: What an Indian Clinic Has to Collect, Purpose by Purpose

Q: Does the DPDP Act apply to a small clinic?

The Act applies to organisations that process digital personal data of individuals in India, and patient records are personal data. Whether a particular obligation applies to a particular clinic, and from when, is a question for your lawyer. This is general information, not legal advice.

Q: Is a signature on the registration form enough?

Usually not for optional purposes. Consent has to be specific to a purpose and given by a clear affirmative action, so one signature covering reminders, marketing and AI processing does not give the clinic a clean record for each.

Q: What if a patient withdraws consent but the clinic has to keep the record?

Withdrawal stops the optional processing, such as promotional messages. It does not override a legal duty to keep a medical record. Treatment record-keeping is therefore handled separately from the optional purposes.

Q: Does using CuraVerto make a clinic DPDP compliant?

No. CuraVerto provides a way to record consent per purpose, keep its history and let patients withdraw optional purposes. Compliance also depends on the clinic's own retention, security and grievance practices.

Anexshe Revedha·Cofounder & COO, CuraVerto·1 October 2026·8 min read

The 60-second version

Consent by purpose, not one signature at registration

General information, not legal advice.

Pick what you want to know

One tap jumps to that part.

Why one signature is not enough What withdrawal does A checklist for any system

See the simple version

Plain words, one picture.

Notice firstA plain-language notice that names the clinic, the data and each purpose.
Consent by purposeTreatment record, reminders, marketing and AI are different purposes.
Optional starts offMarketing broadcasts and AI scribe start as not consented and need an explicit yes.
Withdrawal is easyA patient can withdraw an optional purpose from a signed link.

This records consent. It does not by itself make a clinic compliant with the Act.

See how your clinic stands

A real person sets it up with you.

Take the free DPDP readiness check, or ask for a walkthrough of how CuraVerto records consent by purpose and keeps its history.

Ask us on WhatsApp

Four purposesCuraVerto records consent against four purposes.

New entry each timeEvery consent change is saved as a new entry and written to the audit log.

Want the detail? Read the full guide (8 min) ↓

This post is general information for clinic owners, not legal advice. Check your own obligations, and the dates on which each obligation takes effect, with a lawyer. It is the practical companion to our overview of the Act, about how consent is collected in day-to-day clinic work.

Clinics use one word for two separate things, and mixing them up causes most of the confusion.

Clinical or procedural consent

A patient agreeing to a treatment or procedure
Governed by medical practice rules and, for IVF, by the ART Act

Data-processing consent

A patient agreeing to the clinic using their personal data for a stated purpose, under the DPDP Act

A patient can give one without the other. This post is only about the second.

Under the Act, consent has to be free, specific, informed, unconditional and unambiguous, and given by a clear affirmative action.

Valid consent is

Free
Specific
Informed
Unconditional
Unambiguous

In practice that rules out a pre-ticked box, a clause buried in a registration form, and a signature that is treated as agreement to everything. It also means the patient has to be able to refuse an optional purpose without losing access to care.

The notice comes first

Before consent is asked for, the patient needs a notice in plain language.

A usable notice

Names the clinic
Says which personal data is collected
Says what each piece of data is used for
Says how to withdraw and who to contact

If the notice changes later, the clinic should be able to show which wording a given patient actually saw. That is the part paper forms handle worst: the form gets revised, and nobody can say which version was signed.

Why one signature at registration is not enough

Consent is tied to a purpose, so one blanket signature cannot be specific to each.

Purpose	Can the patient refuse it?	What the clinic needs to record
Treatment record-keeping	No. It is needed to provide care	That the notice was shown and the record is being kept for care
Appointment reminders	Yes	Consent or its withdrawal, with the date and the wording shown
Marketing and health updates	Yes	An explicit yes. Absence of a no is not consent
AI processing of consultations	Yes	An explicit yes, recorded against the patient

A patient may be happy with the first two and not the others. One blanket signature leaves the clinic unable to honour a partial withdrawal.

Withdrawal, and what it does not undo

The Act expects withdrawal to be as easy as giving consent.

What withdrawal does

A patient who withdraws an optional purpose should stop receiving that processing, for example promotional messages, within a reasonable time

What it does not do

Does not make earlier processing unlawful
Does not override a legal requirement to keep a medical record

A clinic that is asked to stop keeping treatment records still has retention duties under other rules, which is a question for your lawyer rather than a software setting.

How this works in CuraVerto

CuraVerto records consent against four purposes, with the exact notice wording generated for each.

STEP 1
Treatment record
Cannot be switched off, because it is needed for care.
STEP 2
WhatsApp reminders
Appointment reminders, recorded as their own purpose.
STEP 3
Marketing and health updates
Starts as not consented and needs an explicit yes.
STEP 4
AI scribe processing
Starts as not consented and needs an explicit yes.

When a patient is registered, whether in the clinic, over WhatsApp, through a family profile or at IVF enrolment, CuraVerto records a consent entry for each purpose together with the exact notice wording.

A consent change is never an edit

Each change, in either direction, is saved as a new entry, so the history of what the patient agreed to and when stays intact, and each entry is written to the audit log. A patient can withdraw an optional purpose themselves from a signed link, without going through the front desk. Staff-side withdrawal is limited to administrators.

A mechanism, not compliance

This is a mechanism for recording consent. It does not by itself make a clinic compliant with the Act, which also covers retention, security safeguards, breach reporting and a grievance process.

A checklist you can use with any system

Seven questions to put to any system, including a paper process.

1A plain-language noticeDoes it name the clinic, the data and each purpose?
2Consent per purposeIs consent recorded per purpose, not as one signature?
3Optional purposes offAre optional purposes off until the patient says yes?
4Which wording was seenCan you show which notice wording a given patient saw, and when?
5Withdrawal without the deskCan a patient withdraw an optional purpose without calling the front desk?
6History keptIs every consent change kept as history rather than overwritten?
7A contact shownDoes the withdrawal page show a contact for questions and complaints?

Frequently asked questions

Does the DPDP Act apply to a small clinic?

Is a signature on the registration form enough?

What if a patient withdraws consent but the clinic has to keep the record?

Does using CuraVerto make a clinic DPDP compliant?

See how your clinic stands on the DPDP Act

Take the free DPDP readiness check, or ask for a walkthrough of how CuraVerto records consent by purpose and keeps its history.

Check your DPDP readiness free →See the CuraVerto privacy commitment Chat on WhatsApp

Prefer not to use WhatsApp? Leave your number and we will call.

Your nameClinic nameMobile number

How did you hear about us? (optional)

We use your name, clinic and number only to contact you about CuraVerto. If you say how you heard of us, we keep that with your request. See our privacy policy.