Health data and the DPDP Act 2023
The position on health data, including the parts that are not yet settled.
Five
Purpose limitation
Data is collected for care and for the programme it was collected under, and not repurposed silently.
Data minimisation
The emergency view is deliberately small. The full record is no larger than the care requires.
Residency
Health data is held in India.
Security
End-to-end encryption in transit and at rest, with audit of every read and write.
Rights
Access, correction, withdrawal of consent and erasure, subject to any statutory retention that applies to medical records.
Stated openly
The fiduciary position and operating entity
Which entity operates the service determines the data fiduciary position, the residency obligation and the notification duties. This requires counsel rather than engineering, and it is a hard gate before real patient data is entered into any environment. Field testing is conducted on synthetic records with no identifiers until it is closed.
What we do
Detect
Audit-log monitoring, anomaly alerting and support intake.
Contain and assess
Scope established and exposure closed.
Notify
The Data Protection Board and affected individuals within the statutory period; where we are processor, immediately the clinic that is fiduciary.
Review
Post-incident, with remediation tracked to closure.
Read the full register.
Every item, with its gate.