DPDP Compliance for HealthTech
Sensitive Health Data
- Separate, explicit consent for each health data category
- Medical history, genetic data, mental health require individual consent
- Re-consent if use changes
Patient Record Security
- End-to-end encryption for all records
- Access logging mandatory
- Retain only during care period + 7 years (legal requirement)
Telemedicine Compliance
- Obtain explicit consent before recording consultations
- Encrypt all recordings
- Delete after retention period (typically 7 years)
Data Sharing & Research
- Cannot share patient data with researchers without consent
- De-identified data still requires consent
- Maintain consent records for audit
Disclaimer: General informational article. Consult medical law experts.
