Patient data requests

Under India's DPDP Act, patients can ask for a copy of their personal data and for their data to be erased. Clinic24x7 gives patients a simple way to ask, and gives your clinic a step-by-step inbox to handle each request properly.

As the clinic, you hold the patient's records, so you verify the patient and act on the request. The Clinic24x7 team can see all requests and helps route ones that didn't reach a clinic.

How patients ask

• From your clinic website: Your data & privacy in the footer opens …/c/your-clinic/my-data.
• From clinic24x7.in/my-data, if they don't know your page. Their mobile number is looked up in every clinic on Clinic24x7, and each clinic that has it gets the request.

They give their name, the mobile number registered with you, an optional email, what they want (a copy, deletion, or both), and an optional message.

The page never says whether a number is on file. The patient always sees "If we hold records for this number, the clinic will call you". Otherwise the form would tell strangers who is a patient where.

Your inbox

Go to Data requests (Clinic Admin). "Needs action" lists open requests, oldest due first, with how long you have left. Clinic24x7 sets an internal target of 30 days per request. A red banner warns when any are past it. All shows closed ones too.

Each request shows the name and number given, what they want, their message, and which of your patients have that mobile or WhatsApp number (candidates). "Number not on file" means no patient matched; the patient may have registered with another number.

Step 1 — Check it's really them

Never share or delete anything until you've confirmed the person asking is the patient (or their parent/guardian).

1. Click Call (or Open WhatsApp chat, which opens a chat in your own WhatsApp). Click I'm calling them now to mark the request as being verified.
2. Ask things only the patient would know: date of birth, last visit, treatment received. Never share data on the call itself.
3. Under Which patient is it?, pick the matching patient, or search for them by name, patient number or another phone.
4. Choose How did you check?: Phone call to the registered number, WhatsApp call, or In person at the clinic. Add a note, for example "Confirmed DOB and last visit".
5. Click Yes, it's them — mark verified.

Couldn't verify, or it's not your patient? Use Close without acting… and choose the reason (Couldn't verify who they are, Not our patient, Duplicate, Patient changed their mind, Other).

Step 2 — Give them their data

If they asked for a copy, Give them their data offers three ways:

• Download PDF to print: a clear, branded "Your health record" report: their details, medical alerts, visits, consultations, treatment plans with prices, prescriptions, bills and payments, messages sent, and consent choices. Print it and hand it over in person.
• Data file (JSON): the same data in a standard machine-readable format (clinic24x7.patient-data/v1), for moving to another clinic or app.
• Make download link: a secure link the patient opens on their phone. It works for 7 days, and the patient must type the mobile number they asked from to open it. After 5 wrong numbers it locks.
  • The link is shown only once: copy it, or click Share on WhatsApp to open WhatsApp on your phone with a message ready. You press send.
  • Make a new link if it expired or locked. The old one stops working.
  • You can see when the link was last downloaded and how many times.

Every download, by staff or by the patient, is recorded in the audit log as an export.

Step 3 — Delete their data (if asked)

Delete their data explains exactly what will happen to the patient:

• Their phone, WhatsApp number, email, address, emergency contact and admin notes are erased.
• Every reminder and message stops, and the patient is archived.
• Treatment and billing records are kept, locked, for as long as the law requires clinical records to be kept.

Click Erase contact details…, type the patient number shown (for example PAT-000123) to confirm, and click Erase now. The patient's page then shows that their contact details were erased at their request.

Why clinical records are kept

Indian rules on medical records require clinics to keep treatment records for a number of years, and DPDP allows keeping data a law requires. Clinic24x7 therefore erases what identifies and reaches the patient, and keeps the clinical and billing record on hold. Final removal of those records after the legal retention period is being added.

Step 4 — Mark as done

Write what you did ("Shared the link on WhatsApp, patient confirmed download") and click Mark done. If the patient asked for deletion, you can only finish once the erasure is done.

The closed request is kept as your proof that the request was handled, and when.

A copy without a request

A patient asking at the front desk doesn't need to fill in the online form. On their page, Patient data (DPDP) has Download PDF and Data file (JSON).