Patient consent (DPDP)
How Clinic24x7 records patients' consent to data processing and to messages, and how to update it when a patient changes their mind.
India's Digital Personal Data Protection Act, 2023 (DPDP) says you need a clear basis to use a person's data, and that people can withdraw consent. Clinic24x7 records two kinds of consent for every patient.
| Consent | What it covers | Required? |
|---|---|---|
| Core processing | Using the patient's data to provide clinical care: records, appointments, billing | Yes. A patient can't be registered without it |
| Communications | WhatsApp, SMS and email messages: reminders, recalls, follow-ups, birthday wishes | No. Optional, and can change at any time |
These are about data. Consent to a treatment (for example an extraction) is a separate signed form; see Consent forms.
At registration
The registration form (and the lead conversion form) has two tick boxes, both unticked:
- Patient consents to their data being processed to provide clinical care — required.
- Patient consents to WhatsApp/SMS/email communications — optional.
Ask the patient, then tick what they agree to. Never tick on their behalf without asking.
Each choice is saved as a consent event: what was agreed, when, by whom (Self or a relationship such as Parent/Guardian), and the version of your privacy notice at the time.
Seeing a patient's consent
On the patient's page, Data consent (DPDP) shows the current status of each purpose: Granted, Withdrawn, or Not yet captured (for example patients imported from a spreadsheet).
View consent history opens the full log. Events are never edited or deleted. A change adds a new event, so you can always show what the patient agreed to and when.
When a patient changes their mind
On View consent history, record a new event for the purpose (Data processing for clinical care or WhatsApp/SMS/email communications):
- Withdraw consent if the patient doesn't want messages any more. Optionally add a Reason (why the patient is withdrawing, if known). From that moment no automatic message goes to them.
- Grant consent if they now want reminders.
Core-processing consent is needed to keep treating the patient. If a patient wants their data no longer used at all, that's a data request: see Patient data requests.
Patients with no consent record
Patients imported, or registered before consent capture existed, show Not yet captured. They're treated as not having withdrawn, so messages still go to them. Capture consent at their next visit.
Good practice
- Make your privacy notice available at the front desk and on your website.
- Train staff to ask, not assume.
- Record withdrawals the same day a patient asks.
Last updated 2026-10-29