Treatment is nota blank cheque.

The patient consented to care. Everything built on top of care needs its own permission.

In one line: Marketing is a separate purpose from treatment. It generally requires specific, freely given consent that the patient can refuse without affecting care.

The estate · Healthcare & PharmaHover to inspect

The emergency justifies the stretcher. It does not justify the newsletter.

The scene

A patient registered at the emergency desk at midnight. By morning her number was in the hospital's CRM. By the next week she was receiving offers for a full-body check-up package. She never gave consent to marketing. She was barely conscious when she gave her number.

Where the thinking breaks

The unclear thoughtWhat it breaksThe clearer thought
Patients agree to everything at admission. Admission forms bundle purposes; DPDPA consent must be specific to each. Separate care, billing and marketing into distinct asks.
Medical data can be processed without consent. Section 7's medical legitimate uses are for emergencies and threats to life or health, not routine commerce. Use legitimate uses only where they plainly fit.

A three-column register

Care: what treatment needs. Compliance: what law requires. Commercial: everything else. Only the third column should ever reach marketing, and only with consent.

Monday morning

  1. 01Read your admission form as a patient would.
  2. 02Count the purposes bundled into one signature.
  3. 03Split marketing consent out, and make it optional.

Questions, answered plainly

Can hospitals use patient data for marketing under DPDPA?

Marketing is a separate purpose from treatment. It generally requires specific, freely given consent that the patient can refuse without affecting care.

When can health data be processed without consent under DPDPA?

Section 7 allows processing for responding to a medical emergency involving a threat to life or immediate threat to health, and for certain health services during epidemics or public health threats, among other listed uses.

Sector · Healthcare & PharmaThe Act has no 'sensitive' category. Your patients do.Read → Healthcare & Pharma · Deep diveThe report on WhatsApp is still your report.Read → Healthcare & Pharma · Deep diveConsent for the trial is not consent for the product.Read →

Tell us where your data sits.We'll show you where the exposure is.

A partner replies within one working day, with a first view on your penalty exposure.

Speak to a partner