DPDP Impact Study: Health-Tech, Telemedicine and E-Pharmacy

Executive summary

Health-tech platforms sit between patients and the people who treat them. A teleconsultation app connects a patient with a doctor; an e-pharmacy routes a prescription to a chemist; a wearable streams heart-rate data to a phone. Most of this processing happens on the platform's own initiative, not on a hospital's instructions.

Overall impact: High. The main obligations of the Digital Personal Data Protection Act, 2023 (the DPDP Act) and the DPDP Rules, 2025 commence on 13 May 2027.

The three biggest changes:

First, consent becomes a product feature. Unlike a hospital, a platform has few "legitimate uses" to fall back on. Symptom checkers, wearable sync, reminders, personalised offers and AI features all need specific, separately withdrawable consent, with notices that itemise the data.

Second, children's data is harder than it looks. The Rules exempt clinical establishments and healthcare professionals from parental-consent and monitoring limits when treating a child, an exemption drafted around the provider, not the platform. Paediatric and teen-facing apps will usually need verifiable parental consent and must not track children or target advertising at them, with penalties of up to ₹200 crore.

Third, e-pharmacy still lacks final sector rules. The 2018 draft rules, which would keep patient data confidential and in India, remain unfinalised. Platforms must build to the DPDP Act, drug-retail rules and e-commerce rules now.

Trayambic's article on hospitals, diagnostics and IVF clinics covers record retention for providers. This study covers the platform layer.

Background

The sector covers several business models, often in one app:

• Teleconsultation by audio, video or chat with registered medical practitioners (RMPs).
• E-pharmacy, as a marketplace for licensed retailers or as an inventory model.
• Diagnostics booking with home sample collection by partner laboratories.
• Personal health records, including ABDM-linked health lockers.
• Wearables and remote monitoring.
• Condition-specific apps for chronic disease, mental wellbeing, pregnancy, period tracking and paediatric care.
• AI tools such as symptom checkers and report explainers.

Data types include identity and contact details, prescriptions and their images, consultation chats and recordings, test results, device readings, delivery addresses, payment data, device identifiers and in-app behaviour.

The data principals (the individuals whose data is processed) are patients, the parents of child patients, carers who book on behalf of elderly relatives, and the doctors, pharmacists and delivery staff on the platform.

The vendor chain is long: cloud, video, messaging, payments, analytics SDKs, ad networks, AI model providers, logistics and laboratories. Some are data processors, acting only on the platform's instructions. Others, such as the treating doctor or the dispensing pharmacy, decide purposes of their own and are separate data fiduciaries, the term the Act uses for whoever determines why and how data is processed.

Legal framework

The DPDP provisions that matter most

• Consent and notice (ss.5, 6; Rule 3). Consent must be free, specific, informed, unconditional and unambiguous, by clear affirmative action, and limited to necessary data. Withdrawal must be as easy as giving it. Notices itemise data and purposes.
• Legitimate uses (s.7). Section 7(a) covers data a user voluntarily provides for a specified purpose, such as an address for a delivery. The emergency and epidemic grounds (s.7(f), (g)) rarely fit a platform's ordinary business.
• Children (s.9; Rules 10, 12). Verifiable parental consent before processing a child's data; no processing likely to harm a child's well-being; no tracking, behavioural monitoring or targeted advertising directed at children. Rule 10 lets platforms verify the parent from details already held or through a virtual token from an authorised entity, such as DigiLocker.
• Fiduciary duties (s.8; Rules 6 to 8). Responsibility for processors; security safeguards; breach notice to each affected user and the Board, with a 72-hour detailed report; erasure when the purpose ends. Under Rule 8 and the Third Schedule, an e-commerce entity with at least two crore registered users in India must erase data after three years without engagement, with 48 hours' notice.
• Rights (ss.11 to 14; Rule 14). Access, including the identities of other fiduciaries and processors the data was shared with; correction and erasure; grievance redressal within 90 days; nomination.
• Significant Data Fiduciaries (s.10; Rule 13). Annual DPIA and audit, an India-based DPO, algorithmic due diligence and possible localisation of specified data, if designated.

Sector instruments

How the regimes interact

Section 38(1) applies the DPDP Act in addition to these instruments; s.38(2) makes it prevail in a conflict. Most sector rules here add duties of confidentiality, record-keeping and grievance handling rather than permissions to process.

Section 16(2) matters more. The DPDP Act itself restricts transfers abroad only to countries the Centre notifies, and none are notified. But any law giving a higher degree of protection or stricter restriction on transfers continues to apply. If the e-pharmacy rules are finalised with the draft's localisation clause, that clause will override the Act's permissive default for e-pharmacy data. Platforms choosing cloud regions and AI providers today should plan for it.

Analysis

The Trayambic DPDP Impact Scorecard

Overall impact: High

Who is the fiduciary: platform, doctor or pharmacy?

A teleconsultation involves at least two fiduciaries. The doctor decides what clinical information to record; the Guidelines put record-keeping on the RMP. The platform decides how the consultation is delivered, what is stored and what else the data is used for. Where it uses consult data for its own purposes, such as offers, doctor rankings or model training, it is a fiduciary in its own right.

This matters in three ways.

• Responsibility for breaches. Paragraph 3.7.1.3 of the Guidelines says an RMP is not held responsible for a confidentiality breach where there is reasonable evidence that it was caused by a technology breach or a third party. Under the DPDP Act, the platform carries that risk as fiduciary for its own processing, and as processor under contract for anything it does on a doctor's behalf.
• Access requests. Section 11(1) entitles the user to know the identities of other fiduciaries and processors her data was shared with. A marketplace that routes prescriptions to many partner pharmacies must be able to list, per user, which pharmacy received what.
• Contracts. Doctor and pharmacy agreements should say who is fiduciary for which data, who answers requests, who notifies breaches and who deletes what. Trayambic's vendor-contract checklist covers processor terms; platforms also need this fiduciary-to-fiduciary allocation.

Consent as the product: wearables, AI features and health lockers

Platforms cannot lean on s.7 the way hospitals can. A user who books a consultation gives her phone number and symptoms for that purpose, and s.7(a) covers that. It does not cover syncing her smartwatch, scoring her risk, sending her supplement offers or feeding her chats into a model. Each needs consent that is specific to the purpose and limited to the necessary data.

Wearables. Continuous streams are where "necessary for the specified purpose" bites. A sleep feature does not need location. Consent should be granular by data type, and withdrawal should stop collection on the device.

AI features. Paragraph 5.4 of the Guidelines bars AI from counselling patients or prescribing; an RMP must do that. The ICMR's 2023 guidelines add that consent must be obtained before running a predictive algorithm on patients and that data should be anonymised unless identity is essential. Trayambic's article on training AI on personal data covers model training. For platforms, the practical rule is to separate "AI explains your report" (a feature the user opts into) from "your data improves our models" (a distinct purpose needing its own consent or genuine anonymisation).

Health lockers. Apps that act as ABDM health lockers fetch records from hospitals through consent artefacts, and the ABDM guidelines bind a health information user to the retention period set in each artefact. The ABDM consent manager is not the same thing as a consent manager under the DPDP Act. DPDP consent managers must register with the Board under Rule 4 from 13 November 2026, with a net worth of at least ₹2 crore. An app that wants to offer consent management across non-ABDM fiduciaries needs that registration; Trayambic's article on consent managers explains the regime.

Consent screens also face consumer law, covered in Trayambic's article on dark patterns and consent design.

Children: the Fourth Schedule does not travel to platforms

Part A of the Fourth Schedule exempts a data fiduciary that is a clinical establishment, a mental health establishment or a healthcare professional from s.9(1) and s.9(3), but only for providing health services to the child, to the extent necessary to protect the child's health. The terms take their meaning from the Clinical Establishments Act, 2010, the Mental Healthcare Act, 2017 and the National Commission for Allied and Healthcare Professions Act, 2021.

A doctor consulting a child on a platform is within the exemption for that consultation. The platform, in Trayambic's view, usually is not: it is a technology business, not a clinical establishment, and no court or regulator has said otherwise. The safer course is to treat its own processing of children's data as unexempted.

Three consequences follow:

1. 1.Verifiable parental consent under Rule 10 is needed for a child's account, using details already held about an identifiable adult or a virtual token such as DigiLocker.
2. 2.No tracking or targeted advertising. Growth trackers, vaccination reminders and teen wellness apps must strip behavioural analytics and ad SDKs from child profiles. Part B of the Fourth Schedule permits limited processing, such as verifying that a user is not a child, but not ad targeting.
3. 3.Teen users. Period-tracking and wellbeing apps attract 16 and 17 year olds, whom the Act treats as children. Age assurance at sign-up and a parent-linked account for under-18s is the realistic design.

Trayambic's article on children's data in schools and ed-tech covers verifiable consent mechanics in more depth.

E-pharmacy: a data regime still in draft

The Ministry of Health published draft e-pharmacy rules as G.S.R. 817(E) on 28 August 2018. They have been litigated in the Delhi High Court since 2018 and, as far as we could find, have not been finalised as of October 2026.

That leaves e-pharmacies with three sets of rules that do apply now, and one that may:

• Drug-retail records. Schedule H1 supplies must be recorded in a separate register kept for three years. That obligation falls on the licensed retailer, but the platform usually hosts the data, so its deletion jobs must not erase it early.
• E-commerce rules. A marketplace must display seller details and run a grievance officer who acknowledges complaints within 48 hours. Running one grievance desk for both regimes, on the shorter consumer-law clock, is simpler than two.
• DPDP retention. Where an e-pharmacy is an e-commerce entity with at least two crore registered users, Rule 8 requires erasure after three years without engagement, subject to retention required by law. Prescription records held for the retailer's legal duty survive; marketing profiles do not.
• The draft. Draft rule 67K would bar use of customer information for other purposes and require data to stay in India. Platforms that today send prescription images to foreign AI or OCR services should ask whether they could switch to India-hosted processing if the draft is finalised.

Worked example: a consult-and-pharmacy app adds new features

A mid-size health app offers video consultations with empanelled doctors, medicine delivery through partner pharmacies and ABDM-linked record storage. Before May 2027 it plans three launches: a paediatric section, smartwatch sync and an AI report explainer.

Its DPDP review finds:

1. 1.Roles. Doctor contracts are silent on access requests. A new clause makes the app handle all user requests and route clinical corrections to the treating doctor.
2. 2.Paediatrics. A tick-box let a parent add a child. It is replaced with Rule 10 verification using the parent's own verified account, and the analytics SDK is switched off on child profiles.
3. 3.Smartwatch sync. The app asked for every sensor. It now requests heart rate and sleep only, each with its own toggle.
4. 4.AI explainer. Reports went to a foreign model API with names attached. The app now strips identifiers, records consent for the feature, keeps a doctor review step for anything resembling advice, and logs the draft localisation clause as a risk.
5. 5.Retention. A blanket 90-day deletion job would have erased prescription records partner pharmacies must keep. The job now excludes them and deletes marketing data after inactivity.

None of this needed new technology. Each fix needed someone to decide, in writing, which law applied to which data.

Compliance framework

Phased roadmap to 13 May 2027

• Now to December 2026: build the feature-by-feature data map; list every SDK and API receiving health data; decide whether to integrate a registered consent manager once Rule 4 is live.
• January to March 2027: ship redesigned consent and parental-consent flows; sign role-allocation and processor contracts; separate AI consents.
• April to May 2027: switch on retention jobs with legal-hold exceptions; publish the rights and grievance process; run a breach drill that notifies a test group of users.
• Ongoing: review new features against the data map; monitor the e-pharmacy rules and Board guidance.

Recommendations

1. 1.Treat every feature as a separate purpose with its own consent and withdrawal.
2. 2.Write down who is fiduciary for consult, prescription and lab data, and put it in every partner contract.
3. 3.Assume the Fourth Schedule exemption covers the doctor, not the platform, and design child accounts around verifiable parental consent with no trackers.
4. 4.Remove identifiers before sending health data to AI services, and never let AI give advice without an RMP in the loop.
5. 5.Build retention around legal holds: keep what pharmacies and doctors must keep, delete everything else on schedule.
6. 6.Prefer India-hosted processing for prescription data while the e-pharmacy rules remain in draft.
7. 7.Run one grievance and rights desk on the strictest applicable timeline.

Key takeaways

• Platforms have few legitimate uses to rely on, so wearable sync, AI features, reminders and offers each need specific, withdrawable consent.
• The Fourth Schedule exemption for treating children is drafted for clinical establishments and healthcare professionals; platforms should plan for verifiable parental consent and no tracking or targeted ads.
• Doctor, pharmacy and lab contracts must allocate fiduciary roles, rights handling and breach notice, because users can ask whom their data was shared with.
• The 2018 draft e-pharmacy rules, with confidentiality and India-storage clauses, remain unfinalised; design for them anyway.
• Retention jobs must keep Schedule H1 and consultation records required by law while deleting marketing and inactive-user data.