This post is general information for clinic owners, not legal advice. Check your own obligations, and the dates on which each obligation takes effect, with a lawyer. It is the practical companion to our overview of the Act: that post lists what a clinic must do, and this one is about how consent is collected in day-to-day clinic work.
Clinics use the word for two separate things, and mixing them up causes most of the confusion. Clinical or procedural consent is a patient agreeing to a treatment or procedure. That is governed by medical practice rules and, for IVF, by the ART Act, and we cover it in the post on ICMR and ART Act consent documentation. Data-processing consent under the DPDP Act is a patient agreeing to the clinic using their personal data for a stated purpose. A patient can give one without the other. This post is only about the second.
Under the Act, consent has to be free, specific, informed, unconditional and unambiguous, and given by a clear affirmative action. In practice that rules out a pre-ticked box, a clause buried in a registration form, and a signature that is treated as agreement to everything. It also means the patient has to be able to refuse an optional purpose without losing access to care.
Before consent is asked for, the patient needs a notice in plain language. A usable notice names the clinic, says which personal data is collected, says what each piece of data is used for, and tells the patient how to withdraw consent and who to contact. If the notice changes later, the clinic should be able to show which wording a given patient actually saw. That is the part paper forms handle worst: the form gets revised, and nobody can say which version was signed.
Consent is tied to a purpose. Keeping a treatment record, sending appointment reminders, sending promotional messages and processing a consultation with AI software are different purposes. A patient may be happy with the first two and not the others. One blanket signature cannot be specific to each, and it leaves the clinic unable to honour a partial withdrawal.
| Purpose | Can the patient refuse it? | What the clinic needs to record |
|---|---|---|
| Treatment record-keeping | No. It is needed to provide care | That the notice was shown and the record is being kept for care |
| Appointment reminders | Yes | Consent or its withdrawal, with the date and the wording shown |
| Marketing and health updates | Yes | An explicit yes. Absence of a no is not consent |
| AI processing of consultations | Yes | An explicit yes, recorded against the patient |
The Act expects withdrawal to be as easy as giving consent. A patient who withdraws an optional purpose should stop receiving that processing, for example promotional messages, within a reasonable time. Withdrawal does not make earlier processing unlawful, and it does not override a legal requirement to keep a medical record. A clinic that is asked to stop keeping treatment records still has retention duties under other rules, which is a question for your lawyer rather than a software setting.
CuraVerto records consent against four purposes: treatment record-keeping, WhatsApp appointment reminders, marketing and health updates, and AI scribe processing. When a patient is registered, whether in the clinic, over WhatsApp, through a family profile or at IVF enrolment, CuraVerto records a consent entry for each purpose together with the exact notice wording generated for that purpose. Marketing broadcasts and AI scribe start as not consented and need an explicit yes. Treatment record-keeping cannot be switched off, because it is needed for care.
A consent change is never an edit. Each change, in either direction, is saved as a new entry, so the history of what the patient agreed to and when stays intact, and each entry is written to the audit log. A patient can withdraw an optional purpose themselves from a signed link, without going through the front desk, and the page shows the clinic's data contact. Staff-side withdrawal is limited to administrators.
This is a mechanism for recording consent. It does not by itself make a clinic compliant with the Act, which also covers retention, security safeguards, breach reporting and a grievance process. Our overview of the Act sets those out, and the free readiness check helps you see where your clinic stands.
The Act applies to organisations that process digital personal data of individuals in India, and patient records are personal data. Whether a particular obligation applies to a particular clinic, and from when, is a question for your lawyer. This is general information, not legal advice.
Usually not for optional purposes. Consent has to be specific to a purpose and given by a clear affirmative action, so one signature covering reminders, marketing and AI processing does not give the clinic a clean record for each.
Withdrawal stops the optional processing, such as promotional messages. It does not override a legal duty to keep a medical record. Treatment record-keeping is therefore handled separately from the optional purposes.
No. CuraVerto provides a way to record consent per purpose, keep its history and let patients withdraw optional purposes. Compliance also depends on the clinic's own retention, security and grievance practices.
Take the free DPDP readiness check, or ask for a walkthrough of how CuraVerto records consent by purpose and keeps its history.
Prefer not to use WhatsApp? Leave your number and we will call.