Every clinic website with an enquiry form collects personal data: names, phone numbers, sometimes details about a health problem. India’s Digital Personal Data Protection (DPDP) Act, 2023 and its Rules, notified in November 2025, set out how that data must be handled, with the obligations coming into force in phases. Notice and consent requirements apply from May 2027, so now is the time to get forms right.
What the law expects, in plain terms
- Tell people what data you collect and why, in a clear notice, before they submit it.
- Get clear consent for that purpose; a pre-ticked box doesn’t count.
- Collect only what you need for the purpose.
- Let people withdraw consent and ask for their data to be corrected or erased.
- Keep the data secure, and don’t keep it longer than you need it.
Fixing your enquiry forms
- Ask for a name, phone number and a preferred time. Leave symptoms and medical history out of general contact forms.
- Add a short notice next to the form: what the data is used for and who to contact about it.
- Add an unticked consent checkbox that links to your privacy policy.
- Make sure form submissions don’t sit in an unsecured inbox or spreadsheet.
WhatsApp and calls
If you reply to enquiries on WhatsApp or call patients back, the same principles apply: use the data only for the purpose the patient gave it for, and don’t add them to marketing lists without consent.
Your privacy policy
Every clinic website should have a privacy policy that explains what the site collects, how it’s used, how long it’s kept, and how people can make requests about their data. Link it from every form and from the footer.
If you’re rebuilding your site, our hospital and clinic website design service builds consent-ready forms in from the start.
This article is general information, not legal advice. Check the DPDP Act and Rules, or take legal advice, for your clinic’s obligations.
