How the DPDP Act affects hospital marketing: consent, ads, WhatsApp and CRM

Transcript

For years, hospital marketing in India ran on an unwritten assumption: if a patient gave a number at registration, the hospital could message them about anything.

India's data protection law ends that assumption.

This is a marketing practice view, not legal advice.

First, the roles.

The hospital is the data fiduciary.

It decides why and how personal data is processed.

The patient is the data principal.

Agencies, CRM providers, messaging platforms and call centres are processors, and the hospital stays responsible for what they do.

Where processing relies on consent, the consent has to meet a high bar.

Free and specific, never a condition of treatment.

Informed and unambiguous, given through a clear affirmative action.

And limited to the data needed for the stated purpose.

The most important design decision is to separate care communication from marketing.

Appointment reminders are care.

Health check offers are marketing.

Report availability is care.

New service launches are marketing.

Billing and insurance updates are care.

Newsletters and camp invitations are marketing, and need their own opt-in.

Most data enters at the registration desk, the appointment call or the booking form.

That is where consent is won or lost.

Use a short notice in the patient's language, then a separate, unticked choice about marketing.

No pre-ticked boxes, and no consent buried in terms.

Some common practices are the most exposed.

Uploading patient phone numbers or emails to ad platforms is marketing processing, even when hashed, and needs a lawful basis.

Lists segmented by condition are more sensitive still, because the audience itself reveals health information.

And a patient who asked about timings on WhatsApp has not agreed to receive offers.

The full guide, with sources and checklists, is on gauravphogat.com.

The link is in the description.