Patient data privacy for physiotherapy clinics in India: the basics every clinic should know

Health information is some of the most personal information there is, and a physiotherapy clinic holds a lot of it: diagnoses, notes about pain and injuries, photos, phone numbers and addresses. India's Digital Personal Data Protection Act, 2023 (the DPDP Act) and its rules set out how organisations, clinics included, must handle personal data. This guide explains the basics in plain words and the everyday habits that follow from them.

It is a general guide, not legal advice. For questions about your own clinic, speak to a lawyer.

The clinic is responsible for its patients' data

Under the Act, the organisation that decides why and how personal data is used is responsible for it. For your patients' records, that is your clinic. A software provider that stores and processes the records for you does so on your behalf and has to protect them, but the responsibility to your patients is yours.

Collect what you need, for a reason you can explain

• Ask only for information you need to treat and bill the patient.

• Tell patients why you collect it, in plain words.

• Use it for that purpose: treating them, reminding them of appointments, billing them. Do not add them to marketing lists without asking.

Consent

Personal data should generally be processed with the person's clear consent, or on another basis the law allows. In practice:

• Record consent to treatment, and who gave it (the patient, or a parent or guardian for a child).

• Ask separately before sending marketing messages, and make it easy to stop.

• For a child, or someone who cannot decide for themselves, involve the parent or lawful guardian.

Keep it secure

The Act expects reasonable security safeguards. For a clinic that means:

• No shared logins. Each person signs in as themselves.

• Least access. Staff see what their role needs; not everyone needs to see every patient or every rupee.

• No patient details in personal WhatsApp groups, photos of files on personal phones, or spreadsheets emailed around.

• A record of who opened or changed what, so misuse can be found.

• Locked cupboards for paper files you still keep.

Patients' rights

Patients can ask you for information about their data, ask for it to be corrected, ask for it to be erased where it is no longer needed and the law does not require you to keep it, name someone to act for them, and raise a grievance. Have a simple way to receive these requests and answer them within a reasonable time.

Medical records often have to be kept for a period even if a patient asks for erasure, because of professional and legal obligations. Explain this to the patient when it applies.

How long to keep records

Keep records only as long as you need them for treatment, for legal and professional obligations, and for any claims. Decide a period, write it down and follow it, rather than keeping everything forever by default or throwing things away at random.

If something goes wrong

If personal data is lost, stolen or accessed by someone who should not have it, act quickly: contain it, find out what happened, and follow the notification duties under the Act and its rules, which include informing the Data Protection Board and the affected people in the ways the rules set out.

How PhysioDesk helps

PhysioDesk is built so the right habits are the easy ones:

• Everyone signs in as themselves, with their own mobile number and password; there are no shared logins.

• Roles limit what each person sees. Therapists see the patients they treat; money is for the owner and clinic admins.

• Every opening, change and export of a record is logged, in a log that cannot be altered.

• Consent to treatment is recorded against a versioned wording, by the patient or by your staff.

• Privacy requests come from patients through the patient portal and are answered within 30 days, with the answer shown to the patient.

• Patients can download their own record, and you can export any patient's record or all of your clinic's data.

• Nothing is erased by accident. Removing a record hides it and keeps it, because medical records have to be kept.

Read our privacy policy and security page for how PhysioDesk itself handles data.