DPDP Compliance for Healthcare Companies

Apollo 24/7's privacy policy is detailed about data collection but remains largely anchored to the IT Act 2000 and SPDI Rules. Given it handles highly sensitive medical data, the lack of explicit DPDP Act 2023 alignment, especially concerning granular consent, specific data retention, and DPB redressal, poses significant compliance risks.

cult.fit collects intimate health data — heart rate, body measurements, workout capacity, injury history, and mental health content engagement — processing what is effectively continuous health monitoring. At 42/100, treating this health data with consumer app privacy standards instead of health data protections creates significant DPDP exposure.

HealthifyMe relies on a 'bundled' consent model that likely fails the DPDP Act's strict requirement for specific and unconditional permission. While they prioritize security for sensitive health data, their broad data-sharing clauses and lack of a dedicated Indian grievance path create major legal risks.

MediBuddy's privacy policy is comprehensive under older regulations but lacks explicit alignment with the DPDP Act 2023. Given its handling of sensitive health data, the absence of granular consent, specific data retention periods, and clear cross-border transfer rules poses significant compliance challenges and potential liabilities.

mfine handles highly sensitive medical and physiological data, yet its policy relies on outdated 'all-or-nothing' consent models. While security measures are mentioned, the lack of DPDP-aligned data erasure timelines and grievance mechanisms creates significant risk for a health-tech leader.

PharmEasy handles highly sensitive health data but its privacy policy doesn't explicitly align with the DPDP Act 2023. Key issues include non-granular consent for health information, unclear data retention, and an incomplete framework for user rights, posing significant regulatory and reputational risks.

Practo handles India's most sensitive personal data — medical records, doctor consultations, prescriptions, and health histories — scoring 53/100 on DPDP alignment. While healthcare-specific awareness is present, the lack of DPDP-specific consent granularity and retention timelines for medical data creates critical regulatory exposure.

Tata 1mg's privacy policy demonstrates a robust approach to data security and provides mechanisms for data principals to exercise certain rights, such as withdrawing consent. However, the policy currently lacks explicit alignment with several critical provisions of India's Digital Personal Data Protection Act 2023. Key areas requiring enhancement include the granularity of consent, clear definition of data retention periods, explicit mention of DPDP Act-mandated rights like nomination, and the escalation process to the Data Protection Board. Given the sensitive nature of health-related personal data processed by 1mg, precise DPDP compliance is essential to build and maintain user trust while navigating India's evolving data protection landscape.