Patient trust now has a legal floor
Appointment forms, lab reports and teleconsult apps carry some of the most sensitive data people share. A leak hurts patients and your name.
Scan your website
Read-only and free. Nothing on your site is changed.
The personal data you hold
- Patient names, ages and contact details
- Diagnoses, prescriptions and lab results
- Insurance and payment details
- Appointment history and doctor notes
- ID numbers collected at registration
Where businesses like yours slip
Forms give notice and ask for consent
Appointment and enquiry forms with no notice and no separate consent for reminders or offers.
Third-party sharing disclosed in the notice
Chat widgets and booking tools that send patient details to outside services nobody listed.
Privacy notice linked from the home page
No privacy notice on the website at all, or one buried where patients never see it.
Security headers in place
Basic browser protections missing on pages that handle patient logins and reports.
A day without consent
Fictional scenario
The lab report that went to the wrong inbox
A busy front desk picks the wrong email address from autocomplete.
Read the storyCommon questions
Is a patient's health data treated differently?
The DPDP Act protects all personal data the same way, but health data carries the highest risk if it leaks, so your safeguards and breach plan matter most here.
What happens if a lab report is emailed to the wrong person?
That is a personal data breach. You must inform the Data Protection Board and the affected patient, and show what you are doing about it.
How long can we keep old records?
Only as long as the purpose needs, or as other laws such as medical record rules require. After that the data should be erased.
This page is general information, not legal advice.
Find out where your website stands
A free, read-only scan with plain-language findings you can act on.