Health data under the DPDP Act, practically.

The obligations, in the order they affect you

Five, and only two of them are really software questions.

Notice and consent

People must be told what you are collecting and why, in language they understand, and consent must be as easy to withdraw as it was to give.

Purpose limitation

Data collected for treatment is not automatically available for marketing, research or anything else. Bundled consent covering everything is precisely what the Act is aimed at.

Retention

Data is kept for as long as the purpose requires or the law demands, and not indefinitely because deleting is inconvenient.

Rights

People can ask what you hold, ask for corrections, and in defined circumstances ask for erasure, subject to statutory retention that a hospital genuinely has.

Security

Reasonable safeguards, and breach notification. "Reasonable" is doing more work in that sentence than most vendors admit.

What lands on your software

Access control that is real rather than cosmetic, meaning a permission a role does not hold is refused on the server, not merely hidden in a menu. An audit trail that can answer who read what. Encryption in transit and at rest. Isolation, if the software is multi-tenant, that a hospital can verify rather than take on trust.

Then the harder ones, which most systems do not have: a workflow for handling a correction or erasure request, retention rules that actually delete something, and consent recorded per purpose rather than as a single tick at registration.

What lands on you

Your notice, your consent process at the desk, your retention policy, your breach response, your staff training, and your contracts with everyone who processes data on your behalf, which includes your software vendor.

Software cannot make a hospital compliant. It can make compliance evidenceable, which is a different and more modest claim.

Questions worth putting to a vendor

These separate a considered answer from a confident one.

Where is the data, physically?

Not "the cloud". Which country, which region, and is that configuration or architecture?

Who else touches it?

A named sub-processor list, what each handles, and whether you are told before it changes.

How is one hospital separated from another?

In a multi-tenant system, ask whether isolation is enforced by the database or by application code, and how it is tested.

What does the audit trail actually record?

Writes are easy. Reads are the interesting question under a privacy law.

What happens when we leave?

Export format, timescale, cost, and what happens to the copy they keep.

Where we stand

Nirogix has database-enforced tenant isolation, role-based access with per-user overrides that can be time-bound, an append-only audit trail, encryption in transit and at rest, India-resident storage, and a named sub-processor list published on our security page.

What we do not have yet is a patient-facing rights workflow: no self-service access request, no correction request and no erasure workflow with statutory holds. There is no purpose-scoped consent registry either. Both are scheduled. A hospital under scrutiny today would handle those requests as a process, with our support, rather than through a screen.