Checklist
Share medical reports only with people who need them, through secure channels, and know why each one is receiving them. Send only what the specialist needs. Use password-protected files or secure links rather than open group chats. Ask who will see your data and how it is stored. India’s Digital Personal Data Protection Act, 2023, gives individuals rights over their personal data.
Your medical reports contain some of your most private information. Sending them to several hospitals to compare opinions is common and reasonable. It also multiplies the places where your data is held. India’s Digital Personal Data Protection Act, 2023 (DPDP Act) says consent to process personal data must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. The Act’s provisions are being brought into force in stages. This checklist turns good practice into steps you can take today.
What should you send?
- Only the reports that answer the specialist’s question, not your entire life history.
- Clear scans as PDFs, named with the date and test, for example ‘2026-09-14 MRI report’.
- Imaging in DICOM format through a secure download link rather than as phone photos of a screen.
- A short covering note stating who the patient is and what you are asking.
- Remove unrelated documents, such as bank statements, from the folder before sharing.
How should you send it?
- Use a secure file-sharing link with an expiry date where possible.
- Password-protect files and send the password by a different channel.
- Send to a named person at a hospital address, not a personal email.
- Avoid posting reports in group chats or social media groups.
- Keep a list of who you sent what to and when.
What should you ask the recipient?
- Who will see my reports and for what purpose?
- Will you share them with anyone else, and will you ask me first?
- How long will you keep them?
- How do I ask you to correct or delete them?
- Who do I contact with a privacy complaint?
- Do you have a written privacy notice I can read?
What rights does the DPDP Act set out?
- A right to obtain a summary of your personal data being processed and who it has been shared with.
- A right to correction, completion, updating and erasure of your data, subject to legal retention.
- A right to grievance redressal by the organisation holding your data.
- A right to nominate someone to exercise your rights if you die or cannot act.
- A right to withdraw consent, with withdrawal as easy as giving it.
Tip: print this page or save it as a PDF from your browser’s print menu.
Who can complain if data is misused?
The DPDP Act requires organisations to provide a way to raise grievances and to respond. You must use that route first. The Act also establishes the Data Protection Board of India, which can inquire into breaches and impose penalties. Keep copies of what you sent and to whom, as this will help if you need to complain.
How IndiaMedica handles your reports
We ask before sharing your reports with any hospital and tell you which hospitals receive them. We share only what a specialist needs to review your case. You can ask us to stop sharing or to delete your records at any time, subject to any legal duty to keep them.
Questions people ask
Is it safe to send reports by WhatsApp?
Messaging apps are convenient and some use encryption, but files can be forwarded, saved on many phones and kept indefinitely. For full reports and scans, a secure link or email to a named hospital address gives you more control. Ask the hospital which method it prefers.
Can a hospital keep my reports after I decide not to go?
Under the DPDP Act you can ask for your data to be erased once it is no longer needed, unless the law requires it to be kept. Ask the hospital how long it keeps reports and how to request deletion, and keep a record of your request.
Sources
- Digital Personal Data Protection Act, 2023 (India Code)
- Telemedicine Practice Guidelines, 2020 (Ministry of Health and Family Welfare)
General information, not medical or legal advice. Rules change: confirm with the official source. How we write and check.