India's Digital Personal Data Protection (DPDP) Act, 2023, together with its 2025 Rules, is now the law that governs how you handle patient information. Health data is among the most sensitive categories it covers. The good news: for a solo doctor or small clinic, compliance is mostly common sense — and the software you choose does a lot of the heavy lifting. This is a plain-English walkthrough written for practising doctors, not lawyers.

This article is general information, not legal advice. For your specific situation, consult a qualified professional.

You are the "Data Fiduciary"

Under the Act, the person who decides why and how patient data is processed is the Data Fiduciary — and that's you, the treating doctor. Your patient is the Data Principal. If you use a cloud service to store records, that vendor is usually a Data Processor acting on your behalf — which means their security failures can still become your liability.

What the Act expects of you

1. Lawful, consented processing

Collect patient data with a clear purpose (providing care) and take consent where required. Only collect what you actually need. Using the data for something unrelated later — say, marketing — without fresh consent is not allowed.

2. Purpose & storage limitation

Don't hoard data you no longer need. Keep records for as long as care and medico-legal requirements demand, then be able to delete them.

3. Reasonable security safeguards

This is the clause your software choice directly affects. Expected safeguards include encryption, access control, and protection against unauthorised access. An app that encrypts records at rest with AES-256 and keeps the key in the phone's secure hardware store satisfies this far better than a plain spreadsheet or an unlocked notes app.

4. Breach handling

If personal data is exposed, the Act contemplates notification obligations. The most reliable way to shrink this risk is to shrink the attack surface — fewer copies, fewer servers, fewer third parties holding the data.

5. Honouring patient rights

Patients can ask what data you hold, seek correction, and in appropriate cases seek erasure. You need to be able to actually find and export or delete a given patient's record.

How your app choice changes your risk

Compare two setups for the same solo practice:

  • Cloud EMR: you add a Data Processor, a data-transfer relationship, a vendor breach surface, and a dependency on that vendor's security and uptime. More power, but more obligations and more ways to be exposed.
  • Offline, on-device app: there is no third-party processor and no cloud copy. The data lives only on your encrypted device, which you physically control. Several of the hardest obligations — processor contracts, cross-border transfer, vendor-breach exposure — largely fall away.

Neither is "automatically compliant" — you still need sensible consent and security habits. But an offline app removes whole categories of risk before you even start.

A practical DPDP checklist for your clinic

  • Use software that encrypts patient records at rest (AES-256 or equivalent).
  • Prefer on-device storage over cloud unless you truly need multi-site sync.
  • Lock your device with a strong passcode and biometrics.
  • Take encrypted backups you control, and know how to restore them.
  • Collect only necessary data; take consent for anything beyond direct care.
  • Be able to find, export, and delete a specific patient's record on request.
  • Avoid apps that transmit data you can't see — check Android permissions.

How Dr.Prescribe helps

Dr.Prescribe is built for this reality. It stores everything on your device only, encrypted with AES-256 SQLCipher, with the key held in the Android Keystore / iOS Keychain. On Android it holds no internet permission, so data physically cannot be transmitted — there is no server and no account. You get one-tap encrypted backups you control, and per-patient records you can find and export in seconds. For more, see the offline prescription app guide or the FAQ.