Health App Consent, a Six-Hour CERT-In Clock, and Two Export Streams
MediScribe Health Technologies Pvt Ltd is a Pune-based company running a lab-report app with 1.2 million users. It collects test results, prescriptions and, for some users, mental-health assessments. Consent is captured by a single tick against a 40-page terms document that covers 'service improvement and sharing with partners'. The named grievance officer resigned five months ago and the website still lists her. On 4 August at 10:00 IST engineers discovered that an unauthenticated API endpoint had been serving 50,000 lab reports to anyone who guessed sequential report IDs; the endpoint had been live since June. MediScribe's US parent wants the raw dataset for a population-health model, and a Singapore affiliate wants 'anonymised' analytics built on the same records - pseudonymous patient IDs and lab values, with the re-identification key still held in Pune. The engineering lead wants to finish root-cause analysis before telling anyone, including CERT-In.
1. Assess MediScribe's consent, notice and grievance handling under the IT Act and the SPDI Rules.
Read the worked answer
The data is sensitive. Medical records, test results and mental-health assessments fall within 'sensitive personal data or information' under the SPDI Rules. That triggers a specific regime: consent from the provider about the purpose before collection; collection limited to what is necessary for that purpose; retention no longer than required; a published privacy policy; reasonable security practices; and a grievance officer whose name and contact details are published.
The bundled consent fails. Consent must be informed, which means the purpose is stated clearly and specifically. A single tick on a 40-page document covering vague 'partners' and 'service improvement' does not tell a user that her lab results will feed a population-health model. Sensitive data cannot be swept up in general account terms.
The vacancy is a standalone breach. Five months without a grievance officer breaches the SPDI Rules and removes the channel through which users would normally raise concerns before going to a regulator.
Exposure. Failure to maintain reasonable security practices engages section 43A of the IT Act, which exposes the company to compensation to affected persons with no statutory cap, and unauthorised disclosure can engage the criminal provision on disclosure of personal information.
Fix. Layered notice with granular purposes (treatment, analytics, partner sharing as separate choices), a retention schedule, an appointed grievance officer, documented security controls, and an incident response plan. Note the DPDP Act 2023 will replace this framework when commenced: notice, consent, grievance redressal, verifiable parental consent for users under 18, and penalties up to Rs 250 crore for security-safeguard failures.
2. What must MediScribe report, to whom, and by when?
Read the worked answer
CERT-In. The April 2022 CERT-In Directions require specified cyber incidents - including unauthorised access to IT systems and data breaches - to be reported to CERT-In within 6 hours of noticing the incident, with a further, more detailed report within 24 hours. Noticed at 10:00 IST on 4 August, the initial report is due by 16:00 the same day and the follow-up by 10:00 on 5 August. Logs must be retained for 180 days within India.
Users. There is at present no SPDI Rules deadline for notifying affected individuals, but the exposure of 50,000 identifiable lab reports is exactly the case in which notification is expected. Under the DPDP Act 2023, once in force, the data fiduciary must intimate both the Data Protection Board and affected data principals; the draft rules published in January 2025 propose a 72-hour window to the Board. Planning to that standard now is prudent.
Why waiting is wrong. The engineering lead's instinct to complete root-cause analysis first is a common failure. The reporting duty is triggered by awareness of the incident, not by certainty about cause or scope. A preliminary report with known facts, the data categories involved, and containment steps satisfies the 6-hour obligation; the 24-hour report can add detail.
Internal. Document the timeline, preserve evidence, and treat the delayed discovery - live since June - as a monitoring failure requiring remediation.
3. Can MediScribe send raw data to the US parent and 'anonymised' analytics to the Singapore affiliate?
Read the worked answer
Raw data to the US. Under the SPDI Rules, sensitive personal data may be transferred outside India only where the recipient ensures the same level of protection, and the Indian body corporate remains accountable for the data; the government may also prohibit transfer of specified categories to specified countries. The US parent therefore needs a contract imposing security, purpose limitation, no onward disclosure, retention limits and audit, and MediScribe must be able to demonstrate accountability. Population-health modelling is also a new purpose: the treatment consent does not cover it, so fresh, specific consent is required.
The DPDP Act overlay. Under section 16, transfer will be permitted except to countries the Central Government notifies as restricted. No such notification exists yet, so the practical default is permissive, but the Act is not fully in force and the Rules are still in draft - relying on the future regime while ignoring the current SPDI Rules would be a mistake.
The 'anonymised' Singapore stream. Pseudonymous IDs with a re-identification key still held in Pune is pseudonymisation, not anonymisation. The data remains personal data, the affiliate is a third party, and the analytics purpose requires consent. Genuine anonymisation - irreversible, no key retained, no singling out - would take the data outside the regime, but it must be tested, documented and periodically re-tested against re-identification risk.