Janani Diagnostics: Consent on a WhatsApp Group
Janani Diagnostics runs two labs in Bhubaneswar with 12,000 patient records: 8,600 sit in a billing Excel file and the rest in a WhatsApp Business account where receptionists send PDF reports to a group of 30 phone numbers. A vendor, MediPing, offers a ₹8,000-a-month reminder service and says it will store the data on its founder's personal Google Drive 'for now'. Of the 12,000 records, 3,400 were collected at health camps where names and phone numbers were written in a register and no consent form was used; the rest have a signed form saying 'for testing and related purposes'. The lab wants to launch fasting reminders, a paid diabetes check-up package, and birthday wishes. About 1,100 records are of children under 18. The manager argues that 'everyone in the market does this' and that patients expect messages.
1. Rank the risks in this arrangement and explain the legal or design reason for each ranking. Refer to consent, purpose limitation, children's data, processors and security.
Read the worked answer
Rank by exposure, not by volume.
- Camp records (3,400). No consent and no notice of purpose. Under the DPDP Act 2023, consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. A name in a register does not meet that. Using these for marketing is the highest exposure.
- The WhatsApp group of 30 numbers. Even if each patient consented to report delivery, a group exposes one patient's health information to others and may include wrong numbers and relatives. This is a confidentiality and security failure independent of consent.
- The form saying 'testing and related purposes'. Too vague. Purpose limitation requires a stated purpose; 'related purposes' will not stretch to a paid diabetes package or birthday messages.
- Children (1,100 records). The Act requires verifiable consent of a parent or lawful guardian for children, and bars tracking, behavioural monitoring and targeted advertising directed at children. Promotional messages to these records are risky whatever the parents signed.
- MediPing on a personal Drive. A processor with no contract, no security baseline and no defined deletion is a breach waiting to be reported.
2. Set out a practical 30-day plan for the 3,400 camp records and the WhatsApp group, in order of risk. What should be stopped immediately and what can wait?
Read the worked answer
Stop today (low cost, high risk):
- Exclude all 3,400 camp records from every marketing list. They may still be used to deliver a report a patient is waiting for, but not for offers.
- Close the WhatsApp group. Move to password-protected individual messages or a portal login. Tell each patient personally before switching, or they will arrive for a report that never comes.
Weeks 1–2 (consent rebuild):
- Send a short, plain consent notice at the next visit, or a one-time re-consent message with a clear opt-in. No pre-ticked boxes and no consent bundled into 'terms of service'.
- Rewrite the form to name the purposes (testing, report delivery, reminders, health-check offers), the retention period, the withdrawal route and a grievance contact.
Weeks 3–4 (controls):
- Add a parent/guardian consent field for under-18 records and stop promotional messages to them.
- Validate phone numbers, restrict the Excel file to named staff with a password, and keep one master copy instead of branch copies.
- Log who accesses the file, and put a deletion date on records that have served their purpose.
3. List the clauses Janani must insist on before signing MediPing. Explain why each clause matters to a small lab rather than treating it as paperwork.
Read the worked answer
Clauses to insist on:
- Purpose and instructions: process data only on documented instructions, only for the listed reminder services. Prevents the vendor repurposing patient data.
- No personal devices or personal cloud accounts: named storage location, encryption at rest and in transit. The founder's Drive is the single biggest risk in the offer.
- Sub-processors: prior written approval, with the same obligations passed down.
- Security and incident notice: notify the lab within 24 hours of any breach, so the lab can meet its own duty to intimate the Data Protection Board and affected patients.
- Deletion: return or delete data on termination within a stated period, with a written certificate.
- Audit and assistance: a right to inspect, plus support for patient requests for access, correction, erasure and grievance redressal.
- Liability and indemnity: the vendor bears the cost of a breach it caused.
- No secondary use: no use of the data to train the vendor's models or build its own products.
If MediPing will not sign these, ₹8,000 a month is not cheap - the lab keeps the penalty and the reputational damage. Cheaper still: keep reminders in-house until a compliant vendor is found.