Bundled consent and 'de-identified' health data sharing at a consumer health app
MediTrack is a Bengaluru-based health app with 4.2 million Indian users. At signup, users tick a single box consenting to 'collection, use, sharing and transfer of my health and lifestyle data for improving services, analytics, research, and insurance partnerships'. The notice is a 40-page PDF linked in the footer. MediTrack now plans to share de-identified prescription and menstrual-cycle data with a reinsurer, which will build risk scores and pass them to an insurer marketing policies back to users. The product team argues the signup consent covers this, de-identification removes the data from scope, and the insurer's offer is a legitimate use. There is no consent-withdrawal flow beyond emailing support, and 6,000 users are minors. Legal must decide before a 50,000-user pilot starts in three weeks.
1. Is the existing signup consent valid for sharing data with the reinsurer and for the insurer's marketing? Explain against the DPDP Act.
Read the worked answer
Probably not, on three independent grounds.
Specificity and informed consent. Section 6 requires consent that is free, specific, informed, unconditional and unambiguous, given by clear affirmative action, and limited to the purpose specified in the notice. A single tick covering analytics, research and insurance partnerships cannot be specific: the user cannot tell that health and menstrual-cycle data will go to a reinsurer and then to an insurer. The 40-page PDF is also unlikely to meet Section 5's notice expectations, which require the personal data, purpose, manner of exercising rights and complaint route to the Data Protection Board to be clear.
Legitimate use is a closed list. Section 7 covers things such as state functions, legal obligations, medical emergencies, employment purposes and specified public-interest cases. Commercial reinsurance scoring and policy marketing are not on that list. Calling the offer a legitimate use does not create a basis.
De-identification is a claim, not a label. Hashed or pseudonymised identifiers that can be linked back remain personal data. Only irreversibly anonymised data falls outside the Act. The reinsurer's ability to score and target users suggests the data remains linkable. Separate opt-in consent, a purpose-specific notice and evidence of anonymisation are needed.
2. What changes should be made to the notice, consent architecture and withdrawal before the pilot, including for minors?
Read the worked answer
Build the following before the pilot:
- Layered notice in plain language and major Indian languages: a short summary, then purpose-by-purpose detail, naming the reinsurer and insurer categories, retention periods and the complaint route to the Board.
- Granular consent: separate toggles for core service, analytics, research sharing, reinsurer sharing and insurance marketing. No pre-ticked boxes and no denial of core service for refusing optional purposes, consistent with Section 6(4).
- Consent records capturing purpose, timestamp, notice version, language and any consent-manager interaction.
- Withdrawal that is as easy as giving consent: self-service, immediate for future processing, and propagated contractually to the reinsurer and insurer.
- Minors: an age gate and verifiable parental consent under Section 9 for under-18s; no behavioural monitoring or targeted advertising directed at children. The 6,000 minors should be excluded from the pilot until this works.
- DPIA and contracts: document re-identification risk and insurer use, and impose purpose limits, no re-use, security and deletion on the reinsurer. If the insurer markets directly, it is likely a separate Data Fiduciary needing its own notice and basis. Also assess whether scale triggers Significant Data Fiduciary duties such as an India-based DPO, audits and DPIAs.