This policy requires legal drafting before publication
Publication pending. What follows is the structure this policy must cover under the Digital Personal Data Protection Act 2023, prepared so that counsel can draft against a complete list rather than a blank page. It is not drafted legal text and must not be published as though it were. Health data is sensitive personal data, and a policy that has not been through counsel is a liability rather than a protection.
Blocked on dependency D3.
What the drafted policy must cover
Each of these is an obligation under the DPDP Act 2023, the associated rules, or the Consumer Protection Act 2019. The health-data items are the ones that most commonly get missed.
- Identity of the Data Fiduciary — the legal entity, its registered address, and how to reach it
- The Data Protection Officer — name and contact route, and a grievance mechanism with a stated response time
- Categories of data collected — separating enquiry data, assessment data, clinical records, body composition, laboratory results and any genetic data
- Purpose for each category, stated specifically rather than as a general permission
- Lawful basis and consent — the consent notice, its wording, and the fact that consent for treatment is separate from consent for marketing
- How consent is withdrawn, and what happens to the data when it is
- Retention period for each category, including the retention obligations that apply to clinical records
- The right to access, correct and erase, and the mechanism for each
- The right to nominate another individual, which the DPDP Act specifically provides for
- Processors and third parties — laboratories, payment providers, messaging, analytics, and any nutrigenomic testing partner
- Cross-border transfer, where any processor stores data outside India
- Security measures, and the breach notification process
- Children’s data — verifiable parental consent, and the prohibition on behavioural advertising to children
- Cookies and analytics — what is set, on what basis, and how it is refused
- WhatsApp communications, which carry clinical content and need addressing explicitly
What this build already does. The assessment shows your result on screen before asking for any contact detail, so nothing is collected to see it. Every form here states its purpose, and every form carries a withdrawal route. Those are design decisions, not policy text, and they hold whatever the drafted policy says.