ClinicsHospitalsMental healthDiagnostics
Consent at the front desk, proof in the record
Patients give their details at reception, on the phone and in your booking form. OptProof records consent in each of those places, gives the patient a receipt, and keeps the evidence your clinic may need later.
How may we use your details?
- Book and manage my appointments (needed)
- Send WhatsApp reminders
- Share lab reports with my doctor
- Health tips by SMS
You’ll get a receipt right away. Change your mind anytime at my.optproof.in/demo-clinic
Built for four kinds of care
Clinics and small practices
One QR standee at reception covers walk-ins. Online bookings use the inline consent block in your booking form, so both land in the same log.
Hospitals
One property per location or department, kiosks at admission desks, and access logs from your HIS so you can answer “who saw my records”.
Mental-health providers
Reminders that never name the kind of care, a choice of discreet channel, and therapy notes kept out of marketing and analytics.
Diagnostic centres and labs
Separate consent for sharing reports with the doctors a patient chooses, and for insurance claims, each with its own receipt.
At reception: a QR standee or a kiosk
Print a standee for each location, or lock a tablet to kiosk mode (Business plan and above). Either way the patient reads the notice in their language and consents on a verified phone number.
- Step 01
The patient scans the standee
Or picks up the kiosk tablet. No app to install. - Step 02
They read the notice in their language
Each purpose is listed with the data it uses. Optional ones start unticked. - Step 03
They confirm their phone number
A one-time code checks the number belongs to them. - Step 04
Consent is recorded with the location
The event stores the location and the staff member on duty, never the patient’s name. - Step 05
They get a receipt
They can check it at verify.optproof.in or change their choices later.
Demo Clinic, Indiranagar
Scan to choose how we use your details
Read the notice in your language
अपनी भाषा में सूचना पढ़ें
You get a receipt right away. Change your mind any time.
Answer “who saw my records”
Your clinic software sends one call each time someone opens a patient record. The log is append-only, and the DPO can search it by patient (Business plan and above).
// Call this from your clinic software whenever a record is openedawait fetch('https://api.optproof.in/v1/access-logs', { method: 'POST', headers: { Authorization: `Bearer ${process.env.OPTPROOF_SECRET_KEY}`, 'Content-Type': 'application/json', }, body: JSON.stringify({ principal: { phone: patient.phone }, viewer_ref: 'staff_dr_iyer', // your staff id, not a name record_type: 'prescription', reason: 'Follow-up consultation', }),});Access log for one patient
Demo data| When | Viewer |
|---|---|
| 26 Oct, 10:51 am | staff_dr_iyer |
| 26 Oct, 10:12 am | staff_front_02 |
| 24 Oct, 4:40 pm | staff_lab_01 |
Erasure requests and medical records
When a patient asks for erasure, OptProof tells your connected tools to delete what they hold, lists the systems it cannot reach, and lets your team keep records the law requires, with a reason the patient can read.
Medical records
Doctors and clinics must keep treatment records for a minimum period. We will keep your medical records for that period and delete them afterwards.
Medico-legal case records
Records linked to a medico-legal case must be kept until the case is closed. We will delete them after that.
Prescription and dispensing records
Pharmacies must keep records of medicines they supply for a minimum period.
Insurance claim records
Records sent to your insurer or TPA for a claim must be kept while the claim and any review of it are open.
Invoices and accounts
We must keep invoices and payment records for tax purposes. We keep only what the bill needs.
Open dispute or legal claim
Some records must be kept while a dispute, complaint or legal claim is open.
Periods differ by state and by the kind of establishment. These reasons are defaults for your team to confirm with counsel.
Extra care for mental-health providers
The template ships with these defaults for therapists, counsellors and mental-health platforms.
- therapy notes and session content are the most sensitive data you hold. Keep them out of marketing, analytics and message text.
- reminders must not reveal the kind of care. Say "your appointment", not "your therapy session" or the therapist's speciality, because phones are often shared.
- let patients choose a discreet channel (for example email instead of WhatsApp) and a neutral sender name.
- the Mental Healthcare Act 2017 has its own confidentiality rules that apply alongside DPDP. To be confirmed with counsel.
The healthcare template
9 purposes in plain language, from appointments to insurance claims. Start here, edit what you need, and have your counsel review before you publish.
Booking and managing appointments
Needed for the serviceWe use your details to book your appointment, confirm it and contact you if anything changes.
Data collected
- Full name
- Mobile number
- Email address
- Age or date of birth
- Gender
- Preferred doctor or therapist
- Appointment date and time
- Short reason for the visit
Kept for: 3 years
Online consultations
OptionalIf you choose an online consultation, we use your details to run the video, audio or chat session with your doctor or therapist.
Data collected
- Full name
- Mobile number
- Email address
- Symptoms and health concerns you share
- Documents and photos you upload
- Chat messages during the session
- Session date, time and length
- Device and connection details needed to run the call
Kept for: 3 years
Treatment, prescriptions and medical records
Needed for the serviceYour doctor or therapist records your health information so they can treat you safely and continue your care at later visits.
Data collected
- Medical history
- Current medicines and allergies
- Symptoms, diagnosis and treatment notes
- Prescriptions
- Vital signs such as blood pressure and weight
- Scans and images
- Referral letters
Kept for: 3 years
Lab tests and sharing reports
OptionalWe send your test orders to the lab and share your reports with you and with the doctors you choose.
Data collected
- Full name
- Age and gender
- Tests ordered
- Sample collection details
- Lab results and report files
- Name of the doctor or lab you want reports shared with
Kept for: 3 years
Reminders on WhatsApp and SMS
OptionalWe send reminders for appointments, follow-ups and medicine refills. Messages never mention your diagnosis or the type of treatment.
Data collected
- Mobile number
- First name
- Appointment date, time and place
- Message delivery status
Kept for: 1 year
Health tips and clinic news
OptionalWe send general health tips, camp announcements and offers. We do not use your diagnosis or treatment to choose what we send.
Data collected
- First name
- Mobile number
- Email address
- Topics you choose to hear about
- Preferred language
Kept for: 1 year
Research and service improvement (optional)
OptionalWe remove names, phone numbers and other details that identify you, then study the records to improve care. We never publish anything that identifies you.
Data collected
- Age range
- Gender
- Diagnosis and treatment, without your name or contact details
- Treatment outcomes
- Visit dates
- Feedback scores
Kept for: 2 years
Insurance and cashless claims
OptionalIf you want to use health insurance, we share the details your insurer or TPA needs to approve and settle your claim.
Data collected
- Full name
- Policy number and insurer name
- TPA name
- Identity document required by the insurer
- Diagnosis and treatment details needed for the claim
- Bills and cost estimates
Kept for: 8 years
Bills and payments
Needed for the serviceWe use your details to prepare bills, take payments and issue receipts.
Data collected
- Full name
- Mobile number
- Billing address
- Services billed
- Payment method and reference number
- GSTIN (if you give one)
Kept for: 8 years
Good practice for every clinic
- Emergencies: care in a medical emergency must never wait for a consent form. Processing for emergencies may not need consent (s.7). To be confirmed with counsel.
- Children: patients under 18 need verifiable consent from a parent or guardian. Adolescent therapy can raise confidentiality questions; take legal advice.
- Record access: log every view of a patient record with the access-log API (Business plan) so you can answer "who saw my records".
- Research: remove identifiers before analysis and keep the key that links them separately. Truly anonymous data is outside DPDP, but de-identifying it still needs a basis.
- Erasure: medical records usually must be kept for a minimum period. Record the "Medical records" exception instead of deleting them, and delete when it ends.
Guidance for your team, not legal advice.
Where patient data usually lives
These are the systems that need to hear about withdrawals and erasure requests.
- Clinic or hospital management system (HIS / EMR)
- Appointment booking tool or website form
- Teleconsultation platform
- Lab information system
- WhatsApp Business account
- SMS provider
- Billing or accounting software
- Insurance / TPA portals
- Excel or Google Sheets patient lists
- Email newsletter tool
Questions
Questions from clinics
Not legal advice. Talk to your counsel about your specific obligations.
Put consent at your front desk
Install the widget, record test consents and verify your first receipt in under ten minutes.