Patient Data Security and the DPDP Act for Physiotherapy Clinics

The DPDP Act in plain words

The DPDP Act and the rules made under it cover digital personal data, which includes your patient records. Under the Act, your clinic decides why and how patient data is used, so your clinic is responsible for it. In simple terms, a clinic should:

• Tell patients what data you collect and why, and get their consent where it is needed.
• Use the data only for that purpose, such as their treatment and their bills.
• Keep it safe with reasonable security safeguards.
• Let patients see and correct their information, and handle their requests.
• Know what to do if data is leaked or lost, including who must be told.
• Choose software and service providers that protect data properly, because they handle it on your behalf.

Health records also have to be kept for years under other rules, so a request to delete data does not mean clinical records simply disappear. Your lawyer can tell you how the two fit together for your clinic.

How Clinidiary protects patient records

Your data stays in India

Indian clinics' records are hosted in Mumbai, on a server that holds Indian clinics only. Australian clinics are on separate servers in Australia. The two never share a database.

Encrypted everywhere

Every connection, from the browser to the server, the patient portal and the booking page, is encrypted.

Strong sign-in

Staff can sign in with a passkey, their face or fingerprint on their phone or laptop, or with a password plus a two-factor code. Screens lock themselves after a period left alone, so a shared front desk computer never stays open on a patient's file. Owners choose how long.

The right people see the right things

There are six roles and more than fifty permissions, and the server checks every one of them, not just the screen. Clinical notes can never be opened by a front desk, accounts or marketing login. That switch is locked and no setting turns it on. Give each person the least they need to do their job. See staff roles and permissions.

A trail of who did what

Every record keeps a trail of who did what. The activity log shows every booking made, moved or cancelled, every bill issued and every change to the practice, with the person's name. The Security page shows who is signed in on which device, and lets you sign a device out.

Nothing clinical is lost

Notes save themselves as you type and lock once signed. Corrections are amendments, so the original always stands. Nothing clinical is ever hard-deleted. See physiotherapy EMR and treatment notes.

A plan if something goes wrong

Clinidiary has a written breach-response procedure that sets out the first hour, the first day, and the notification steps under the DPDP Act and the CERT-In directions, decided in advance.

Your data is yours

Export your patients, appointments, notes and bills whenever you like, yourself. Every export is recorded in the audit log.

What your clinic should do

Software is only half of data protection. The other half is how your team works:

1. Give every person their own login. Never share the reception password.
2. Use passkeys or two-factor for everyone, especially owners.
3. Review access every few months. Remove people who have left; check nobody has more than they need.
4. Tell patients how you use their data. Put it in your intake and consent form.
5. Do not send clinical details on personal WhatsApp groups. Keep them in the patient's file.
6. Lock the screen when you step away, even though Clinidiary will do it for you.

Frequently asked questions

Does the DPDP Act apply to physiotherapy clinics?

The DPDP Act covers digital personal data, which includes digital patient records. A clinic that keeps patient data digitally should treat it as applying, and check the details with a lawyer.

Where is Clinidiary's Indian data stored?

In Mumbai, on servers that hold Indian clinics only.

Can my receptionist see clinical notes?

No. Front desk logins can never open clinical notes in Clinidiary.

Can I get all my data out of Clinidiary?

Yes. Export patients, appointments, notes and bills yourself, whenever you like.

What happens if I lose my phone?

Sign that device out from the Security page. Screens also lock themselves after being left alone.