DPDP Act and Hospital Marketing: Leads, CRM, WhatsApp and Tracking Pixels

A patient lead is not merely a marketing record

When someone enquires about an oncology service or surgery, even a minimal form can reveal or support inferences about health. Patient enquiries may pass from Meta or a website to an agency CRM, a WhatsApp coordinator, a hospital appointment platform and the clinical team. Each transfer deserves an identified purpose and data-security analysis.

NMC clause 7.6 and its qualification

Clause 7.6 refers to the Information Technology Act, DPDP Act and Rules in relation to personal information used in advertising, and expressly qualifies compliance by what is applicable and in force from time to time. It does not bring into force provisions that the commencement notifications have postponed. S1

The DPDP clock in October 2026

The DPDP Act, 2023 and rules notified in November 2025 have staggered commencement. A set of institutional provisions commenced earlier; some additional provisions are scheduled one year after the notification, while core notice, consent, fiduciary, rights and security requirements principally follow the longer 18-month commencement path. Confirm the exact commencement notification for the precise section and date before stating an offence, remedy or penalty. S8 S9

This is not a permission to ignore medical confidentiality or IT-related obligations currently in force. Hospitals should plan for future DPDP duties while following the present legal regime.

Review the entire digital path

Advertising form: Collect only what is needed for a lawful initial enquiry. Avoid forcing the user to state a diagnosis publicly or inside an unnecessary advertising field.

Lead transfer: Identify whether a marketing agency receives data as a service provider and whether it can use the data for its own purposes.

CRM: Limit staff access; maintain a log of exports, updates and purpose restrictions. Avoid shared password-based access between unrelated facilities.

WhatsApp follow-up: Review whether the communications are legitimate, expected and consistent with the applicable permissions and platform rules.

Clinical handover: Move detailed health facts into an appropriate clinical channel instead of treating advertising software as a medical record system.

Pixels, analytics and inferred health status

A platform might receive the name of a medical-condition page viewed, a button click, an appointment event or an offline conversion. Even when a name is not explicitly sent, the event may be linked to identifiers. Before activating a tracking tag, identify the data transmitted and assess the purpose and legal basis under currently applicable law.

A 'privacy policy' alone does not resolve every question. Nor does consent to medical treatment automatically cover use of health-related interactions for advertising optimisation.

AI tools and outsourced campaigns

Clause 7.2(d) refers to patient data entered into AI systems. If a designer uploads a patient scan or record to a generative AI provider, the data issue arises at input, regardless of whether the published creative looks anonymous. S1

A working governance model

Maintain a data-flow diagram and register of collection points, recipients, processing purposes, current legal assessment, retention periods, security controls, vendor agreements and a scheduled DPDP readiness review. Do not manufacture a generic checklist score to declare an entire hospital compliant.

Constructive marketing strategy

Prefer clinically useful, low-data educational pages and secure enquiry channels. Trustworthy measurement should not depend on exporting unnecessary patient medical details to outside ad platforms.