DPDP Consent (Healthcare) — the granular consent gate every clinic lead form now needs.

How it works.

DPDP restructures how a clinic thinks about a lead. Before the Act, a name and phone were a lead; now they are personal data, and personal data has a legal owner — the patient, called the Data Principal — and a legal steward — the clinic, called the Data Fiduciary. The steward's obligations are specific. Consent has to be sought before collection, has to name the purpose, has to be granular per-purpose, and has to be revocable at any time. A single bundled "I accept T&C" checkbox does none of this. The Act does not ban lead-collection — it changes the mechanics of what a valid lead-collection event looks like. Every clinic marketing operation has to unpick the old bundled consent and reassemble it as itemised, purpose-limited, revocable events.

1. Itemise the purposes. Treatment reply, recall communication, marketing broadcast, pLTV attribution — each is a distinct purpose and needs a distinct consent.
2. Notice before consent. The Data Principal must see, in clear language, what data is collected and why, before the consent event.
3. Capture consent, not assumption. A pre-ticked checkbox is not consent. An implied-consent-by-signup is not consent. An affirmative, unambiguous act is.
4. Store the consent record. Every consent event has to be logged — timestamp, purpose, scope, IP or channel — and available to the patient on request.
5. Honour revocation instantly. A patient revoking consent triggers a stop-processing event across every downstream system — CRM, Meta CAPI, WhatsApp broadcast list.
6. Time-bound retention. Data retained only for the duration the consented purpose demands — then anonymised or deleted.

How ICG uses this.

Every ICG-managed lead form ships with an itemised consent block — treatment reply, recall, marketing broadcast, attribution — each with its own checkbox, its own purpose statement, and its own revocation path. Every WhatsApp CTA fires a pre-click disclosure and captures a first-reply consent event that gets logged into HealthPro 360. Every CRM record carries a consent-scope flag that decides which downstream systems can process the record. When a patient revokes, the revocation propagates across Meta CAPI, WhatsApp broadcast list, and the recall system inside 24 hours. The consent architecture is not a compliance overlay — it is the data model the clinic marketing operates on. Related terms: NABH Marketing Compliance and pLTV.

Read next.