Patient testimonial content compliance in India — DPDP + NMC rules for 2026

What changed in 2024-2026

Three regulatory shifts now bracket how testimonial content is produced in India:

• DPDP Act 2023 + Draft Rules 2025 — personal data of patients (including a face, a name, or a condition narrative) requires specific, purpose-bound consent. Blanket marketing consent is invalid.
• NMC RMP Regulations 2022 — bars doctors from self-promotion via patient testimonials. Patient-volunteered clinic testimonials remain allowed under specific conditions.
• ASCI Health & Wellness Code 2024 update — bans guarantee language, before-after framing for treatment outcomes, and undisclosed incentives in testimonials.

The combined effect is that testimonials are now a regulated content category, not a creative one. Inside Content HQ, the testimonial workflow has its own approval lane, its own consent registry, and its own renewal cadence.

The DPDP-grade consent template

A valid consent record must capture nine fields. Anything less and the consent is considered ambiguous under DPDP’s “specific, informed, unambiguous” test:

The identifier-masking matrix

Even with consent, not every identifier should ship. Content HQ’s masking matrix maps each personal data element to the lowest-risk version that still preserves trust:

Tier 1 is single-signature consent. Tier 2 adds clinical lead countersign. Tier 3 requires legal countersign and 24-month auto-renewal. The matrix sits in Content HQ — the editor sees red flags before the piece advances.

The NMC self-promotion line

NMC RMP Regulations bar a doctor from soliciting or publishing testimonials about themselves. The line that matters: testimonials must be about the clinic, the care process, the team, or the facility — not about the named individual doctor’s skill. Reframing rules:

• Bad: “Dr. X is the best gynaecologist in Pune.”
• Good: “The team at ___ Clinic explained my treatment plan over three sittings and answered every question.”
• Bad: “Dr. Y cured my back pain.”
• Good: “The physiotherapy programme at ___ helped me return to work in eight weeks.”

Content HQ’s lint pass flags testimonials that name an individual doctor as the agent of outcome. The editor rewrites or returns to the patient for an updated quote.

The re-consent renewal cadence

DPDP treats consent as a living artefact. Content HQ runs a quarterly renewal sweep:

1. Month 12 reminder — auto-message to the patient: “Your testimonial is still live. Reply YES to keep it for another 12 months, NO to remove.”
2. No response → soft retire — testimonial moves to draft state and stops being served.
3. Revocation request — testimonial is delisted across all 7 surfaces (web, Instagram, YouTube, Google review re-flag, WhatsApp asset library, GMB, internal training decks) within 72 hours.
4. Audit log — every action logged with timestamp and operator.

The anonymised IVF case

An ICG IVF client ran 26 patient stories across 2023-2024 with informal consent. Migration to Content HQ in early 2025 required a full audit. Outcome:

• 9 stories had no documented consent at all → unpublished pending re-consent
• 6 had Tier 1 consent but published Tier 3 assets (photos) → photo assets pulled, text retained
• 4 violated NMC reframing → rewritten and re-approved by patient
• 2 had inducement (small gift) undocumented → legal countersign added with disclosure
• 5 passed clean

The audit cost 18 hours of ops time and removed nine reputational landmines.

What to set up this quarter

• Adopt the 9-field consent template; back-fill against active testimonials.
• Run the identifier-masking matrix against your top 10 testimonials.
• Set a quarterly renewal sweep with a 72-hour revocation SLA.
• Add NMC reframing as a compulsory lint step in your editor.

Related reading

• Content HQ product page
• Medical fact-check workflow inside Content HQ
• E-E-A-T amplification per content piece
• Client review workflow that eliminates the back-and-forth tax