Patient Follow-up CRM for Indian Clinics Under DPDP and Clinical Establishments Act

The 40% follow-up revenue leak

An OPD doctor sees roughly 30 patients on a busy day in urban India. Two of those will need surgery referrals, four will need scans, and roughly twelve will need a structured follow-up to manage a chronic condition — diabetes, hypertension, hypothyroidism, PCOS, or post-pregnancy care. Of those twelve, our 2024 audit of nine clinics found that only seven returned. The other five disappeared. Most of them did not switch doctors — they simply forgot. The clinic forgot first.

DPDP consent — what your CRM must record

The Digital Personal Data Protection Act 2023 introduced specific obligations for Data Fiduciaries that hold patient health information. A patient CRM in 2026 cannot just store name and phone — it must record granular consent for each purpose. The four consent categories every Indian clinic CRM should carry: appointment reminders, lab-result delivery, marketing/wellness updates, and post-care research participation. Each is opt-in, separately revocable, and time-stamped.

• Consent timestamp — exactly when, on which channel, with what wording shown to the patient
• Consent scope — list of purposes the patient agreed to (not a global 'I agree')
• Consent withdrawal trail — the date and channel of any later opt-out
• Re-consent triggers — automatic re-confirmation prompt every 12 months for active patients

Clinical Establishments Act audit trail in the CRM

States that have notified the Clinical Establishments (Registration and Regulation) Act 2010 — Maharashtra, Tamil Nadu, Karnataka, and twelve others — require clinics to maintain auditable records of patient encounters for a minimum of three years (six for paediatric and oncology). A CRM that does not preserve every patient interaction with an immutable timestamp fails the first day of an inspector visit. The fix is straightforward: append-only audit log on every CRM mutation, with the inspector-export view pre-built.

Appointment reminder cadence by speciality

Reminder cadence should vary by speciality, not be a one-size template. A diabetologist's three-month follow-up benefits from a 14-day, 7-day, 2-day, and same-morning WhatsApp reminder chain — the same chain applied to a paediatrician's annual checkup feels spammy and triggers opt-outs. Specialities, our data shows, sort cleanly into four cadence buckets: chronic (every 3 weeks), acute (single 24-hour reminder), elective (14-day + 2-day), and preventive (annual single-touch).

PHI redaction before AI ever sees a record

Healthcare clinics that want to use AI for note summarization or appointment categorization must redact Protected Health Information before the patient record leaves the clinic boundary. The CRM should auto-strip name, phone, address, Aadhaar, ABHA ID, and any free-text mention of family relations before it forwards a record to a language model. This is not optional in a DPDP-aware build — it is the foundational pattern.

A healthcare CRM that asks patients for blanket consent is a healthcare CRM that will not survive its first DPDP audit.

Internal DPDP readiness review, 2024