India
Device law, data privacy, and hosting tier for India, on one page.
Device law
Full sectionDraft but directionally clear. The October 2025 draft guidance confirms that software performing a medical purpose falls within the MDR 2017 regime, classified A to D on intended use, information significance, and situation severity. Crucially, the guidance states that administrative and non-clinical software, such as billing or appointment management systems, stays outside scope. A triage-capable agent would likely be Class C under central CDSCO licensing. The Telemedicine Practice Guidelines 2020 separately bar platforms from making clinical decisions, so both regimes point the same way.
The data management and general communication carve-out covers the product. Appointment, intake, education, routing all sit here.
Symptom interpretation likely Class C, central licensing, AI/ML validation burden.
The schedule or connect to a human, never decide output design is exactly what keeps the system in the carve-out. Hold that boundary throughout the build.
Data privacy
Full sectionThe framework is now live. The DPDP Rules 2025 were notified on 13 November 2025, operationalising the 2023 Act on a phased schedule running to roughly mid-2027. The model is consent-led: clear notice, defined data-principal rights, and erasure once the purpose is served. Breaches are notifiable to the Data Protection Board, with penalties up to 200 crore per incident. Significant Data Fiduciaries face extra duties, including an annual DPIA and an independent audit. Two design-relevant points: the Act does not carve out a separate sensitive data tier the way GDPR does, treating personal data more uniformly, and cross-border transfers are permitted unless the government specifically restricts a destination, which is more flexible than the EU. Processing data of anyone under 18 needs verifiable parental consent.
Build clean consent and notice, and purpose-bound retention, in from the start. Localisation is not federally mandated, but clinic contracts and sector expectations push toward in-India hosting. Where SDF thresholds are crossed, the annual DPIA and independent audit apply.
Hosting tier
Full sectionContract or consent-gated. India, United States
Cross-border transfer is allowed in India unless a destination is restricted, and is BAA-gated in the US. A managed API is acceptable with proper consent and, in the US, a complete BAA chain. In-region processing is still preferred for trust and to satisfy clinic contracts.