A consent form your patients will actually read, clause by clause.

What a consent form has to do under the DPDP Act.

Under the Digital Personal Data Protection Act, 2023, consent must be free, specific, informed, unconditional and unambiguous, and given by a clear affirmative action. It must be accompanied by a notice that says what data is collected, for what purpose, and how the patient can exercise their rights or complain.

Most clinic consent forms fail on 'specific'. They ask the patient to agree to everything in one line. The Act expects consent per purpose, which means the form has to separate treatment from messaging from marketing, and record each answer.

The template below is written in plain English, short enough to be read at a front desk, and structured so each clause maps to one purpose. Translate it into the language your patients read.

Before the clauses: the notice.

The notice is not the consent. It is the short explanation that comes first. Put it at the top of the form and in the first WhatsApp message a new patient receives from your clinic.

A workable notice reads something like: 'We collect your name, contact details, health information and payment details to treat you, keep your medical record and bill you. We store it in India. You can ask to see, correct or delete your data, or withdraw consent, by contacting contact email. You can complain to the Data Protection Board of India.'

The template clauses.

Each clause below is a separate tick or signature. The note under each one explains why it is there.

1. 1Identity and contact. 'I confirm that the name, date of birth, phone number and address I have given are mine and correct.' Note: this is data accuracy, and it lets you rely on the phone number for messaging.
2. 2Treatment and records. 'I consent to the clinic collecting and keeping my health information, including history, examination findings, diagnoses, prescriptions and reports, for the purpose of my treatment and as required by medical regulations.' Note: this is the core purpose. It should not be optional for someone who wants treatment, and the Act allows for that.
3. 3Sharing within the clinic. 'I understand my record may be seen by the doctors and staff of this clinic, at any of its locations, who are involved in my care or billing.' Note: covers multi-location practices and role-based access.
4. 4Sharing outside the clinic. 'I consent to my record being shared with a referring or referred doctor, a laboratory or a pharmacy only where this is needed for my care, and I will be told when this happens.' Note: keep this narrow. Insurance and third parties get their own consent when the moment arrives.
5. 5ABDM and ABHA. 'I agree to my visit records at this clinic being linked to my ABHA. I understand that sharing them with any other facility will require my separate approval through my ABHA app, which I can withdraw at any time.' Note: linking and sharing are separate steps under ABDM; say so.
6. 6Appointment and care messages on WhatsApp. 'I agree to receive appointment reminders, prescriptions, reports, follow-up and refill messages from this clinic on WhatsApp at the number above. I can reply STOP to end these messages.' Note: this is a utility purpose. Record it with a timestamp; it is your opt-in for WhatsApp Business.
7. 7Health information and offers. 'I agree to receive general health information and information about the clinic's services on WhatsApp. This is optional and does not affect my treatment.' Note: a separate purpose, separately ticked. Default unticked.
8. 8Children. 'I am the parent or legal guardian of the patient named above and I give these consents on their behalf.' Note: for patients under eighteen, the Act requires verifiable parental consent. Record the guardian's identity.
9. 9Retention. 'I understand the clinic keeps medical records for the period required by law and deletes other data, such as messaging preferences, when it is no longer needed.' Note: ties the form to your retention table.
10. 10Rights and withdrawal. 'I understand I can ask to see, correct or delete my data, withdraw any of the consents above, or raise a grievance, by contacting contact email or support phone. Withdrawal does not affect anything done before it.' Note: names the contact, and separates withdrawal from the core treatment record, which you are required to keep.

Close with the patient's name, signature or digital acknowledgement, the date, and the form version.

How to record it.

A paper form in a file is evidence, but it is hard to search and impossible for your messaging system to read. The form is only useful if the answers end up as flags on the patient record.

• Record each clause as a separate field with a yes or no, a timestamp and the channel (desk, WhatsApp, app).
• Store the form version alongside, so you know which wording applied.
• Let the WhatsApp system read the messaging flags. If clause 7 is unticked, no offers go out; if the patient replies STOP, the flag flips and the record shows it.
• Show the flags on the patient header so a doctor or receptionist can see them without opening a separate screen.

On Saaro Health, consent is captured as per-purpose flags on the patient record, timestamped, with a STOP reply on WhatsApp updating the flag automatically. ABHA linking consent is recorded when the patient approves it in their ABHA app, and the consent artefact for any record sharing is stored against the patient.

Collecting consent on WhatsApp instead of paper.

Many clinics now register patients before the visit. A pre-visit message that contains the notice and asks the patient to reply with a keyword for each optional consent is a valid affirmative action, as long as it is recorded.

Keep the treatment consent on the paper or screen form the patient completes at the clinic, where identity is confirmed. Use WhatsApp for the messaging and offers clauses, which are exactly the ones a WhatsApp reply proves.

Mistakes to avoid.

• One tick for everything. It fails the 'specific' test and leaves you unable to prove the messaging opt-in.
• Marketing consent ticked by default. Make it an active choice.
• No version control. If the wording changes, you cannot say what a patient agreed to.
• Asking for Aadhaar on the form. You do not need to hold it; ABHA creation handles the OTP step without it.
• No way to act on withdrawal. If STOP does not stop the messages, the consent record is worth little.

Pair this template with the DPDP checklist for clinics, which covers the inventory, retention and breach steps the form alone does not.