AI and Patient Data in India: What Doctors Are Actually Responsible For
Why this question keeps coming up
Every doctor evaluating AI software eventually asks the same thing: where does my patient's information go, and am I responsible if something happens to it?
The short answer is yes, you are responsible. India's Digital Personal Data Protection framework places obligations on whoever determines how personal data is handled, and for a clinic that is the clinic. Choosing a tool is a decision you are accountable for, in the same way that choosing where to keep the case files is.
This article is a practical guide, not legal advice. Confirm your own position with a legal advisor and your professional body.
The distinction that does most of the work
There are two different situations and people confuse them constantly.
**Situation one: you paste patient information into a general consumer tool.** A chatbot, a translation site, a document summariser. This is a transfer of personal data to a third party for a purpose your patient never consented to, under consumer terms not written for healthcare. It is the common mistake and it is the one to eliminate.
**Situation two: your clinical software sends a bounded request to a model provider as part of delivering care.** This is processing for the purpose the patient came to you for, under your clinic's obligations, with the vendor acting on your instructions. This is an ordinary vendor arrangement, the same shape as using a cloud host or a payment gateway.
The technology can be identical in both cases. The governance is not remotely the same.
What to eliminate first
The realistic risk in most clinics is not the doctor. It is routine staff convenience:
- A receptionist pasting a patient list into a chatbot to "clean up the formatting"
- Someone photographing a prescription and uploading it to a free OCR site
- Staff using an online translator on a document containing names and numbers
- A WhatsApp group with patient reports in it, on personal phones
Write down three rules and tell your staff:
- Never paste patient names, phone numbers, addresses or hospital IDs into any website or app that is not your clinical system.
- Never upload a photograph of a prescription, report or register to a free online tool.
- If you would not read it aloud in the waiting room, do not paste it anywhere.
Questions to ask any AI healthcare vendor
Get these answered specifically, and in writing where you can.
- **Which model provider receives the data?** A vendor who will not name it cannot be assessed. "Enterprise-grade secure AI" is not an answer.
- **Is our data used to train models?** The answer should be an unambiguous no.
- **What is retained, and for how long?** Particularly for audio or uploaded documents. Unspecified retention means indefinite.
- **Who inside your company can see our data?** And is that access logged?
- **Can we export and delete our data?** Including on the day we leave.
- **What happens to patient data if you are acquired or shut down?**
MedKit Care's answers
Stated plainly, because the questions above are only useful if vendors answer them.
MedKit Care's AI features call Google's Gemini models over the API, with DeepSeek as a fallback provider. Data is sent to answer the immediate request and is not used to train any model. Consultation audio is processed to produce the transcript and structured clinical fields and is not retained permanently; what remains on the patient record is the transcript and the data the doctor confirmed. Access inside the platform is governed by a role matrix rather than shared logins, and every access is written to an audit trail. Your clinic owns its data and can export it in full at any time.
MedKit Care is an independent Indian company. It is not affiliated with, endorsed by, or a partner of Google, OpenAI, Anthropic or Apple.
The consent question
Patients do not need to consent separately to every piece of software you use to deliver their care, any more than they consent to your choice of filing cabinet. What matters is that the processing is for the purpose they came to you for, and that you are not doing something with their data they would be surprised by.
Recording a consultation is the case worth thinking about. Telling patients that you use a system that transcribes the consultation to write the prescription is straightforward, takes five seconds, and removes any question later. Most patients find it reassuring rather than concerning.
Where responsibility actually sits
For clinical decisions: with the prescribing doctor, unchanged. An AI draft is a draft.
For data handling: with the clinic, as the entity deciding which tools are used.
For the vendor's own conduct: with the vendor, which is why their answers to the questions above should be in writing rather than in a sales conversation.