Is your personal health record safe? PHR privacy and security in India
- Seht Health Team
- Jun 8
- 5 min read
The most common objection to building a digital PHR in India is this: what if my health data gets leaked? It is a legitimate concern. But the question contains a hidden assumption: that paper records or WhatsApp are safer alternatives. They are not. This article covers what a properly secured PHR app does to protect your data, what India's DPDP Act 2023 requires, and the risks hiding in the alternatives most Indian families currently use.
For the complete PHR guide, read: personal health records India (https://www.seht.in/post/personal-health-records-india-family-guide)
This article answers: ▸ What does India's DPDP Act 2023 mean for your health data? ▸ What security standards should a PHR app meet? ▸ Why is WhatsApp actually less safe than a purpose-built PHR app? ▸ How does ABHA's consent model protect your records? |
The real security landscape for Indian health data in 2026
India's health data security landscape changed fundamentally on November 13, 2025, when Phase 1 of the Digital Personal Data Protection Act 2023 (DPDP Act) came into force. The Data Protection Board of India is now operational. Phase 2 activates consent manager frameworks in November 2026. Phase 3 brings full compliance obligations in May 2027 including breach notification requirements, retention policies, and security safeguard mandates.
Storage method | Encryption | DPDP Act compliance | Practical risk |
Purpose-built PHR app (Seht) | AES-256 at rest and in transit | Yes, built for Indian health data compliance | Lowest designed for health data security |
Google Drive / iCloud | Yes (at rest) | Partial ToS-governed, not Indian health-specific DPDP | Moderate no consent controls, advertising-adjacent business model |
Messages: end-to-end. Media files at rest: unclear. | No Meta's data practices not DPDP-aligned for health data | High accidental forwarding is common; Pune clinic breach 2026 | |
Paper files at home | None | Not applicable | Very high destroyed in floods/fires, lost in moves, readable by anyone |
Personal email | In transit only | No | High frequently compromised; no health structure, no consent controls |
What the DPDP Act 2023 means specifically for PHR app users
India's DPDP Act establishes five rights that apply to your health data held by any data fiduciary:
Right to access: You can request a copy of all personal data the app holds about you
Right to correction: You can request correction of inaccurate personal data
Right to erasure: You can request deletion of your data when the purpose is complete
Right to grievance redressal: You can file a complaint with the Data Protection Board of India
Right to nominate: You can nominate someone to exercise these rights in the event of incapacity or death
These are legally enforceable from Phase 1 (November 2025) through full enforcement at Phase 3 (May 2027). Choosing a DPDP-compliant PHR app means these rights are operationally supported, not just theoretically acknowledged.
Myth: My health records are safer on paper than on a phone.
Reality: Paper health records have no encryption, no access controls, no backup, no geographic redundancy, and no breach accountability. They are destroyed by floods, fires, and house moves. They are read by anyone who opens the drawer. A properly secured PHR app like Seht with AES-256 encryption, authentication requirements, and DPDP compliance is measurably safer than any paper file. |
The five things a secure PHR app must do and how to verify them
AES-256 encryption at rest and in transit: All data encrypted while stored on servers and while being transmitted
ABDM certification: ABDM-certified apps are verified by India's National Health Authority check the partner list at abdm.gov.in
Explicit DPDP Act 2023 compliance statement: The privacy policy should reference DPDP Act 2023 no reference is a yellow flag
No third-party data sale or advertising use: Health data must never be monetised through advertising or sold to third parties
Granular consent for data sharing: Any sharing requires explicit, purpose-specific consent that you can grant and revoke individually
ABHA's security model the consent architecture
ABHA's security model is built on a federated, consent-based architecture. Records stay with the provider that created them. ABHA is the secure highway that moves them with your explicit, time-limited, purpose-specific consent through a 4-digit consent PIN. You can revoke consent at any time. When you link ABHA to Seht, Seht receives records providers push to your ABHA account. No provider gets access to your Seht data through the ABHA link.
For the complete PHR checklist, read: What to include in your personal health record: the complete Indian checklist (https://www.seht.in/post/what-to-include-personal-health-record-india)
When security concerns should prompt action
An app requests permissions with no health records use case contact list access, call log access, real-time location decline and reconsider using the app
A health app privacy policy contains phrases like 'we may share data with partners' without explicit limitation ask exactly what partners means
You receive a data breach notification from a health app follow credential change guidance and file a complaint with the Data Protection Board at dpboard.gov.in
Records appear in your ABHA account from an unrecognised provider contact the NHA grievance portal at grievance.abdm.gov.in
Emergency: If your phone is lost and the health app has no biometric or PIN protection, follow the app account security procedure immediately.
FAQs
Is it safe to store personal health records digitally in India?
Yes, in a properly secured, DPDP-compliant, ABDM-certified app. PHR privacy security India is governed by the DPDP Act 2023 (Phase 1 active November 2025, full enforcement May 2027). Purpose-built apps like Seht use AES-256 encryption, require authentication, do not sell health data, and provide granular consent controls. Risks are significantly lower than paper records or WhatsApp storage.
What does the DPDP Act 2023 mean for my personal health record in India?
The DPDP Act 2023 gives Indian residents five rights over health data held by any app: access, correction, erasure, grievance redressal, and nomination. It requires apps to collect data only for stated purposes, maintain security safeguards, report breaches, and delete data when the purpose is complete. Phase 1 is active from November 2025. Full enforcement begins May 2027.
Is WhatsApp safe for storing health records in India?
WhatsApp is not a safe long-term health records repository. It is a messaging app not designed or certified for health data storage. Accidental forwarding is a documented risk a 2026 Pune clinic case resulted in a DPDP complaint when an MRI was accidentally forwarded to a family group. Media files are not encrypted at rest the same way messages are. A purpose-built PHR app like Seht is the correct container for health records that arrive via WhatsApp.
Download Seht — free on iOS and Android
Seht was built with Indian health data security requirements in mind: AES-256 encryption, DPDP Act 2023 compliance, ABDM certification, no advertising, no data sale. Your family's health records deserve a container designed for them not repurposed from a messaging app.
Download free:
Sources and references
MeitY — Digital Personal Data Protection Act 2023. https://www.meity.gov.in
Recording Law — India data privacy laws DPDP compliance guide 2026. https://www.recordinglaw.com/world-laws/world-data-privacy-laws/india-data-privacy-laws/
EasyClinic — Patient data privacy mistakes India 2026: Pune clinic DPDP breach. https://www.easyclinic.io/patient-data-privacy-mistakes
Disclaimer: This blog is for informational purposes only and is not medical advice. Seht helps families stay informed, but is not a substitute for professional healthcare guidance.
Comments