AI clinic software in India: 14 questions to ask the vendor Which model, what is sent, who reviews, what it costs, and what happens when you leave.

Ask the vendor which model and company run the AI and where, what data is sent, what is stored and whether it trains models, where the DPDP contract is, whether a person reviews every output before it is saved, what the AI never does, what it costs, whether you can switch it off, which languages are tested, what the audit trail shows, what happens to drafts when you leave, and how any accuracy figure was measured. For AI clinic software in India those are the questions to ask; the fourteen below spell them out.

This post sits next to two others. The 20 demo questions cover price, offline work, the print and export; the security questions under DPDP cover encryption, access and logs. Ask those first; the AI questions come on top.

Who runs the AI and what leaves the clinic

1. Which model does this feature use, which company runs it, and in which country or region does it run? Section 8(1) of the DPDP Act makes the clinic responsible for processing "undertaken by it or on its behalf by a Data Processor", irrespective of any agreement to the contrary. You cannot assess a processor you cannot name. A straight answer names the model, the company and the region, in writing. "Our own AI" is not an answer.
2. Exactly what is sent out for each feature: the patient's name, the whole consultation audio, the clinic's name, the doctor's name, a transcript, or only a few words? The NMC's advertising notice of 6 October 2026 says in section 7.2(d) that any use of patient information as input for an AI system shall comply with applicable privacy, confidentiality and data-protection requirements; the clinic cannot meet that without knowing what goes in. A straight answer is a list, per feature, of the fields and files that leave the clinic.
3. Is anything stored by you or by the model company, for how long, and is any of it used to train models? Section 8(7)(b) of the Act requires the clinic, once data is no longer needed, to cause its Data Processor to erase it; a vendor who does not know what its model company keeps cannot promise that. A straight answer gives a retention period for each party and a written statement that clinic data is not used for training.

The contract and the breach

1. Under the DPDP Act, are you our Data Processor for this AI feature, and where is the written contract? Section 8(2) allows a Data Fiduciary to use a Data Processor "only under a valid contract", and rule 6(1)(f) of the DPDP Rules, 2025 asks for appropriate provision in that contract for reasonable security safeguards. A straight answer is a contract you can read before you sign, which names the AI feature and the model company as a further processor. Our post on the DPDP Act for clinics covers the duties themselves.
2. If the AI pipeline leaks, how and when do you tell us? Section 8(6) requires the clinic to inform the Board and each affected patient, and rule 7(2) sets a window of seventy-two hours from becoming aware of the breach for the detailed report to the Board. The vendor's notice to the clinic has to leave room for that. A straight answer is a number of hours, a named contact, and a clause that says so.

What the AI is allowed to do to the record

1. Does a person review every AI output before it is saved, and can the AI write to the patient record on its own? A draft a doctor reads is one thing; a note that lands in the file while the next token is called is another. A straight answer: nothing is saved until a named user accepts it, and no setting skips that step.
2. What does the AI never do, and is that written down? Ask about clinical decision support, dose suggestions, drug interaction alerts and diagnosis. If a product does offer these, the doctor is relying on it clinically and needs its scope, source and limits in writing. A straight answer is a written list of what the feature does and does not do, in the contract or the documentation.
3. Can the clinic see, for each saved entry, what the AI generated, who accepted it, and what they changed? Without that trail a disputed note has no history. A straight answer is a log per entry with the generated text, the accepting user and the time. Our post on audit trails in clinic software explains what to look for.

Money and the off switch

1. What are the caps and quotas, and what does the AI cost per month beyond the licence? Model calls cost the vendor money, so there is a limit somewhere. A straight answer states the caps, what happens when they are reached, and whether anything is metered on top of the plan price.
2. Can the clinic switch each AI feature off, separately, and for which roles? A doctor who wants the voice note but not the summary should not have to take both. A straight answer: per-feature switches under the clinic admin, with the feature gone from the screen.

Language and accuracy

1. Which languages does it really support, as a tested locale rather than a count on the website? "Supports Hindi" can mean Hindi speech recognition, or Indian English that copes with a Hindi word in the sentence. A straight answer names the locales and lets your own doctor dictate a real consultation in the demo.
2. How was any accuracy percentage measured: on whose speech, which specialty, which version, and who ran the test? A figure without a method is a slogan. The NMC notice of 6 October 2026 (section 8.1(ix)) bars RMPs and medical institutions from comparative claims such as "best", "No.1" or "most trusted" unless objectively verifiable through a transparent, independently ascertainable methodology. That rule governs what the clinic says, not what a software vendor says; a clinic that repeats a vendor's figure on its own board or website is making the claim itself. A straight answer is the test set, the metric, the date and the model version, in writing.

Leaving

1. What happens to AI drafts, transcripts and audio when the clinic leaves? Accepted entries are part of the record and should come out with the export; unaccepted drafts and recordings should be deleted on a stated date. A straight answer names both dates and says who confirms the deletion. Our post on switching clinic software covers the rest of the move.
2. Have you written all of this down anywhere we can read it? A product that passes patient data to a third party should have a plain page on it: model, company, region, data sent, retention, training, caps, switches. A straight answer is a link.

What vendor pages say, and what to ask

The table takes a sentence from four Indian vendors' own pages and pairs it with the question above that the sentence leaves open. The questions are the same ones you would put to any vendor, including us.

The same questions, answered for Vitels

Vitels has no AI scribe and no decision support; its AI fills medicine details for review and answers how-to questions about the app. Add medicines using AI sends only medicine names to Claude (Anthropic, model claude-sonnet-5-5) and, for a voice note of up to 60 seconds, the audio clip to Azure AI Speech in the Indian English locale (en-IN; it copes with Hinglish phrasing but is not Hindi speech recognition). No patient data, clinic name or staff details are sent, Vitels does not store the audio, nothing is saved until a doctor or clinic admin accepts each card, and the AI never fills the Rx or OTC status. Caps are 60 lookups per clinic per hour and 300 voice notes per clinic per day; the feature is switched on per clinic. Vitels Assistant (Vitels Pro) answers how-to questions in English, Hindi or Hinglish (Claude, model claude-haiku-5-5), declines medical, legal, tax and pricing questions, and is capped at 10 model-answered messages per person per day and 25 per clinic per month; transcripts are readable by Vitels support staff. The full answers are on AI in Vitels and how Vitels handles AI data.

How to use the list

Put the fourteen questions in a sheet, one column per vendor, and mark each answer as written, shown or said. Only written and shown count. Three answers deserve a hard stop if they go the wrong way: the vendor cannot name the model company and region, the AI can write to the record without a person accepting it, and there is no written statement on storage and training. If consent from the patient is the next thing on your mind, our post on AI scribes, consent and DPDP takes that up.