20 questions to ask a clinic software vendor in the demo Each one with the reason it matters and what a straight answer sounds like.

Ask a clinic software vendor about price units, offline behaviour, the printed prescription, edit history, export, the data contract, breach reporting, support and what happens when you leave. The twenty questions below cover those nine subjects. Most take a minute to answer; the vendor who cannot answer one has told you something too.

If you have not yet shortlisted products, our guide on how to choose clinic management software in India comes first. This post is for the demo itself.

Price and plan

1. What is the price per month, and is it per clinic, per doctor, per user or per patient? A per-doctor price doubles when a visiting consultant joins; a per-user price grows with every new receptionist. A clear answer names the unit and the number.
2. What are the written limits of this plan: doctors, staff logins, patients, messages, printing? Limits live in pricing-page footnotes and terms, not in the demo. Ask for the page.
3. Which screens you showed me are not in this plan? Billing, reports or a second doctor often sit one tier up. A clear answer lists the add-ons and their prices.
4. Is GST charged on top, and will the invoice show it? A clinic that supplies only exempt consultations usually cannot claim it back, so it is part of the cost. Our post on free versus paid clinic software has the worksheet.

The day's work

1. Show me a repeat visit from token to printed prescription, with my doctor typing. Repeat visits are most of an OPD day; if they are slower than paper, the records stop within a month. Time it.
2. Pull the internet cable now. Which actions still work: open a patient, write, print, bill, register a new patient? At most OPD desks the connection drops weekly. The clear answer is a written list of what works offline and how sync happens when the line returns.
3. Who sets up the fee list, doctor timings, templates and letterhead, and how long does that take? Setup is the first week's cost in staff time. A clear answer says who does what and gives a day count.
4. How does the front desk learn it, and how long until a new receptionist is on her own? Desk staff change; each change repeats the training cost. Our post on training the front desk has a one-week plan.

The prescription and the record

1. Print one prescription now, on A5 and A4. Does it carry the doctor's registration number, generic drug names and my letterhead, with no vendor logo? Clause 1.4.1 of the 2002 conduct regulations puts the registration number on every prescription, and clause 1.5 asks for generic names written legibly. Check the paper, not the screen.
2. Edit a saved prescription. What does the record show afterwards? A clear answer shows the earlier version, who changed it and when. A silent overwrite is a problem the day a patient or a court asks for the record.
3. Can the patient-facing print or message carry anything of yours: an advert, a QR code, a pharmacy name? The clear answer is no, in writing.

Data, contract and security

1. Under the DPDP Act, is the clinic the Data Fiduciary and are you the Data Processor, and where is the written contract for that? Section 8(2) of the Act allows a Data Fiduciary to use a Data Processor "only under a valid contract", and section 8(1) keeps the fiduciary responsible for processing done on its behalf. A clear answer is a contract you can read before you sign, not a sentence in the terms.
2. Who at your company can open my patients' records, and is each access logged? Rule 6(1)(c) of the DPDP Rules, 2025 lists, among the minimum safeguards, "visibility on the accessing of such personal data, through appropriate logs, monitoring and review". A clear answer names the roles, the reason required and where the log is.
3. Where is the data stored, is it separated from other clinics, and is it encrypted? Rule 6(1)(a) names encryption, obfuscation, masking or virtual tokens among the minimum measures. Ask what is encrypted and whether one clinic's data is isolated from another's.
4. If there is a breach, how and when do you tell me? Section 8(6) of the Act requires the fiduciary to inform the Board and each affected Data Principal; rule 7(2) of the Rules sets a 72-hour window for the detailed report to the Board. The vendor must tell the clinic fast enough for the clinic to meet that. Our list of security questions under DPDP goes deeper.
5. Do you keep logs, and for how long? CERT-In's directions of 28 April 2022 require service providers and body corporates to keep logs of their ICT systems for a rolling period of 180 days within India, and the DPDP Rules speak of retaining logs for one year. A vendor who has not heard of either is a warning sign.

Support and leaving

1. Who answers when the desk is stuck at 10 AM on a Monday, on which channel, in which language, and how fast? A clear answer is a phone number or WhatsApp line and a response time, not an email address.
2. Export my data now. Can the clinic admin do it alone, in which format, and is it in every plan? Run it in the demo, open the file, find a real visit. A PDF of each visit is not an export.
3. If I stop paying, what happens to my records and when are they deleted? The clear answer is a stated read-only period and a deletion date in the terms. Our post on switching clinic software covers the move.
4. Where in your terms are the price-change notice, the cancellation steps and the data return written? Ask the vendor to point to the clause. If it is not written, it is not promised.

How to score the answers

Put the twenty questions in a sheet with one column per vendor. Mark each answer as shown (you saw it in the demo), written (it is in the terms or a document) or said (the salesperson told you). Only shown and written count. Three answers deserve a hard stop if they go the wrong way: no offline behaviour at all, no export by the clinic admin, and no data contract.