Skip to content
  1. Home
  2. Blog
  3. Switching clinic software: how to move your data

Software

Switching clinic software: how to move your data What to export, what to ask the old vendor, and how to pick the cut-over day.

Most clinics decide to switch software over a month of small irritations and then try to do the switch in one evening. The data is the part that goes wrong. A plan written a few weeks ahead keeps every old record reachable and the OPD running on the day you change.

Shaurya Pratap SinghFounder, Vitels

Published · Last reviewed · 10 min read

In short
  • Before you give notice, get a full export from the old product in writing: patients, visits, prescriptions, bills and certificates, as CSV files that share one patient ID, plus PDF copies of prescriptions as issued. Check it before the login stops working.
  • The old export is still your medical record. Regulation 1.3.1 of the 2002 conduct regulations asks for 3 years for indoor records, and regulation 1.3.2 gives you 72 hours to hand over a copy on request, whichever software the visit was made in.
  • Under the DPDP Act the clinic usually holds the duty and the vendor processes on its behalf. Section 8(7)(b) has the clinic cause its Data Processor to erase data, except where retention is needed under law. Most of these duties start around 13 May 2027, but put the deletion request in writing now.

Take a complete export from the old software before you cancel anything, ask for it in writing, and check it opens before the old login stops working. The export should cover every patient, every visit, every prescription and every bill, in CSV files that share a patient ID, with PDF copies of prescriptions as they were printed. Then run the new software alongside the old one for a short, planned overlap, cut over on a quiet OPD day, and keep the old export for at least as long as your record-keeping duty lasts. Patients need to hear very little: what changes at the desk, and that their old records are still available.

What should you export, and in what format?

Export everything you would need to answer a patient, a council or your CA about a visit made before the switch. Ask for one file per kind of data, not one giant report, and make sure every file carries the same patient ID so a visit can be matched to a patient and a bill to a visit.

What to take out of the old software
DataWhat it should includeFormat to ask for
PatientsPatient ID, name, mobile number, age or date of birth, sex, address, date of first visitCSV, one row per patient
Visits (OPD notes)Visit date, doctor, complaint, findings, provisional diagnosis, investigations advised, advice, follow-upCSV, one row per visit, with the patient ID
PrescriptionsEvery prescription as issued, with date, doctor and registration numberPDF per prescription or per patient, plus CSV of the medicine lines if available
Bills and receiptsReceipt number, date, patient ID, amount, payment mode (cash, UPI, card), refunds and waiversCSV, one row per bill
Appointments and follow-upsFuture bookings and follow-up dates already given to patientsCSV
Medical certificatesThe certificate register and a copy of each certificateCSV for the register, PDF for copies
AttachmentsScanned reports, photos, consent formsOriginal files in folders named by patient ID
Clinic set-upDoctor fees, prescription templates, medicine favourites, letterheadAny readable format; you will re-enter these by hand

Three details decide whether the export is usable later. The files should be in UTF-8, so names typed in Hindi or another Indian script do not turn into question marks. Dates should be in one stated format, and you should note which (DD-MM-YYYY or YYYY-MM-DD), because 03-04-2025 means 3 April or 4 March depending on how a computer is set up. And the export should cover all dates since the clinic started on that software, not a recent date range.

What to ask the old vendor, and why in writing

Read the old product's terms or your contract first, especially the clauses on termination, data and fees. Those decide how the export is delivered, how long you have after cancelling, and whether it costs anything. Our post on free and paid clinic software lists the costs worth checking before you sign the next one. Then send the request by email, so there is a dated record of what you asked and what was promised.

  1. The full export of all clinic data for all dates, listing the files in the table above.
  2. The format: CSV in UTF-8 with a header row, the patient ID in every file, and the date format stated.
  3. Prescriptions and certificates as PDF copies, and attachments as original files.
  4. How the files will reach you (download link, email, drive) and by what date.
  5. Any fee for the export, stated in rupees before they start.
  6. How long your login will keep working after you give notice, so you can check the export against the live screens.
  7. After you confirm the export is complete: when and how they will delete the clinic's data, what they must keep and for how long, and a written confirmation once it is done.

When the files arrive, check them before you reply that all is well. Compare the patient count in the export with the count the old software shows. Pick ten patients you know, some old and some from last week, and confirm their visits, prescriptions and bills are all there. Total one month of bills from the export and match it against that month's report in the old software. Only then cancel the subscription.

How long must you keep the old records?

Switching software does not change your record-keeping duty. Regulation 1.3.1 of the Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002 says every physician shall maintain the medical records of indoor patients "for a period of 3 years from the date of commencement of the treatment". Regulation 1.3.2 says that when a patient, an authorised attendant or a legal authority asks for records, the request is acknowledged and "documents shall be issued within the period of 72 hours". The National Medical Commission held its own 2023 conduct regulations in abeyance on 23 August 2023 and adopted the 2002 regulations, so these are the numbers that apply. Our medical records guide covers what they mean for an OPD.

In practice, a patient who visited a year before the switch can still ask for their file, and you still have 72 hours. So the old export stays part of your medical records for those years. Keep two copies, one on a computer at the clinic and one on a drive or account the clinic owns, sorted so the desk can find a patient by mobile number in a minute. Treat the copies like the records they are: password-protect the files, and limit who at the clinic can open them.

What the DPDP Act says about the old vendor

The Digital Personal Data Protection Act, 2023 sorts the parties by role. Section 2(i) defines a Data Fiduciary as the person who "determines the purpose and means of processing of personal data"; section 2(k) defines a Data Processor as "any person who processes personal data on behalf of a Data Fiduciary". In most clinic software set-ups, the clinic decides why patient data is collected and the vendor stores it for the clinic, which fits those two roles. Your contract with the vendor is where this is written down, so read it.

DPDP provisions that bear on a software switch
ProvisionWhat it saysWhat to do at the switch
Section 8(1)The Data Fiduciary is responsible for processing "undertaken by it or on its behalf by a Data Processor"The old vendor's handling of your data until deletion is still your concern
Section 8(2)A Data Processor may be engaged "only under a valid contract"Have a signed contract or accepted terms with the new vendor before patient data goes in
Section 8(7)Unless retention is necessary under any law, erase personal data when the purpose is no longer served, and "cause its Data Processor to erase" data given to itAsk the old vendor in writing to erase the clinic's data after you confirm the export, and to confirm when done
Rule 6(1)(f), DPDP Rules 2025Security safeguards include an "appropriate provision in the contract" with the Data ProcessorCheck the new vendor's contract covers security
Rule 8(3), DPDP Rules 2025Personal data and processing logs kept for at least one year from the date of processing, including processing by a Data Processor, unless another law needs longerExpect the old vendor to say some logs must stay for a period; ask them to state what and how long
Section 11(1)(b)A patient can ask for the identities of Data Processors with whom their data was sharedKeep a note of which software held patient data, and from when to when

Timing matters. The definitions in section 2 have been in force since 13 November 2025 under notification G.S.R. 843(E). Sections 3 to 5, 7 to 10 and 11 to 17, which include section 8, come into force eighteen months after that notification, and rules 3 and 5 to 16 of the DPDP Rules, 2025 (G.S.R. 846(E)) on the same timetable, which lands around 13 May 2027. A clinic switching software today is not yet bound by section 8(7), but the written deletion request costs nothing and is the habit the Act will expect. Section 8(7) also keeps your own duty intact: it does not require erasure where "retention is necessary for compliance with any law for the time being in force", and the record-keeping regulations are such a law. Our DPDP guide for clinics has the full timeline.

Getting the old data into the new software

Ask the new vendor before you buy, not after: do they import from other products, which files, in which format, who does the work, and what it costs. An import is only as good as the match between the two products' fields, so ask to see a sample of your own data imported before cut-over, and check the same ten patients you checked in the export.

If the new product does not import, or the import covers only the patient list, you have three workable choices. Register patients afresh as they come, and look up their old history in the export when needed. Enter your regular follow-up patients ahead of time, a few each evening, starting with the ones due back soonest. Or keep the old export open on the desk computer for the first months, searchable by mobile number. What does not work is asking the receptionist to type in thousands of old records between patients. If you are moving from paper rather than from another product, our guide on digitising a paper clinic covers that route.

How should you run the old and new software in parallel?

Run them in parallel for set-up and practice, not for live entry. Double entry of every visit sounds safe but splits the day's bills across two systems and leaves you unsure which total is right when you close the day.

  1. Before cut-over: set up the new software fully. Doctors, fees, timings, letterhead, prescription templates and favourites. Print a test prescription on your own paper.
  2. Practise with sample patients, not real ones. Every person at the desk should register a patient, issue a token, take a payment and close a day at least once. Our post on training the front desk has a plan.
  3. On cut-over day: every new visit and every bill goes into the new software only. The old software becomes read-only, for looking things up.
  4. After cut-over: keep the old login for as long as the vendor allows and you are still checking the export. Cover at least one full week of your OPD, including your busiest day, before you cancel.

How do you choose the cut-over day?

Pick the day your own register says is quietest, not the day after a holiday or the Monday rush. A few other things decide the date.

  • Start the new software on the first day of a month if you can, so each month's billing report lives in one system and your CA gets a clean trail.
  • Note the last receipt number in the old software and the first in the new one, and give both to your CA.
  • Count back from the old subscription's renewal date, so the overlap ends before you pay for another term.
  • Make sure the new vendor's support is reachable that day, by phone or WhatsApp, during your OPD hours.
  • Keep a paper token register and a parchi pad at the desk for the first day, in case anything stalls. Our offline clinic software page explains what keeps working without a connection.

The evening before, after the last patient, take a final export from the old software so it includes that day's visits and bills, and check its patient count against the earlier one.

What should you tell patients?

Only what changes for them. A short notice at the desk, in English and the local language, is enough: the clinic has changed its system; the token slip and prescription may look different; old records are still available on request; the clinic's phone number is the same. If the new software sends patients messages, such as a token on WhatsApp or SMS, tell them what they will receive and from whom, so a new message is not mistaken for spam. Do not promise patients anything the new system has not yet shown it can do at your desk.

Questions

Do I have to delete patient data after switching software?

No. Regulation 1.3.1 asks for indoor records to be kept for 3 years, and requests under regulation 1.3.2 must be answered within 72 hours, so keep the old export. Section 8(7) of the DPDP Act does not require erasure where retention is necessary under law. What you can ask is that the old vendor deletes its copy once you have checked yours.

Can I re-enter old patients into the new software by hand?

Yes, but do it selectively. Enter regular follow-up patients ahead of time, register others as they return, and keep the old export searchable by mobile number for everyone else.

What if the old vendor charges for the export or is slow to send it?

Your contract or the vendor's terms decide the format, timing and any fee, so read them before you give notice. Ask in writing, ask for the fee in rupees up front, and do not cancel until the export has arrived and checked out.

Sources

  1. National Medical Commission, Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002, No. MCI-211(2)/2001/Registration, amended up to 8 October 2016 (regulations 1.3.1 and 1.3.2) (accessed 22 Oct 2026)
  2. National Medical Commission, Registered Medical Practitioners (Professional Conduct) (Amendment) Regulations, 2023, No. R-12013/01/2022/Ethics, 23 August 2023 (abeyance of the 2023 regulations; 2002 regulations adopted) (accessed 22 Oct 2026)
  3. Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Gazette of India, 11 August 2023, sections 2(i), 2(k), 8 and 11 (accessed 22 Oct 2026)
  4. Ministry of Electronics and Information Technology, notification G.S.R. 843(E), 13 November 2025 (commencement of the DPDP Act) (accessed 22 Oct 2026)
  5. Ministry of Electronics and Information Technology, Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), 13 November 2025 (rules 1, 6 and 8) (accessed 22 Oct 2026)

This is operational guidance for clinics, not legal advice. Read your vendor contracts, and confirm with your council or a lawyer.

Drafted with AI assistance; every fact checked against the sources listed; reviewed by Shaurya Pratap Singh.

  1. 1 You
  2. 2 Your clinic

Who should we call?

Your name and the number we can reach you on.

One more step, all of it optional.