Who owns clinic data
Who owns your clinic's patient data? And does your software sell it?
Your clinic does. Under India's Digital Personal Data Protection Act, 2023 the clinic decides why and how patient data is used, which makes it the Data Fiduciary; the software vendor processes the data on the clinic's behalf. Vitels, clinic management software for Indian clinics, does not sell, license or analyse prescription data for pharma companies, and a clinic admin can download every record as CSV at any time.
Who owns patient data held in clinic software?
The clinic controls it and answers for it. The DPDP Act defines a Data Fiduciary in section 2(i) as the person who "determines the purpose and means of processing of personal data"; for patient records that is the clinic. The vendor is a Data Processor under section 2(k), processing on the clinic's behalf, and section 8(2) says a Data Fiduciary may use a Data Processor only under a valid contract. So the useful questions to ask any vendor are what it does with your data beyond running the software, and how you take the data with you if you leave.
- Data Fiduciary
- Your clinic
- Vitels's role
- Data Processor
- Prescription data
- Never sold or licensed
- Export
- CSV zip, any time, no fee
- Staff access
- None standing
- Stored in
- Central India
Why does it matter whether a vendor sells prescription data?
A prescription says what you prescribe, how often and for whom. Aggregated across clinics, that is useful to anyone who sells medicines, which is why a free or cheap product with a pharmacy, diagnostics or pharma relationship deserves a direct question about what happens to the prescriptions written in it. The answer belongs in the contract, not only on a sales call.
Under the DPDP Act the clinic stays answerable for patient data the vendor processes. Section 8(1) makes the Data Fiduciary responsible for compliance "irrespective of any agreement to the contrary", including for processing done by its Data Processor. A vendor's use of your patients' data for its own purposes is your problem as well as theirs. Our guide to the DPDP Act for clinics covers the duties and dates.
How do I get my records out of Vitels?
Sign in as the clinic admin and download the export. It is a zip of CSV files: the clinic profile, staff, patients, visits, prescription lines, bills, appointments, conditions, investigations, notes, the list of uploaded files, registration notices and online registrations. Cells that a spreadsheet could run as a formula are neutralised, so the files open safely in Excel or Google Sheets.
The export is not a paid feature and needs nobody's approval. It works the same on the free plan and on Pro, and it keeps working if a Pro subscription lapses. Moving from one product to another is covered step by step in switching clinic software.
What are the limits today?
We would rather list them than have you find them. The export is CSV only; a PDF export is not available. Erasing a patient record on request is recorded but not yet carried out, while we wait for counsel's view on how long records must be kept. The offline copy kept on a clinic computer is not encrypted at rest; signing out with nothing waiting to sync clears it. How long you must keep records is a separate legal question, answered in how long to keep medical records in India.
What Vitels does and does not do with your data
Each item is how Vitels works today. The limits are listed further down the page.
No sale of prescription data
Vitels does not sell, license or analyse your prescription data for pharma companies, and does not track where a prescription is filled.
No pharmacy routing
Nothing in the software sends your patients to a pharmacy. No pharmacy reference, QR code or Vitels branding is printed on your prescriptions.
No advertising
No advertising inside the product, so there is no advertiser who needs to know what you prescribe.
Full export, on demand
A clinic admin downloads every record as CSV files in a zip at any time, with no approval and no fee, whether or not the clinic pays for Pro. Each export is written to the audit log.
No standing staff access
Vitels staff have no standing access to patient records. If support must open a record, it is reason-gated, time-limited and logged.
An access log you can read
The clinic admin can read the support access log at any time without asking us.
Kept in India
Records sit in a private database in Central India with no public endpoint, with daily backups kept 30 days.
Clinic by clinic
Each clinic's rows are separated by row-level security in the database, so one clinic's data cannot be read from another clinic's login.
Questions to ask any clinic software vendor about your data
Ask for the answers in writing, in the contract or terms, not only in the demo.
Do you sell, license, share or analyse prescription data for any pharma, pharmacy, diagnostics or insurance company, even anonymised or aggregated?
Does anything in the software route patients to a pharmacy or lab, or print a partner's QR code or branding on the prescription?
Can I export every record myself, at any time, in a format I can open, without paying or asking?
Which of your staff can open patient records, how, and can I see a log of every time they did?
Where is the data stored, and who is your hosting provider?
Is there a written contract that makes you my Data Processor under the DPDP Act?
What happens to my clinic's data after I stop using the product, and how long do you keep it?
What Vitels does not offer yet
We would rather you find this out here than after you have moved your patients in.
- Export as PDF: the export is CSV files in a zip.
- Erasure of a patient record on request: recorded, not yet executed, pending counsel's view on retention.
- Encryption at rest of the offline cache on a clinic computer.
- ABHA linking and consent-based record sharing: on the roadmap, not switched on.
Straight answers
Does Vitels sell my prescription data?
No. Vitels does not sell, license or analyse your prescription data for pharma companies, shows no advertising and does not track where a prescription is filled.
Who owns patient data in clinic software in India?
The clinic controls it. Under the DPDP Act the clinic is the Data Fiduciary, which decides why and how the data is used and answers for it. The software vendor is a Data Processor acting on the clinic's behalf.
Can I export all my clinic's data from Vitels?
Yes. A clinic admin can download every record as CSV files in a zip at any time, with no approval and no fee, on the free plan or Pro.
Can Vitels staff see my patients' records?
Not by default. No Vitels staff member has standing access. If support must open a record, it is reason-gated, time-limited and written to an access log your clinic admin can read.
Where is the data stored?
In a private database in Central India with no public endpoint, with daily backups kept 30 days.
Does anything on the prescription advertise a pharmacy?
No. Prescriptions print on your letterhead with no Vitels branding, pharmacy reference or QR code.
This page explains the DPDP Act in general terms for clinic owners. It is not legal advice; ask a lawyer about your clinic's situation.
Related pages
Security and data
Isolation, audit log, sign-in and break-glass access in detail.
ReadDPDP Act for clinics
What the Act and Rules ask of a small clinic, with dates.
ReadSwitching clinic software
How to move your records from one product to another.
ReadFree clinic management software
What "free" should and should not cost you.
Read