Consent & India DPDPA
DPDPGrid — Intelligent Consent Management for Healthcare
This section covers consent management and alignment with the Digital Personal Data Protection Act (DPDPA). It does not replace the platform security topics above.
DPDPGrid is an independent Consent Management System (CMS) designed to help healthcare organisations manage patient consent, protect the confidentiality of patient information, and support the responsible use of health data for authorised healthcare purposes. It provides a centralised framework for managing consent across clinical, administrative, and digital healthcare applications.
Designed to integrate with existing Hospital Information Systems (HIS), Electronic Medical Records (EMR), and other healthcare applications, DPDPGrid enables hospitals to incorporate consent management throughout the patient journey—from registration and consultation to investigations, treatment, patient engagement, research, and discharge.
DPDPGrid supports purpose-based consent management, defined validity periods, consent modification and withdrawal, version management, and audit trails. Its integration capabilities enable connected applications to check relevant consent status and apply the associated permissions before processing patient information.
By providing a common consent management layer across healthcare applications, DPDPGrid aims to improve transparency, strengthen data governance, and help healthcare organisations implement consent processes aligned with applicable requirements of India's Digital Personal Data Protection Act (DPDPA) and rules notified by the Government of India.
Patient journey with consent management integration
Awareness & booking
Consent context before appointments and digital engagement begin.
Registration
Purpose-based consent captured at intake and identity establishment.
Consultation & care
Applications verify consent before clinical documentation and treatment data use.
Diagnostics
LIS, RIS and related systems check consent for investigations and results.
Discharge & beyond
Ongoing consent for follow-up, engagement, research (where permitted), and withdrawal.
Consent management workflows
The diagram below shows how consent is captured through patient-facing portals, stored in a central consent service, and enforced before trusted applications access patient information. FHIR-oriented APIs help connected HIS, EMR, and other systems stay interoperable.
Creating and storing consent (top of diagram)
- Members, administrators and related persons act through consent portals (web, mobile, and other channels) to create, update, revoke, verify, or deactivate consent as permitted by policy.
- The portal calls the consent service using FHIR-style GET, POST, or PUT operations on a Consent resource.
- The consent service persists records in a consent management database—storing new consent and retrieving existing records when required.
Validating consent before data access (bottom of diagram)
- A trusted application requests patient information through standard healthcare APIs.
- Before data is released, the platform asks the consent service whether the requested use is authorised for that patient and purpose.
- If consent is valid, access proceeds from the clinical data repository; if not, the request is denied and only the permitted response is returned to the caller.
How consent works throughout the patient journey
DPDPGrid introduces a consent verification process at each relevant stage of the patient journey. Before a connected application uses patient information for a particular purpose, it can check whether the required consent is available and valid. If consent is not available, the application can initiate a consent request through the CMS.
Patients can provide, reject, or modify consent as supported by the relevant process. The CMS records consent details, purpose, data scope, validity, and changes in an audit trail. Consent updates and withdrawals can be communicated to integrated applications so that subsequent data processing can reflect the updated consent status.
The platform also provides for patients to view their consent history, review active or expired consents, modify consent where permitted, and withdraw consent where applicable. These capabilities help establish a transparent and traceable consent management process across the healthcare ecosystem.
Core capabilities
Consent lifecycle management
Create and manage consent templates, versions, purposes, data scope, validity, acceptance, modification, and withdrawal.
Integration with healthcare applications
Consent APIs and status updates for HIS, EMR, CRM, LIS, RIS, document digitisation, and AI/analytics applications.
Audit trail and accountability
Maintain traceable records of consent events, changes, and application interactions.
Patient control and transparency
Enable patients to review consent records, exercise available controls, and receive relevant notifications.
DPDPGrid's role in the KareGrid ecosystem
Within the KareGrid ecosystem, DPDPGrid serves as an independent consent management layer that can support consent-aware processing across multiple healthcare products and third-party applications. It is designed to work alongside clinical documentation, patient engagement, diagnostic, and hospital workflow solutions.
By separating consent management from individual applications, DPDPGrid allows healthcare organisations to establish a common framework for consent while retaining their existing HIS and EMR infrastructure. Its objective is to make patient consent an integral part of digital healthcare workflows rather than an isolated administrative activity.
DPDPGrid — Consent-driven healthcare. Confidential data. Connected systems.
Compliance note
DPDPGrid is designed to support compliance with applicable Indian data protection requirements, including the Digital Personal Data Protection Act (DPDPA) and rules notified by the Government of India. Actual compliance depends on implementation, operational controls, and the applicable legal requirements for each organisation and deployment.
Product summary: DPDPGrid on the products section.