---
title: "Hospitals, labs and health apps (including ABHA): your rights and..."
description: "Medical records, test reports, health apps and your ABHA health account. Plain steps, helplines and templates."
url: "https://dpdpr.in/rights/hospitals-labs/"
canonical: "https://dpdpr.in/rights/hospitals-labs/"
site: "dpdpr.in"
updated: "2026-11-02"
disclaimer: "Independent reference, not legal advice. Not affiliated with the Government of India or MeitY."
---

# Hospitals, labs and health apps (including ABHA): your rights and how to complain

Plain-language help for ordinary people. General information, not legal advice. Helplines, portals and screen names were checked against official Government and regulator pages on 1 November 2026. Portals change: if a screen looks different, follow the words on the screen and the official guide linked in each step.

## What data they hold

- Your medical history, test reports, scans and prescriptions.
- Name, age, phone, address and ID used at registration.
- Insurance and payment details.
- On ABHA: your ABHA number, ABHA address and the consents you gave.

## Your rights under current law

- Medical records and health conditions are 'sensitive personal data' under the IT (SPDI) Rules, 2011 (rule 3). A private company must take your prior permission before sharing it with a third party, unless the law or your contract allows it (rule 6).
- Doctors must give you your medical records within 72 hours of your request, under regulation 1.3.2 of the Code of Medical Ethics Regulations, 2002 (published by the National Medical Commission).
- On ABHA, doctors and hospitals see linked records only with your consent. You can revoke consent at any time, and deactivate or delete your ABHA.
- Health data shared without permission and misused to cheat you is a cyber crime. Report it on cybercrime.gov.in.

## Your DPDP rights once in force

Sections 11 to 14 of the DPDP Act (your rights) and the duties of companies in sections 4 to 10 start on **13 May 2027** (G.S.R. 843(E)). Until then, use the sector rules on this page. After that date you can use both.

From 13 May 2027 a hospital, lab or health app must use your data only for the purpose you agreed, keep it safe and tell you about a breach. A medical emergency (section 7(f)) and treatment during an epidemic (section 7(g)) do not need consent. For children, the Fourth Schedule lets clinical establishments and healthcare professionals process a child's data for health services without parental consent, only as far as needed to protect the child's health.

- Access: a summary of your data and who it was shared with ([section 11](https://dpdpr.in/act/section-11/)).
- Correction, completion, updating and erasure ([section 12](https://dpdpr.in/act/section-12/)).
- Grievance redressal by the company, before going to the Board ([section 13](https://dpdpr.in/act/section-13/)).
- Nominate someone to act after your death or incapacity ([section 14](https://dpdpr.in/act/section-14/)).
- Withdraw consent, as easily as you gave it ([section 6(4)](https://dpdpr.in/act/section-6/)).

## Common problems

- A pharmacy, insurer or diagnostic company calls you about a condition you told only your doctor.
- Test reports sent to the wrong person or shared on WhatsApp.
- The hospital will not give you your records.
- An ABHA account you did not create, or records linked without your consent.

## Evidence to keep

- Your bill or registration slip with the patient ID.
- The call log or message showing your health details.
- A written note of exactly what the caller knew.
- Your written request for records and the date you gave it.

See the full [evidence checklist](https://dpdpr.in/rights/evidence-checklist/).

## How to approach, step by step

Go in this order. Start with the company. Move to the next step only when the time limit has passed or the reply is not good enough. If money was lost or you were threatened, go to 1930 or the police first.

### Control your ABHA health account and who sees your records

ABHA is the health ID of the Ayushman Bharat Digital Mission (ABDM), run by the National Health Authority. Doctors and hospitals can see your linked records only with your consent. You can revoke consent, unlink, deactivate or delete.

**Keep this ready before you start:**

- Your ABHA number or ABHA address, or the mobile number linked to it.
- The phone with that mobile number, for the OTP.

1. Open the ABHA app or the official ABHA portal and log in with OTP.
2. To see who has access, open the **Consent** tab (the privacy policy calls it **My consent**).
3. Select a consent you no longer want. Press revoke or delete. That doctor or hospital can no longer see those records.
4. When a new consent request comes, you can edit it: choose which records to share and for how long. Then grant or deny it.
5. To unlink your ABHA number from your ABHA address, open your profile and choose **Unlink ABHA number**. Confirm with OTP.
6. To leave ABDM, use the deactivate or delete option on the ABHA portal. Deactivation can be reversed. Deletion is permanent. The portal shows any benefit program linked to your ABHA; ABDM says ABHA cannot be deleted while linked to one.
7. For any problem, call **1800 11 4477** or **14477**, or file on [grievance.abdm.gov.in](https://grievance.abdm.gov.in/). Save the grievance number.
8. If ABDM does not fix it, write to the ABDM Grievance Redressal Officer named in the ABHA privacy policy.

Checked on 1 November 2026 against: [Ayushman Bharat Digital Mission (NHA): FAQ](https://abdm.gov.in/FAQ), [ABHA privacy policy (NHA): your rights, consent withdrawal, grievance officer](https://abdm.gov.in/abha-PRIVACY-POLICY-english), [ABDM grievance portal](https://grievance.abdm.gov.in/), [ABDM newsletter, April to June 2025: ABHA deletion (not while linked to a benefit program)](https://abdm.gov.in/strapicms/uploads/ABDM_Newsletter_April_to_June_2025_revised_color_a2b033f077.pdf).

### Use your DPDP rights (from 13 May 2027)

The rights in sections 11 to 14 of the DPDP Act, and the duties of companies that go with them, start on 13 May 2027 (G.S.R. 843(E)). Until then you can still write to a company and ask. Many will answer. But they are not yet bound by these sections.

**Keep this ready before you start:**

- The company's published method for rights requests. Rule 14 says companies must show it on their website or app.
- The identifier they ask for, such as your username, customer ID or registered mobile number.

1. Find the company's rights or grievance page, or its Data Protection Officer contact.
2. Send a written request using the method they publish. Use our [request letter template](https://dpdpr.in/rights/rights-request-letter/).
3. Ask for what you need: a summary of your data and how it is used, and the names of everyone it was shared with (section 11); correction, completion, updating or erasure (section 12); or a fix for a grievance (section 13). You can also nominate someone to act for you after death or incapacity (section 14), and withdraw consent (section 6(4)).
4. Save the acknowledgement or ticket number.
5. Wait for the time they publish. Rule 14(3) says it cannot be more than 90 days.
6. If they refuse or do not answer, you can complain to the Data Protection Board of India. You must use the company's grievance route first (section 13(3)).
7. The Board works as a digital office. Use the method it publishes on its website and app (rule 19). We will add the link when the Board publishes it.

Checked on 1 November 2026 against: [Digital Personal Data Protection Act, 2023 (MeitY copy of the Gazette)](https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf), [Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E))](https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf), [G.S.R. 843(E): start dates for the Act](https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf).

### National Consumer Helpline, then the Consumer Commission

The National Consumer Helpline (NCH) is run by the Department of Consumer Affairs. It forwards your complaint to the company and tracks the reply. If that fails, you can file a case before a Consumer Commission on e-Jagriti.

**Keep this ready before you start:**

- Bill, invoice, order ID or account number.
- Your complaint to the company and its reply, if any.
- Screenshots and dates.

1. Call **1915** or **1800114000** (8 AM to 8 PM), or WhatsApp **+91 8800001915**.
2. Or open [consumerhelpline.gov.in](https://consumerhelpline.gov.in/public/) and click **Register Grievance**. You can also use the NCH app or the UMANG app.
3. Describe the problem, the company and what you want.
4. Save the grievance number you are given.
5. Use **Track Your Grievance** to see the company's reply. Use **Upload Documents** to add proof.
6. If the company still does not fix it, you can file a consumer case on [e-Jagriti](https://e-jagriti.gov.in), the official portal for Consumer Commissions. It uses OTP registration, online fees and virtual hearings.
7. File the case within 2 years of the problem. This is the limit in section 69 of the Consumer Protection Act, 2019.

Checked on 1 November 2026 against: [National Consumer Helpline (Department of Consumer Affairs)](https://consumerhelpline.gov.in/public/), [e-Jagriti: file a case before a Consumer Commission](https://e-jagriti.gov.in/).

## Ready-to-use complaint

Copy, fill the brackets, and send it through the company's official channel. Keep a copy.

To: Medical Superintendent / Grievance Officer, \[hospital or lab\] Subject: Request for my medical records and complaint about sharing of my health data, patient ID \[number\] 1. Please give me copies of my medical records for \[dates\]. Regulation 1.3.2 of the Code of Medical Ethics Regulations, 2002 requires this within 72 hours. 2. On \[date\] I got a call from \[number\] about my \[condition / test\]. I shared this only with you. Please tell me whether you shared my data with any company, and stop any such sharing. \[Name\], \[mobile\], \[date\]

## Time limits

- Medical records: within 72 hours of your request.
- ABDM grievance: track it on grievance.abdm.gov.in.
- Consumer case: within 2 years.
- DPDP rights: from 13 May 2027; reply within the time the hospital publishes, at most 90 days.

## If this happened to you

- [\*\*A hospital or lab staff member shared my reports on WhatsApp\*\*Your test results or medical records were shared without your consent.](https://dpdpr.in/rights/scenarios/hospital-shared-reports/)
- [\*\*An insurance agent knows my policy details and keeps calling\*\*An agent or 'advisor' knows your policy, sum assured or renewal date.](https://dpdpr.in/rights/scenarios/insurance-agent-knows/)
- [\*\*Someone called with personal details I never shared with them\*\*A caller knew your name, address, purchases or family details, and named a company.](https://dpdpr.in/rights/scenarios/caller-knew-my-details/)
- [\*\*Agents from other insurers know my health policy and push me to port\*\*Callers know your health insurer, sum insured and renewal date, and push you to switch.](https://dpdpr.in/rights/scenarios/agents-know-health-policy/)
- [\*\*Can my employer see my health claims through the group policy?\*\*You are worried HR can see your diagnosis through the company health cover.](https://dpdpr.in/rights/scenarios/employer-sees-health-claims/)
- [\*\*My diagnosis seems to have reached advertisers or strangers\*\*After a test or visit, you see ads or get calls about your condition.](https://dpdpr.in/rights/scenarios/diagnosis-reached-advertisers/)
- [\*\*The lab sent my test results to my employer's insurer or someone else\*\*Your results reached someone you did not authorise.](https://dpdpr.in/rights/scenarios/lab-sent-results-to-others/)
- [\*\*After buying medicine online, the pharmacy app will not stop calling\*\*An online pharmacy keeps calling and messaging about refills and offers.](https://dpdpr.in/rights/scenarios/pharmacy-app-calls/)
- [\*\*The online lab gave me a wrong report\*\*A home collection or app based lab gave a result that turned out to be wrong.](https://dpdpr.in/rights/scenarios/online-lab-wrong-report/)
- [\*\*My spouse or family shared my medical documents without asking\*\*A family member passed your reports to relatives, an employer or a court.](https://dpdpr.in/rights/scenarios/family-shared-medical-documents/)

## Official sources

- [IT (Reasonable Security Practices and Sensitive Personal Data) Rules, 2011 (India Code)](https://upload.indiacode.nic.in/showfile?actid=AC_CEN_45_76_00001_200021_1517807324077&filename=GSR313E_10511%281%29_0.pdf&type=rule)
- [National Medical Commission: Code of Medical Ethics Regulations, 2002 (records within 72 hours, regulation 1.3.2)](https://nmc.org.in/storage/cms/Ethics-Regulations-2002.pdf)
- [Ayushman Bharat Digital Mission (NHA): FAQ](https://abdm.gov.in/FAQ)
- [ABHA privacy policy (NHA): your rights, consent withdrawal, grievance officer](https://abdm.gov.in/abha-PRIVACY-POLICY-english)
- [Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E))](https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf)
- [Digital Personal Data Protection Act, 2023 (MeitY copy of the Gazette)](https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf)
- [G.S.R. 843(E): start dates for the Act](https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf)