Certinal makes DPDP compliance an operating standard for healthcare - every patient consent captured, signed, purpose-tagged, and audit-ready for the Data Protection Board.
Recognized by analysts. Chosen by organizations worldwide.
Named a Leader in the IDC MarketScape
Recognized in Gartner Peer Insights Voice of the Customer
Rated by verified enterprise reviewers on Gartner Peer Insights
Featured in a Gartner Market Guide
Under the DPDP Act, health data is sensitive personal data and the penalties are not symbolic. A single leaked record, an unlogged consent, or a missed breach notice can put a hospital in front of the Data Protection Board of India - with fines assessed per instance.
The cost of getting it wrong
One mishandled patient record can cost up to ₹250 crore
Every patient record and consent form is in scope
Levied on the hospital as Data Fiduciary, decided by the Board
Stacked on top of NABH scrutiny and reputational fallout
DPDP Act · Penalty schedule for health data
₹250 CrFailure to safeguard patient records, leading to a health-data breach
₹200 CrFailure to notify a breach to the Board and affected patients
₹200 CrBreach of additional obligations around children's and minors' data
₹150 CrNon-fulfilment of Significant Data Fiduciary duties, common for large hospitals
₹50 CrBreach of any other provision of the Act or its Rules
Before the Board asks - who owns DPDP?
01
Name an accountable owner
Significant Data Fiduciaries must appoint an India-based Data Protection Officer who reports directly to the hospital Board.
02
Answer rights in 90 days
Access, correction, and erasure across the EHR, LIS, billing, and every vendor holding a patient's records - captured and evidenced on time.
03
Show your working
Purpose-tagged consent, DPIAs, and independent audit records kept ready as a by-product of everyday care.
Self-serve Privacy Portal. Rights Request Portal. Patient Engagement Portal.
Why Certinal
What makes Certinal different
Consent, compliance and signatures on one platform, typically live in about a week, inside the systems your teams already run.
Three pillars, one platform
DPDP consent management, healthcare consent and enterprise eSignatures in one consent and compliance platform, with every consent event and signature on one audit trail.
DPDP consent management
Healthcare consent
Enterprise eSignatures
7 daystypical time to go live
Live in about a week
The Certinal consent platform is typically deployed in around 7 days, so compliant capture starts almost immediately.
1000+integrations
Inside the systems you run
Direct integrations with Epic, Oracle Cerner, MEDITECH and OpenEMR write completed records back to the patient chart, with free API access on every plan.
LeaderIDC MarketScape, 2023
Recognized by IDC and Gartner
Named a Leader in the IDC MarketScape for worldwide eSignature, featured in a Gartner Market Guide, and rated by verified enterprise reviewers on Gartner Peer Insights.
20M+users worldwide
1M+documents signed monthly
Proven at enterprise scale
One platform carries consent for hospital networks and signatures for global enterprises.
ISO 27001certified, SOC 2 Type II audited
Certified security
Certified and independently audited controls over how personal data is stored, processed, and transmitted.
Hospital network80%
Reduction in patient check-in wait times, with 100% automated, audit-ready consent logs across 70+ hospitals and 10,000+ beds.
One of Asia's largest healthcare networks
Primary care7,000+
Weekly documents signed directly in Epic, eliminating $210K+ in annual administrative cost across 30+ locations.
Independent primary-care network
Private hospital93%
Of patients sign consent forms digitally, saving 4 hours of staff effort a day for 1.1M+ patients served annually.
Leading Southeast Asia hospital
Compliance, mapped in
Consent management starts with compliance
Enforceable agreements and protected health data, mapped to the Indian laws, healthcare standards, and security certifications regulated enterprises are held to.
Indian law
DPDP Act 2023IT Act 2000ABDM Framework
Audit-ready in step
Standards & security
NABH StandardsISO 27001SOC 2 Type II
Purpose-tagged consent
Every patient consent timestamped, versioned, and exportable as proof on demand.
Section 5 (IT Act) electronic signatures for medical records, prescriptions, and consent forms - admissible in Indian courts.
DPDP Section 6, built in
Purpose-based capture, granular notice, and Data Principal rights for sensitive health data - consent that stands up to the Data Protection Board and NABH surveys.
Enforcement clock · Live
Enforcement·May 13, 2027
The window is closing
Enforcement is months away
The law is not theoretical anymore. The work runs in sequence - map the data, serve fresh notices, then stand up consent and rights.
--Days
--Hrs
--Min
--Sec
May 13, 2027Enforcement deadline
Enforcement May 13, 2027
Today
11 Aug 2023 · Enacted
Now · Transition
May 2027 · Enforcement
The window is closing
From enacted to enforced - and where you stand today
2023of 2023-2027
The law2023
DPDP Act enacted
Passed by Parliament as India's data protection law
Every hospital becomes a Data Fiduciary by definition
The law2025
Rules notified
The transition begins - months, not years
Consent, rights, and breach workflows become expected practice
The transitionNow
Map the data
Every place patient data is captured, shared, or stored
A named purpose against each processing activity
The transition+90d
Serve fresh notice
Itemised notice in the patient's chosen language
Legacy consent re-papered against Section 6
The transition+6mo
Stand up consent and rights
Purpose-tagged capture at intake, admission, and procedure
Access, correction, and erasure routed on a 90-day SLA
The deadline2027
Penalties active
Board audits, NABH surveys, and patient complaints
Up to ₹250 crore assessed per instance against the hospital
How Certinal works
Consent, rights, and proof in one platform
01
Ownership
The Act names who answers for compliance, all the way up.
Large hospital networks qualifying as Significant Data Fiduciaries must appoint a Data Protection Officer, based in India, reporting directly to the hospital Board.
Hospital Board. Ultimately accountable for compliance across every facility and department.
Data Protection Officer. Appointed by Significant Data Fiduciaries, answers to the Board.
Clinical & admin teams. Execute, evidence, and audit every patient consent, with Certinal as the system of record.
1named, accountable owner
Boardlevel accountability
Hospital BoardUltimately accountable for compliance
Data Protection OfficerAppointed by SDFs · answers to the Board
Clinical & admin teamsExecute, evidence, and audit patient consent
02
Rights
Access, correction, and erasure of patient data, across the EHR, LIS, billing, and every vendor holding that patient's records.
Done manually, one request can burn weeks of staff time.
One intake for every right. Patient access, correction, and erasure requests captured in a single place.
Automated routing. Requests fan out across the EHR, HIS, labs, and vendors that hold the data.
SLA tracking. Every request actioned and evidenced within the timelines the Act expects.
90days, tracked automatically
1place to run it all
90d
Access requestFulfilled · evidence attached
Correction requestSynced to 4 systems
Erasure requestIn progress · day 6 of 90
03
Evidence
When the Board, a NABH surveyor, or the Data Protection Board asks, leadership needs proof on hand, not a project to assemble it.
Certinal keeps the evidence ready as a by-product of everyday care.
Independent data audits. Patient-consent records structured so external auditors can verify without archaeology.
DPIAs for high-risk processing. Impact assessments for health-data flows, captured and versioned where the processing happens.
Purpose-tagged consent, on demand. Every patient consent timestamped, versioned, and exportable as proof.
Auditready, every day
Proofon demand, not on request
Audit-ready
Every patient consent captured, signed, purpose-tagged, and audit-ready - for the Data Protection Board, NABH surveys, and ABDM.
Integrations
Connects to the healthcare systems you already run
Trigger consent and signing from your EHR, HIS, or patient portal, then get every signed record synced straight back. Free API access on every plan lets your team embed consent capture into any clinical workflow.
Your healthcare stack
EHR / EMR
Hospital Information System (HIS)
Patient Portal & App
Salesforce Health Cloud
Oracle Health
Telehealth Platform
CertinalDPDP Consent & Compliance Platform
Back in your systems
Captured, stored & auditablewith a full DPDP audit trail
System of record · Live now
Consent, end to end
One system of record
Certinal keeps every patient consent, rights request, and audit artefact in one place - so compliance is a by-product of everyday care, not a scramble before an audit.
Purpose-tagged consentEvery consent timestamped, versioned, and exportable as proof.
Data Principal rightsAccess, correction, and erasure captured in one intake with SLA tracking.
Automated routingRequests fan out across the EHR, HIS, labs, and vendors that hold the data.
DPIAs & auditsImpact assessments and independent audit records, versioned where processing happens.
Breach workflowsNotifications and evidence kept ready for the Data Protection Board.
Proof
Outcomes across healthcare
Hospitals
80%Shorter check-in waits
100%Audit-ready logs
70+Hospitals live
Patient intake, admission, and procedure consent captured digitally with the audit trails regulated care demands.
Primary care
7,000+Weekly docs in Epic
$210K+Annual cost removed
Signed directly inside the systems clinicians already use, across 30+ locations.
Private hospital
93%Sign digitally
4 hrsSaved every day
Consent for 1.1M+ patients a year, digital, purpose-tagged, and defensible.
Diagnostics & labs
AnyDevice signing
100%Purpose-tagged
Test authorizations, sample-collection consent, and report release, signed anywhere.
Certinal healthcare customers, 2026 · results vary by deployment and workflow.
Scale
Consent at the scale healthcare runs on
70+
Hospitals on a single network
10000+
Beds served across facilities
1M+
Patients served annually
7000+
Weekly documents signed in Epic
93%
Patients signing digitally
7 days
Typical time to go live
Recognition & certifications
Analyst-recognized. Compliance-certified.
Named a Leader in the IDC MarketScape
Featured in a Gartner Market Guide
Recognized in Gartner Peer Insights Voice of the Customer
Rated by verified enterprise reviewers on Gartner Peer Insights
Consent built for DPDP Section 6 and sensitive health data
Legally valid electronic records and authentication in India
Consent documentation aligned with NABH patient-rights standards
Consent for ABHA-linked records and Health Information Exchange
