Handing a stranger your thyroid results, your medicine list, and your phone number is a reasonable thing to hesitate over. Here's what actually protects you.
Being cautious about sharing health information online isn't overthinking it — it's the right instinct. Here's what real protection looks like, separate from what a platform simply claims.
The law behind it
India's Digital Personal Data Protection Act, 2023 (DPDP Act) governs how your personal data — including health information — can be collected, used, and stored. It gives you specific rights: to know what's collected, to correct it, and to have it deleted. A platform handling health data is expected to have a real, working process behind these rights, not just a line in a privacy policy.
Health data carries a particular weight under this kind of framework, because unlike a leaked shopping habit, a leaked lab result or prescription can follow you into insurance decisions, employment, or family relationships. That's not a reason to avoid online consultation — it's a reason to expect the same seriousness from a telemedicine platform that you'd expect from a hospital's records department, just delivered through an app instead of a filing cabinet.
What "role separation" actually looks like
A phrase like "your data is protected" is easy to write and hard to verify. Role separation is more concrete, and worth understanding in practice: a platform's non-clinical staff — the people who help you reschedule an appointment, answer a billing question, or manage your account — should have no technical ability to open your lab results, read your prescription, or see your doctor's notes. This isn't a policy promise; it's something that has to be built into how the system's permissions work, so that even a well-meaning coordinator literally cannot see clinical detail they don't need for their job. If a platform can't explain, in plain terms, who on their team can see what, that's a meaningful gap — not a minor one.
What to actually check before you book
- Where your data is stored. Health data handled within India, by providers with India-based data residency, keeps you inside India's own legal protections rather than a foreign jurisdiction's.
- Whether video consultations are encrypted. This should be a stated baseline, not a vague reassurance.
- Who can see your records. A well-built platform separates roles — for instance, someone helping schedule your appointment shouldn't be able to see your lab results or prescription contents. If a platform can't explain this separation, that's worth noticing.
- How to delete your data. You should be able to find — and actually use — a way to request correction or deletion of your information, not just read about the right to do so.
The video call itself
Beyond where your records sit afterward, the live consultation deserves its own scrutiny. A video consultation should run over an encrypted connection by default — the same baseline expectation as any sensitive video call, not an optional upgrade. Recording of a consultation, if it happens at all, should require your explicit, informed consent captured before the call starts, not buried in a terms-of-service checkbox you agreed to during signup. If a doctor or platform wants to record a session for any reason, they should say so plainly and ask first.
It's also worth knowing that a legitimate platform's customer-support or coordination team should never ask you to describe your symptoms, lab values, or medication in detail over chat, email, or a phone call outside the consultation itself — that information belongs inside the clinical record, reviewed by your doctor, not scattered across support tickets.
App-based versus web-based consultation
Whether you consult through a mobile app or a browser doesn't change the underlying privacy expectations, but it does change what's worth checking. A mobile app should ask for only the device permissions it actually needs — camera and microphone for the video call, not your contacts list or location history. A browser-based consultation should run over HTTPS with a valid certificate, visible in your browser's address bar. Neither format is inherently more or less private; what matters is whether the platform behind either one has actually built the protections described above.
What's reasonable to ask directly
Before your first consultation, it's fair to ask a platform: where is my data stored, who has access to it, and how do I delete it if I want to later. A platform with a real answer to all three is a good sign. A platform that only points you to a long policy document without a straight answer is not. It's equally reasonable to ask what happens to your records if you stop using the platform altogether — a trustworthy answer describes a defined retention period and a real deletion process, not silence on the question.
Red flags worth noticing
A few patterns are worth treating as warning signs rather than minor inconveniences:
- A platform that can't say where your data is stored, or gives a vague answer like "on secure servers" without naming a region or jurisdiction.
- No visible way to request your own records or ask for deletion, beyond a generic email address with no confirmed process behind it.
- Coordinators or support staff who ask clinical questions — your symptoms, your results, your medication — over chat or phone, rather than directing you to your actual consultation.
- A consultation booked with no clarity on who you're actually seeing — a legitimate platform tells you which doctor you're booked with and lets you verify their registration, rather than assigning an anonymous "on-call doctor."
None of these guarantee a platform is unsafe on their own, but together they're a reasonable basis for choosing a different one.
The safest platform isn't the one that talks about privacy the most. It's the one that can answer these three questions plainly.
Talk to a doctor
When you're ready, Kyros consultations run over encrypted video, and your data stays within India. Take the assessment.
This article is for general information and is not a substitute for a consultation with your own doctor.