DPDP and health data in India: what it means for your wearable integration

Published 20 August 2026 · Written for engineering and product teams, not lawyers.

If you are building a health product for Indian users and pulling data from Oura, WHOOP, Fitbit or Apple Health, you have a data-protection question to answer before you have a scaling question. The Digital Personal Data Protection Act 2023 treats health data as sensitive, and the wearable data you are collecting — sleep, heart rate, glucose, body composition — is squarely health data.

Most teams discover this late, usually when an enterprise customer or a hospital partner sends a security questionnaire. By then the architecture is set and the wearable aggregator is a US-hosted SaaS, which makes the honest answer to “where does this data live?” an uncomfortable one.

What DPDP actually asks of you

Three obligations dominate the engineering conversation. The first is consent. DPDP requires consent that is free, specific, informed, unconditional and unambiguous, given by clear affirmative action and tied to a stated purpose. In practice that rules out bundling “we will read your health data” into a general terms checkbox at signup. It has to be a distinct, purpose-bound choice, and it has to be as easy to withdraw as it was to give — which means a working revocation path, not an email address.

The second is purpose limitation. You may process the data for the purpose the user consented to and not for adjacent things you thought of later. Training a model on aggregate user health data is a different purpose from showing a user their own sleep trend, and consent for one is not consent for the other.

The third — the one that determines your architecture — is where the data sits. Health data on Indian residents is expected to be held on infrastructure within India, and while the precise contours continue to be shaped by rules and sectoral regulators, in-India storage is the defensible default. It is also the answer that gets through a procurement review without a six-week legal detour.

Why this is a problem with most wearable APIs

The major wearable aggregators are US or EU hosted. Terra, ROOK and Junction all run their infrastructure outside India. If you route your Indian users’ sleep and glucose data through one of them, that data leaves the country as a matter of ordinary operation, and the burden shifts to you to justify the transfer, document the consent basis, and satisfy whatever sectoral rules apply to your category.

This is not a reason those vendors are bad — for a US-market product they are excellent choices. It is a reason that a compliance requirement specific to your market may not be satisfiable by a vendor that does not serve that market as a priority.

The trap is that this rarely blocks you early. It blocks you at the exact moment you are trying to close a hospital, an insurer or a corporate wellness contract — the customers who read the questionnaire.

What to check before you pick an aggregator

Five questions, all of which a vendor should be able to answer in writing:

• Where is the data physically stored, and can you name the region? "The cloud" is not an answer.
• Does any processing, backup, or log shipping cross a border? Backups and observability pipelines leak data out of a region more often than the primary datastore does.
• Can you configure retention per tenant, and can you prove deletion actually happened?
• Is there an audit log of privileged access, and can you export it? A questionnaire will ask.
• What is the sub-processor list, and how are you notified when it changes?

How WearLink is set up

WearLink runs on self-hosted infrastructure in India rather than in a US or EU cloud region, so wearable and nutrition data for Indian users does not leave the country as a matter of ordinary operation. That is the main structural reason an India-focused health product would choose us over a larger US-hosted aggregator.

Alongside that: retention is configurable per tenant rather than fixed globally; every privileged action lands in an append-only audit log that you can export as NDJSON with a single request; meal photos have EXIF GPS coordinates stripped before they reach storage; and end-user deletion removes the underlying records rather than flagging them.

What we do not have yet is a SOC 2 Type II report. If your buyer requires an attestation, we cannot satisfy that today, and we would rather tell you now than during procurement. The preparation work and control mapping exist; the audit has not been run.

Frequently asked

Does DPDP require health data to be stored in India?

The DPDP Act 2023 classifies health data as sensitive personal data requiring explicit, granular, informed consent, and the prevailing guidance is that health data on Indian residents should be held on infrastructure within India. Localisation specifics continue to be shaped by rules and sectoral regulators, so treat in-India storage as the defensible default and take your own legal advice rather than relying on a vendor page.

Can I use a US-hosted wearable API for Indian users?

It is not automatically prohibited, but it puts the burden on you to justify a cross-border transfer, document the consent basis, and satisfy any sectoral requirements that apply to your product. The simpler position — and the one that survives a procurement review with less friction — is to keep Indian residents' health data on Indian infrastructure.

What counts as consent under DPDP for health data?

Consent must be free, specific, informed, unconditional and unambiguous, given by clear affirmative action, and tied to a stated purpose. Bundling health-data collection into a general terms acceptance does not meet that bar. Consent must also be as easy to withdraw as it was to give.

Do I still need HIPAA if I am an Indian company?

If you handle protected health information belonging to US patients, yes — HIPAA obligations extend to business associates outside the US. An Indian healthtech serving both markets can find itself subject to DPDP and HIPAA at once, with GDPR added if it has EU users.

How does WearLink handle Indian data residency?

WearLink is self-hosted on Indian infrastructure rather than on US or EU cloud regions, so wearable and nutrition data for Indian users does not leave the country by default. We also ship per-tenant retention configuration, an append-only audit log with NDJSON export, and end-user deletion.