What to tell someone at the gate before they hand over their details — and the exact signage, screen copy and consent line to do it with.
📌 For hospitals. Under the Digital Personal Data Protection Act, 2023 a visitor must be told what you are collecting, why, and how to raise a grievance — before they hand over their details. Displaying that notice is your obligation as data fiduciary, not Caresoft's.
Below are three things you need: a printable gate notice to display at every entrance, a short notice for the signup screen, and the consent line that sits above the submit button. Fill in the highlighted fields, have your own privacy officer approve it, and print it.
Print this page to get the gate notice on its own, without these instructions.
Display at every gate where the QR code appears, at eye level, in English and in the local language. A0 or A1 for a main gate; A4 beside the QR code itself.
[Hospital Name] — Visitor Management
When you scan the code at this gate and fill in the form, we collect your details in order to issue you a visitor pass.
Your visit record is kept for [90 days] and then deleted. The one-time code record is deleted within 24 hours.
You may ask to see your visit record, have it corrected, or ask us to delete it. You may nominate another person to exercise these rights on your behalf, and you may withdraw your consent. Contact our Grievance Officer below. If you are not satisfied, you may complain to the Data Protection Board of India.
If you do not have a smartphone, cannot read the form, or need help for any reason, please ask the staff at this gate. They will complete it for you. You will not be refused entry because you could not use the digital form.
Shown on the form itself, above the fields. Keep it this short — a visitor standing at a gate will not read more.
[Hospital Name] collects your name, mobile number and visit details to issue your pass and to know who is inside, for everyone's safety. Your mobile is verified by a one-time code on WhatsApp. Email is optional.
We do not take photographs or biometrics, do not ask for ID numbers, and never sell your details. Your record is kept for [90 days].
Questions or requests: [grievance officer email]. Full notice: [link] · How Caresoft handles this data
No smartphone or need help? Ask the staff at the gate — they will assist you.
Signup screen
Immediately above the submit button, as a checkbox that is not pre-ticked.
| Item | Requirement |
|---|---|
| Language | English plus the local language of the area. The DPDP Act entitles a person to the notice in a language listed in the Eighth Schedule of the Constitution |
| Placement | Beside every QR code, and at every gate where the system is in use |
| Timing | Readable before the form is filled, not after submission |
| Consistency | If you change what the form collects, change this notice the same day. A notice that does not match the form is worse than none |
| Retention figure | Must match what is actually configured in the platform. Do not print 90 days and configure 2 years |
| Grievance officer | Must be a real, monitored contact. This is a statutory requirement, not a formality |
| Review | At least annually, and whenever the form, retention or contact changes |
Paste into the visitor form above the fields. Replace the bracketed values.
Note required on the checkbox and the absence of checked. Record the consent — timestamp, notice version and IP — alongside the visitor record, so you can evidence what the person agreed to and when. A consent you cannot evidence is a consent you did not obtain.