Consent evidence and breach command · DPDP · Indian hospitals
Consent is evidence. Make it verifiable before 13 May 2027.
That is when the DPDP Rules' notice, security, breach and rights duties take effect for every hospital in India. Capturing consent is a solved problem; proving it, stopping processing when it is withdrawn, and reporting a breach on time are not. This is the evidence and breach layer that sits on top of a consent-capture product.
194 days to enforcement
Receipts verified
435 of 442
6 unsigned paper imports and 1 edited after signing, both flagged
Withdrawals propagated
33 of 44
7 in progress, 4 outside the 48h window
Open breach: Report to CERT-In
2h 12m
INC-2026-031, running live
DPDP readiness
98%
Seven controls, each derivable from the registry
Computed on this page load from the synthetic tenant, Kestrova Health (fictional); latest receipt 10 hours ago.
Three modules, one evidence format
Evidence
Each consent becomes a receipt bound to the exact notice version and language shown, the identity check and the teach-back grade the server established, sealed with Ed25519. Anyone verifies it offline with the public key; an edit after signing is caught.
Open the registryWithdrawal that reaches processors
Withdrawing a purpose issues a signed event with a cease-processing notice to every processor that received the data, and tracks each acknowledgement against a clock. The receipt itself is never edited.
Withdraw a consentBreach command
CERT-In in 6 hours, the Board and every patient without delay, the detailed report in 72. Rules set severity and duties; a model drafts the notices and offers a second opinion, within a daily budget.
Open breach commandWhat is real and what is simulated
The signing, verification, tokens, clocks, readiness score and AI budget are working code. Identity providers, processors and the hospital itself are simulated, and every screen says which is which.
- Signed consent receipts
Ed25519 · key ksv-47c7d4987f3a
Ed25519 key derived from a deployment secret. Production would hold a per-hospital key in an HSM or cloud KMS. The public key is published, so anyone can verify a receipt offline.
- Tamper detection
Re-hash, then signature check
Every verification recomputes the hash from the stored content first, so an edited receipt fails even when its stored hash and signature were never changed.
- Server-bound evidence
Identity and teach-back tokens
The server signs only identity and comprehension facts it established itself, carried in 10-minute session-bound tokens.
- Live AI
Teach-back, drafting, second opinion
Teach-back grading and advisory triage use Claude Haiku 4.5; Board and patient drafts use Claude Sonnet 4.5. Every call is inside a site-wide daily budget; past it, the deterministic engine runs and says so.
- Legal clocks and duties
Deterministic rules
Board and patient intimation, the 72-hour report and the CERT-In 6-hour clock are computed by rules. No model decides a legal duty.
- Withdrawal cascade
Signed notices; processors simulated
Each withdrawal is a signed event with one cease-processing notice per processor. The processors and their acknowledgements are simulated.
- Identity providers
OTP, ABHA and voice simulated
No SMS is sent and the demo code is 123456. ABHA linkage and voice match are simulated and recorded as such; face liveness runs on the device.
- Hospital data
Synthetic tenant
Kestrova Health, its patients, processors and incidents are fictional. Receipts you sign live only in your browser.
- ABDM consent manager (HIE-CM) bridge
Roadmap
Designed for, not built in this version.
- HIS/EMR write-back (FHIR export only)
Roadmap
Designed for, not built in this version.
- Real SMS OTP and ABHA verification
Roadmap
Designed for, not built in this version.
- Board and CERT-In e-filing
Roadmap
Designed for, not built in this version.
An outside-in product view
Certinal already markets healthcare consent and a DPDP offering to hospitals. This is an independent proposal for the adjacent layer a Group DPO will be asked about first: evidence that survives an audit, withdrawal that provably stops processing, and a breach response that meets its clocks.
Read the strategy and market view