Overview
Tata 1mg (formerly 1mg) is India’s leading online pharmacy and health platform. Users upload prescriptions, order medicines (often for chronic conditions), book lab tests, and consume health content. Every interaction reveals health information — making 1mg effectively a health data processor operating under e-commerce privacy standards.
DPDP Readiness: Section-by-Section Analysis
Section 6 — Consent & Notice 🔴
1mg’s consent is standard e-commerce style: “By using our platform, you consent…” This is fundamentally inadequate for health data processing.
What 1mg collects that reveals health conditions:
- Medicine orders (diabetes medication = diabetes diagnosis)
- Prescription uploads (complete medical history on paper)
- Lab test bookings (thyroid panel = thyroid concern)
- Health content browsing (“symptoms of cancer” searches)
- Doctor consultation records
DPDP requirement: Health data should have explicit, informed, purpose-specific consent with clear explanation of how it will be used and who will access it.
Section 7 — Certain Legitimate Uses 🔴
1mg extends processing well beyond medicine delivery:
- “Personalizing health recommendations” based on medicine purchase history
- Health product advertising (supplements, wellness products) targeted based on prescriptions
- Integration with Tata ecosystem (BigBasket, Tata Neu)
Critical gap: Using prescription medication data to target supplement advertising is not a legitimate use under DPDP.
Section 8 — Obligations of Data Fiduciary ⚠️
Standard security. But prescription uploads (images of medical documents) require:
- Enhanced encryption
- Access controls limiting who can view prescriptions
- Automatic redaction of unnecessary information
- Secure deletion after purpose fulfillment
Section 9 — Data Retention 🔴
No retention timelines. Critical concerns:
- Prescription images: How long are uploaded prescriptions stored? They contain complete health information
- Medicine purchase history: Chronic medication orders create a longitudinal health record
- Lab results: Stored indefinitely or time-bounded?
- Health content browsing: “Searched for [condition]” data — retained?
Section 11 — Rights of Data Principal 🔴
- No mechanism to delete prescription uploads selectively
- No health record portability
- No transparency on how medicine purchase data influences recommendations
- No nomination rights (Section 14)
Section 12 — Right of Grievance Redressal ⚠️
Grievance officer exists. No DPB pathway. No mechanism for health data-specific privacy complaints.
Section 16 — Cross-Border Data Transfer ⚠️
As a Tata Group entity, data may flow within the conglomerate. Health data localization should be a priority — prescription and medicine data should ideally not leave Indian jurisdiction.
Risk Assessment
| Category | Risk Level | Potential Impact |
|---|---|---|
| Regulatory fine | Critical | Health data mishandling = highest penalty tier |
| Medicine data = health data | Critical | Every purchase reveals a health condition |
| Prescription storage | Critical | Uploaded prescriptions = complete medical snapshot |
| Tata ecosystem sharing | High | Health data flowing to BigBasket/Tata Neu |
| Data retention | Critical | No timelines for deeply sensitive health data |
The Medicine-as-Health-Data Problem
Every 1mg purchase is effectively a health data point:
| Medicine Category | Health Condition Revealed | Sensitivity |
|---|---|---|
| Metformin, insulin | Diabetes | High |
| Antidepressants | Mental health condition | Very High |
| Antiretrovirals | HIV/AIDS | Extremely High |
| Fertility medications | Reproductive health | Very High |
| Blood pressure medication | Hypertension | High |
| Generic vs. branded | Financial health/insurance status | Moderate |
| Refill patterns | Treatment adherence | High |
Treating this data with standard e-commerce privacy standards is a critical oversight.
Recommendations
- Reclassify medicine data as health data — Apply enhanced protections, consent, and retention rules
- Implement prescription auto-deletion — “Prescription images are verified and deleted within 72 hours; only the verification status is retained”
- Separate Tata ecosystem health data — Clear firewall between 1mg health data and other Tata entities
- Create health data consent layers — Separate consent for medicine delivery, lab test booking, health content personalization, and health product marketing
- Define health-specific retention — “Medicine purchase history: 5 years per drug regulatory standards; Lab results: 3 years; health browsing: 90 days; prescriptions: deleted after verification”
- Add nomination mechanism — Allow patients to nominate a family member for health data access
How Does Your Policy Compare?
Take the free 60-second DPDP Audit to check your own company’s liability under the DPDP Act — 16 quick questions, instant risk report.
Analysis conducted by DPDP Consulting, a Meridian Bridge Strategy initiative. For a comprehensive compliance roadmap, book a free consultation.