Patient consent for AI scribes: a ready Hindi and English script

An AI scribe listens to the conversation in the consulting room and drafts the clinical note, often the prescription too, for the doctor to check and approve. Done well, the doctor looks at the patient instead of the keyboard. But the patient is being listened to by software, often while describing things they would tell nobody else, so they should be asked first, in words they understand.

This guide gives you those words, written for Indian OPDs, where most patients speak Hindi or another Indian language and many bring a relative into the room.

What a patient should know before the scribe starts

1. What is listened to: the conversation in the room during this visit, including what relatives and staff say.
2. What is kept: whether any audio is recorded, and what happens to the written transcript.
3. For how long: when the transcript is deleted, and that the note the doctor approves goes into their medical record.
4. Who sees it: the doctor and the hospital staff involved in their care, with the software company processing it only for the hospital.
5. That they can say no, or ask to stop at any time, and still be seen exactly as usual.

Every word must be true of your system: if your scribe keeps audio, say so; if the vendor keeps transcripts for 90 days, don’t say 30.

Say it in the patient’s language. In a 2026 study at a tertiary hospital in Mangaluru, 204 of 218 surgeons named language as a barrier to informed consent, and 188 pointed to the content and readability of consent forms. In a New Delhi medicine OPD, 75.2% of 500 patients could not read English. A form in English, signed without being understood, protects nobody.

Why consent matters under India’s DPDP Act

Under the Digital Personal Data Protection Act, 2023, your hospital is the data fiduciary: it decides why and how patient data is processed (section 2(i)). The scribe’s maker is a data processor working for you under a contract (section 8(2)), and your hospital stays responsible for what happens to the data (section 8(1)).

The Act allows some processing without consent, such as responding to a medical emergency (section 7(f)). Whether any of these “legitimate uses” covers an AI scribe in a routine OPD is for lawyers to argue; patients don’t expect software to be listening unless told, so the safe course is a notice and a clear yes. Four provisions shape it:

• A notice first (section 5). A request for consent must come with or after a notice telling the patient what personal data will be processed and why, how to withdraw consent and use their rights, and how to complain to the Data Protection Board. They must be offered it in English or a language in the Eighth Schedule of the Constitution, which includes Hindi (section 5(3)).
• Real consent (section 6(1)). Consent must be “free, specific, informed, unconditional and unambiguous with a clear affirmative action”, and limited to the data needed for the stated purpose. A yes to drafting today’s note is not a yes to anything else.
• Easy withdrawal (section 6(4)). The patient can withdraw at any time, as easily as they said yes. The hospital and its processor must then stop within a reasonable time (section 6(6)), and erase the data unless a law requires it to be kept (section 8(7)).
• Proof (section 6(10)). If it is ever questioned, the hospital must prove that the notice was given and the consent obtained.

The DPDP Rules, 2025 spell out the notice (rule 3). It must make sense on its own, in clear and plain language, with an itemised description of the personal data, the specific purpose, a link to your website or app, and how to withdraw consent, use one’s rights and complain to the Board. Rule 3 and the Act’s main duties apply from 13 May 2027, eighteen months after the Rules were published (rule 1(4); see this law-firm summary). Breaching these duties can attract a penalty of up to ₹50 crore (the Act’s Schedule, item 7).

For a child, which the Act defines as anyone under 18, the parent or lawful guardian gives consent (sections 2(f), 2(j) and 9(1)). The Rules exempt hospitals and doctors from the verifiable parental consent requirement when the processing is limited to giving the child health services, as far as needed to protect the child’s health (rule 12 and the Fourth Schedule). Whether a scribe is needed in that sense is arguable, so ask the parent anyway.

Medical ethics point the same way. The ICMR’s ethical guidelines on AI in healthcare say patients should be fully informed before AI is used in their care and that “patients must have complete autonomy to choose or reject AI technologies”, with no coercion (section 1.1). The NMC’s October 2026 guidelines, though written about advertising, add that any use of patient information as input for an AI system must meet privacy, confidentiality and data-protection rules (clause 7.2(d)).

The spoken script, in Hindi and English

Read this before switching the scribe on; it takes about 30 seconds. Words in square brackets must match your system.

For a patient who prefers English:

When the answer is no, keep it short:

The printed notice, for the wall and the consent slip

Put this at reception and in the consulting room, and hand it to anyone who wants to read before deciding. It covers rule 3 and names the contact person section 6(3) requires. Fill in the brackets.

AI notes in this consulting room

[Hospital name] uses AI software to help doctors write consultation notes.

• What it listens to: what is said in this room during your visit, such as your symptoms, history and questions, and what anyone with you and our staff say. It turns this into a written transcript.
• What it is for: drafting your clinical note and prescription, which your doctor checks and approves. Nothing else.
• What is kept: [No audio recording is kept.] The transcript is deleted [30 days] after your visit. The approved note and prescription stay in your medical record at [hospital name].
• Who sees it: your doctor and the hospital staff involved in your care. [Software company] processes it only on the hospital’s behalf.
• Your choice: it starts only after you say yes. You can say no, or ask us to stop at any time. Your treatment will be exactly the same.
• Questions, your rights or a complaint: [name and designation], [email], [phone], [website link]. If we can’t resolve your complaint, you can take it to the Data Protection Board of India.

इस कमरे में AI नोट्स

[अस्पताल का नाम] में डॉक्टरों के नोट्स लिखने के लिए एक AI सॉफ़्टवेयर की मदद ली जाती है।

• क्या सुना जाता है: आपकी विज़िट के दौरान इस कमरे में कही गई बातें, जैसे आपकी तकलीफ़, पुरानी बीमारियाँ और सवाल, और आपके साथ आए लोगों और हमारे स्टाफ़ की बातें। इनसे बातचीत का लिखित रूप बनता है।
• किस लिए: आपका क्लिनिकल नोट और पर्चा तैयार करने के लिए, जिसे डॉक्टर जाँचकर मंज़ूर करते हैं। किसी और काम के लिए नहीं।
• क्या रखा जाता है: [आवाज़ की कोई रिकॉर्डिंग नहीं रखी जाती।] लिखित बातचीत विज़िट के [30 दिन] बाद मिटा दी जाती है। मंज़ूर हुआ नोट और पर्चा [अस्पताल का नाम] में आपके मेडिकल रिकॉर्ड में रहता है।
• कौन देखता है: आपके डॉक्टर और आपके इलाज से जुड़ा अस्पताल का स्टाफ़। [सॉफ़्टवेयर कंपनी] इसे सिर्फ़ अस्पताल की ओर से प्रोसेस करती है।
• आपकी मर्ज़ी: यह आपकी “हाँ” के बाद ही चालू होता है। आप मना कर सकते हैं या कभी भी बंद करवा सकते हैं। आपके इलाज में कोई फ़र्क़ नहीं पड़ेगा।
• सवाल, आपके अधिकार या शिकायत: [नाम और पद], [ईमेल], [फ़ोन], [वेबसाइट लिंक]। अगर हम आपकी शिकायत हल न कर पाएँ, तो आप डेटा प्रोटेक्शन बोर्ड ऑफ़ इंडिया (Data Protection Board of India) में शिकायत कर सकते हैं।

How to record the yes

The Act asks for “a clear affirmative action” and puts the burden of proof on the hospital, so silence isn’t enough, and a nod is hard to prove later. For every visit, record:

• the date and time;
• who gave the notice (doctor, nurse or reception) and in which language;
• who answered: the patient, or a parent or lawful guardian, and their relationship;
• the answer: yes, no, or stopped part-way, and when.

A tick box in the software, filled in by whoever asked, does this; so does a line on the case sheet. Ask again at every visit. Last month’s yes doesn’t cover today, when the patient may have brought a different relative or a more private problem.

When the patient says no, or changes their mind

• Say thank you and switch it off. Don’t ask why or ask twice, and don’t let the patient feel they have made the doctor’s day harder. Record “declined”.
• Carry on as usual. The doctor writes or dictates the note the old way.
• If they stop part-way, switch it off at once and delete what was captured, unless a law requires you to keep it. Withdrawal doesn’t make the earlier processing unlawful (section 6(5)), but the data should go (section 8(7)).
• Some visits are better without it. Consider keeping the scribe off unless the patient asks for it in mental health, sexual health and any consultation where violence or abuse may come up.
• If a patient can’t decide for themselves, use it only with a lawful guardian’s yes. The Rules expect hospitals to check that a guardian of a person with disability was appointed by a court, a designated authority or a local level committee (rule 11). An attendant who isn’t one can’t say yes for them, so leave it off.

Questions to ask your AI scribe vendor

1. Is any audio kept, even for a short time, and where?
2. When is the transcript deleted, and can we erase one consultation on request?
3. Are our transcripts or notes used to train AI models? If so, that is a different purpose and needs its own consent.
4. Is each consent logged with the case, and each opening of a record?
5. Does our contract say you process our patients’ data only on our behalf (sections 2(k) and 8(2))?

Ask the same of an AI receptionist on your phone line; our guide to what an AI receptionist does covers it.

Where DrMate fits

DrMate’s doctor’s room is built this way. It listens only after the patient’s recorded yes, with the notice read in Hindi or English, and a patient who says no is respected. No audio is kept: speech becomes text and the audio is discarded. The consultation transcript is deleted 30 days after the visit, and the approved note and prescription stay with your hospital. Consent and access are logged for each case, and your hospital admin can erase a consultation on request.

The doctor’s room is built and ships with DrMate, but it is not yet in daily use at a hospital, so we can’t yet tell you how patients respond to the script in practice. Our safety and privacy page covers the rest: your hospital stays the data fiduciary, and the app and its storage are hosted in India on Microsoft Azure.