LEGAL STATUS OF BIOMETRIC HEALTH SCORING SYSTEMS

1. INTRODUCTION

Biometric health scoring systems use physiological or behavioural measurements, biometric sensors, and computational algorithms to generate numerical assessments of a person's health, fitness, disease risk, stress, fatigue, or other health-related characteristics. Examples include wearable-device health scores, facial or voice-based health assessments, heart-rate variability scores, and systems combining biometric measurements with artificial intelligence.

Their legal status depends on their intended purpose, the accuracy of their claims, the sensitivity of the information collected, and whether the scores influence diagnosis, treatment, insurance, employment, or access to public services. A system used for general wellness may face different regulatory requirements from a device intended to diagnose disease or guide clinical decisions.

In India, no single statute specifically governs every biometric health scoring system. Their use is assessed under constitutional privacy protections, information-technology and data-protection laws, medical-device regulation, consumer-protection requirements, and applicable professional standards.

2. LEGAL FRAMEWORK IN INDIA

A. RIGHT TO PRIVACY

Article 21 of the Constitution of India protects the right to life and personal liberty, including informational privacy. Collection and use of biometric health information must therefore be assessed against applicable legal authority, the purpose of processing, necessity, proportionality, and safeguards.

B. INFORMATION TECHNOLOGY ACT, 2000

Section 43A and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, have historically provided protections concerning sensitive personal information, including biometric information and specified medical records. Section 72A addresses disclosure of information in breach of a lawful contract in circumstances covered by that provision.

The precise applicability of these provisions must be assessed against subsequent amendments, commencement notifications, and the current statutory framework.

C. DIGITAL PERSONAL DATA PROTECTION ACT, 2023

The Digital Personal Data Protection Act, 2023, establishes a framework for processing digital personal data, including identifiable health information. Its operative requirements must be applied according to the provisions and commencement notifications in force at the relevant time. Unlike the earlier sensitive-personal-data framework, the Act does not create a separate statutory category for biometric or health data.

Organisations must establish the applicable legal basis, provide required notices, observe consent and other statutory requirements, and implement appropriate security and retention controls.

D. MEDICAL-DEVICE REGULATION

The Drugs and Cosmetics Act, 1940, and Medical Devices Rules, 2017, may apply where a biometric scoring system falls within the regulatory definition of a medical device, including qualifying software intended for medical purposes. Classification depends on intended use and applicable regulatory criteria.

A wellness score is not automatically a medical device. Conversely, describing software as a wellness product does not necessarily exclude regulation if its actual intended purpose is diagnosis, prevention, monitoring, prediction, prognosis, or treatment of disease.

E. CONSUMER PROTECTION AND PROFESSIONAL LIABILITY

The Consumer Protection Act, 2019, may apply where a biometric health scoring product or service involves misleading claims, deficient services, or unfair trade practices. Medical professionals and healthcare institutions may also face liability under applicable law where they rely on unreliable scores without appropriate clinical assessment.

3. CORE LEGAL STANDARDS

A. LAWFUL COLLECTION AND INFORMED CONSENT

Organisations should clearly explain what biometric information is collected, why it is required, how the score is calculated, and whether information will be shared with healthcare providers, insurers, employers, or third-party platforms. Consent must satisfy applicable legal requirements; merely accepting lengthy general terms may not establish meaningful authorisation for every secondary use.

B. PURPOSE LIMITATION AND DATA MINIMISATION

Biometric information should be collected and used for defined, lawful purposes. A fitness score should not automatically become a basis for insurance underwriting, employment decisions, or unrelated behavioural profiling without an independent legal assessment.

C. ACCURACY, VALIDATION, AND CLINICAL RELIABILITY

Developers should validate scoring algorithms against appropriate reference standards and representative populations. They should document false-positive and false-negative rates, limitations, demographic performance differences, and the consequences of inaccurate results. A score should not be presented as a confirmed diagnosis unless the system is appropriately validated and authorised for that purpose.

D. SECURITY AND ACCOUNTABILITY

Organisations should implement encryption, access controls, secure storage, audit trails, incident-response procedures, and appropriate vendor oversight. Where applicable, they must comply with statutory security and breach-notification obligations.

E. NON-DISCRIMINATION AND HUMAN OVERSIGHT

A score should not automatically justify denial of healthcare, employment, insurance, or public benefits. Decisions affecting fundamental rights should be assessed for discriminatory effects, reliability, legal authority, and appropriate opportunities for review.

4. IMPORTANT CASE LAWS

1. Justice K.S. Puttaswamy (Retd.) v. Union of India (2017) — DIRECT CONSTITUTIONAL AUTHORITY

The nine-judge Constitution Bench of the Supreme Court recognised privacy as a fundamental right under the Constitution. The judgment provides the foundational constitutional framework for protecting personal and health-related information against unjustified interference.

2. K.S. Puttaswamy (Retd.) v. Union of India (2018) — DIRECT BIOMETRIC-DATA AUTHORITY

In the Aadhaar judgment, the Supreme Court examined biometric identification, data retention, security safeguards, and proportionality. The decision is relevant to biometric health scoring because it emphasises that the legality of collecting and using biometric information depends on the governing law, purpose, and safeguards. It did not specifically determine the legality of health-scoring algorithms. <Cite refs={["turn380192search25","turn380192search3"]}/>

3. Selvi v. State of Karnataka (2010) — ANALOGOUS AUTHORITY

The Supreme Court addressed involuntary narcoanalysis, polygraph examinations, and brain-mapping techniques. The judgment is relevant to bodily autonomy, personal liberty, and protection against compelled extraction of personal information. It does not establish a blanket prohibition on consensual wearable-device measurements.

4. District Registrar and Collector v. Canara Bank (2005) — ANALOGOUS AUTHORITY

The Supreme Court considered privacy and unauthorised access to private records. Its reasoning supports the principle that access to sensitive personal information requires lawful justification and cannot be treated as unrestricted merely because records are held by an institution.

5. Suchita Srivastava v. Chandigarh Administration (2009) — ANALOGOUS AUTHORITY

The Supreme Court recognised reproductive autonomy as an aspect of personal liberty under Article 21. The decision reinforces bodily autonomy and informed choice, principles relevant when health technologies collect intimate physiological information or influence personal medical decisions.

6. Common Cause v. Union of India (2018) — ANALOGOUS AUTHORITY

The Supreme Court recognised the importance of autonomy and informed consent in end-of-life medical decisions. Although unrelated directly to biometric software, the judgment supports respecting individual choice in healthcare and avoiding the substitution of automated assessments for legally and ethically appropriate human decision-making.

5. PRACTICAL COMPLIANCE REQUIREMENTS

Healthcare providers and technology developers should:

Classify the system according to its actual intended purpose and determine whether medical-device requirements apply.

Document data collection, consent, disclosures, retention, and permitted secondary uses.

Conduct algorithmic validation, bias testing, and periodic performance reviews.

Establish procedures for correcting inaccurate records and challenging consequential scores.

Maintain appropriate cybersecurity, vendor-management, and incident-response controls.

Ensure that consequential clinical decisions receive appropriate professional oversight.

CURRENT IMPLEMENTATION NOTE: The Digital Personal Data Protection Act, 2023, and DPDP Rules, 2025, have phased commencement provisions. As of October 2026, not all substantive provisions are yet operative; the relevant commencement dates must be checked before determining which specific obligations apply. <Cite refs={["turn380192search24","turn380192search1"]}/>

6. CONCLUSION

Biometric health scoring systems are not inherently unlawful in India. Their legal status depends on lawful data processing, constitutional privacy protections, scientific reliability, appropriate medical-device classification, and the consequences of the scores. Courts have established important principles concerning privacy, autonomy, confidentiality, and proportionality, but no cited Indian judgment creates a comprehensive legal code specifically for biometric health scoring. Responsible deployment therefore requires transparent consent, validated algorithms, strong security, non-discriminatory use, and appropriate human oversight.