TL;DR: Three regulators govern Indian hospital marketing — NMC (clinical conduct), ASCI (advertising content), and DPDP (patient data). Build compliance into the workflow rather than bolting it on, and you remove the most common risks before they reach the regulator.
EDITORIAL · JUN 2026
Hospital Marketing Compliance in India: NMC, ASCI & DPDP Checklist
By Qlarify Health Team · 12 min read
Three regulators sit between an Indian hospital marketing team and the patient. The National Medical Commission (NMC) governs the clinical conduct of registered medical practitioners — what they can claim, how they can advertise themselves. The Advertising Standards Council of India (ASCI) regulates the content of healthcare advertising — what creative can say, what it cannot. The Digital Personal Data Protection Act, 2023 (DPDP) governs how patient data is collected, stored, used, and erased.
Most marketing teams know one of the three well and the other two only vaguely. The risk lives in the overlap.
NMC — the clinical-conduct side
Doctors cannot solicit patients, cannot use superlative claims ("best surgeon", "world-renowned"), cannot publish testimonials from patients without explicit consent and clinical accuracy, and cannot pay referral commissions. Hospitals that market individual doctors must keep the doctor's marketing within the NMC professional-conduct boundary. The doctor — not the hospital — carries the medical licence at risk.
ASCI — the advertising-content side
ASCI's healthcare code prohibits exaggerated efficacy claims, requires substantiation for outcome claims, restricts before/after imagery, and demands consent for any patient identifiability. Comparative claims ("better than open surgery") need clinical evidence. Cure claims for chronic disease are out. The ASCI guidelines on celebrities, doctors, and influencers in advertising are tighter than most marketing teams assume.
DPDP Act 2023 — the data-handling side
Granular consent for every data use. Purpose limitation. Right to erase. Right to access. Mandatory breach reporting. No more passive cookie-consent banners — consent must be explicit, specific, and revocable. See our retargeting playbook for the implications on paid media.
The practical compliance checklist
Every patient story, image, or video has a signed consent form on file with a clear scope. Every outcome claim has a citation or internal data substantiation. Every marketing email has an opt-out. Every retargeting audience excludes condition-specificity. Every doctor profile is reviewed for NMC-compliant language. The legal team and the marketing team review the campaign brief together, not separately. Compliance is the workflow, not the audit.
Can a doctor be in a hospital ad?
Yes, with limits. The doctor can appear in their professional capacity — qualifications, experience, factual claims. They cannot use superlatives, cannot make outcome promises, and cannot endorse the hospital in ways that read as solicitation under NMC.
Can we publish patient testimonials?
Yes, with explicit signed consent and clinical accuracy. The patient must be identifiable only with permission, must not make exaggerated outcome claims, and the hospital must hold the consent record for as long as the testimonial is in use.
What does DPDP change for hospital websites?
Cookie banners must collect granular consent. Patient data forms must explain purpose. Retargeting audiences need consent-based definitions. The hospital must be able to honour an erasure request within a reasonable window. Compliance starts on the website, not in the back office.
What happens when an ASCI complaint is filed?
ASCI's Consumer Complaints Council reviews the complaint and requests substantiation from the advertiser. If unsubstantiated, the advertiser is asked to withdraw or modify. Repeat or egregious violations are escalated and can attract regulator and media attention.
Build compliance into the marketing workflow.
We help Indian hospital marketing teams set up NMC, ASCI, and DPDP compliance as a built-in process — not an after-the-fact audit.