Do you have to give your real phone number for a blood test?

At a glance

A diagnostic lab can ask for a number where it’s genuinely needed — mainly to deliver your report — but it can’t force it as a condition of the test or turn it into a marketing channel. Under India’s DPDP Act collection is tied to the stated purpose, and using your number or health details to market to you needs separate consent. So you can ask for report delivery another way, decline the marketing, and get the spam stopped.

Educational resource only. This explains your rights around the personal data diagnostic labs collect under India’s Digital Personal Data Protection Act, 2023 (DPDP Act); it is not formal legal advice.

On this page

• Does a lab actually need your number?
• Is your health and test data specially protected?
• Can they use your number to market to you?
• What you can do about it
• FAQ

The situation

You go in for a routine blood test and the desk insists on your mobile number before they’ll even draw the sample — then the promotional messages start, offering “health packages” for months afterwards. A lab does have a plausible reason to reach you: it has your report. But that’s not the same as an open licence to your number, and the difference is worth knowing.

Does a lab actually need your number?

Sometimes yes — to send your report — but that doesn’t make it a condition of the test or a free pass to everything else. Your number is personal data and the lab is a Data Fiduciary. Under the DPDP Act it must give a clear notice of why it’s collecting (Section 5), and collection is limited to what the stated purpose needs (Section 6). Delivering your report is a genuine purpose a number can serve — but the lab should be able to offer another delivery route (email, in-person collection, a portal), and it can’t insist the number is mandatory when the actual need is report delivery you could receive another way.

Is your health and test data specially protected?

Your test results are personal data, but the DPDP Act has no separate “sensitive” category for them — the real safeguard is purpose limitation. People assume health data sits in a special high-protection box; under the DPDP Act it doesn’t. That isn’t a downgrade — the protection comes from a rule that does most of the work here: purpose limitation. The lab can use your details for the testing and reporting you came in for, and not for anything else. Your results feeding a “wellness package” sales pitch is a different purpose the law doesn’t hand the lab for free.

Can they use your number to market to you?

Not without your separate consent — a number given for your report isn’t a marketing channel, and the telecom rules back that up. Using your contact details to push health-package promotions is a new purpose that needs its own specific consent, not a pre-ticked line on an intake form. On top of the DPDP purpose limit, persistent promotional calls and texts run into India’s telecom rules: you can register on the Do Not Disturb (DND) list and report unsolicited commercial communication. Both point the same way — data collected to serve you isn’t a licence to sell to you.

What you can do about it

Give only what report delivery needs, decline the marketing, and cut off the spam.

1. Ask how the report reaches you. If email, a portal, or in-person pickup works, the mobile number may not be necessary at all.
2. Decline marketing consent. Any “receive offers and health tips” box should be separate and optional — leave it unticked.
3. Say no to repurposing. Your test data is for your diagnosis, not a sales list; you can object to it being used to market to you.
4. Ask for deletion. You can ask the lab to delete your contact details once your report is delivered and there’s no ongoing purpose.
5. Stop the calls. Register for DND and report unsolicited marketing; escalate a lab that won’t stop to the Data Protection Board of India.

FAQ

Can a lab refuse to do my blood test without a phone number? Not where the number isn’t genuinely necessary. If the report can reach you another way, a mandatory number is over-collection — consent must be unconditional, so it can’t be the price of the test.

Isn’t my health data “sensitive” and specially protected? The DPDP Act has no separate sensitive-data category, so it’s protected as ordinary personal data. The key safeguard is purpose limitation — your results can’t be used beyond the testing you came for.

Can the lab send me promotional health-package messages? Only with your separate, specific consent for marketing. Using a number given for your report to push offers is a new purpose — and you can register for DND to curb the messages.

Can I give an alternative or ask for email delivery? Yes. Ask whether email, a portal, or in-person collection works; where it does, you may not need to give a mobile number for the report at all.

Can I make the lab delete my details? Yes. Once your report is delivered and there’s no ongoing purpose, you can ask the lab to erase your contact details and confirm it’s done.