1. Introduction

The Biometric Health Doctrine is a legal and ethical framework for determining when biometric information and health-related biometric technologies may lawfully be collected, processed, stored, shared, and used to make decisions about individuals.

It is not a formally codified doctrine under one universally applicable statute. Rather, it is an analytical framework derived from constitutional privacy, bodily autonomy, medical confidentiality, data-protection law, informed consent, equality, and accountability principles.

Biometric health technologies may use fingerprints, facial images, iris patterns, voice characteristics, or physiological signals to authenticate a patient's identity or support healthcare services. Some systems also analyse heart rate, gait, facial movements, or other biological measurements to infer health conditions.

The central legal question is:

How can healthcare providers and governments use biometric technology to improve medical care without violating privacy, dignity, autonomy, confidentiality, or equality?

In India, the doctrine is particularly relevant to Aadhaar-based identification in healthcare, digital health records, hospital authentication systems, biometric attendance for healthcare personnel, and AI-assisted medical monitoring.

2. Meaning and scope of the doctrine

The doctrine can be understood through six interconnected principles.

1. Privacy and confidentiality

Biometric identifiers and health information must receive appropriate protection against unauthorised access, disclosure, and misuse.

2. Bodily autonomy and consent

A person's body, biological characteristics, and sensitive health information should not be subjected to unnecessary or unjustified intrusion.

3. Necessity and proportionality

The biometric method must have a legitimate purpose and should not impose a greater privacy burden than necessary to achieve it.

4. Equality and non-discrimination

Patients must not be unfairly denied treatment, insurance, or essential services because of biometric failure, disability, or algorithmic bias.

5. Purpose limitation and data minimisation

Only information reasonably necessary for a specified healthcare purpose should be collected and retained.

6. Accountability and remedies

Healthcare providers, technology vendors, and public authorities should be answerable for unlawful processing, negligent security, discriminatory decisions, and preventable harm.

These principles operate together. Obtaining consent alone does not necessarily make an excessive collection lawful, and a legitimate medical purpose does not automatically justify insecure storage or discriminatory decisions.

3. Distinguishing biometric identification from biometric health data

A critical legal distinction is the difference between identifying a person and inferring something about their health.

Not every biometric measurement is automatically health data, and not every health measurement is a biometric identifier. The legal classification depends on the information, the processing method, the purpose, and the applicable legislation.

For example, a fingerprint used solely to verify a patient's identity raises different questions from a facial-analysis system that claims to predict depression or cardiovascular risk. The second system also raises questions of scientific validity, medical-device regulation, and the consequences of inaccurate predictions.

4. Constitutional foundations in India

A. Article 21: Right to life, privacy, and dignity

Article 21 of the Constitution of India protects life and personal liberty. The Supreme Court has interpreted it to include privacy, dignity, and personal autonomy.

For biometric healthcare systems, this means that the collection and use of sensitive personal information must be legally justified. Public authorities cannot treat a person's biological identity as information that may be collected and used without meaningful limits.

B. Article 14: Equality before the law

Article 14 becomes relevant where biometric systems produce unequal outcomes. For example, if a hospital's fingerprint authentication system repeatedly fails for certain patients and those patients are denied publicly funded treatment, the resulting exclusion may raise equality and arbitrariness concerns.

C. Article 19: Freedom and autonomy

Where biometric surveillance interferes with protected freedoms, Article 19 may also be relevant. The particular right and constitutional justification depend on the circumstances.

D. Article 20(3): Protection against compelled self-incrimination

Article 20(3) may be relevant when biometric evidence is compelled in criminal proceedings. Its application depends on the nature of the evidence, the compulsion, and the legal context. It is not a general prohibition on collecting biometric information for healthcare.

These constitutional protections provide the foundation for assessing biometric health practices by the State. Private hospitals and technology companies may additionally be subject to statutory duties, contractual obligations, and applicable civil liability rules.

5. Leading case laws

The following cases establish important legal principles relevant to the Biometric Health Doctrine. Some directly concern biometric information, while others concern privacy, medical confidentiality, or the legal treatment of biological evidence.

Case 1: Justice K.S. Puttaswamy (Retd.) v. Union of India (2017)

Citation: (2017) 10 SCC 1 · Supreme Court of India

Facts: A constitutional challenge raised the question of whether privacy is protected as a fundamental right under the Indian Constitution.

Judgment: A nine-judge bench unanimously recognised the fundamental right to privacy, grounded in the Constitution, including Article 21 and the freedoms protected by Part III.

Legal principles:

Privacy includes bodily privacy and informational privacy.

Personal autonomy and dignity are integral to privacy.

Intrusions on privacy require legal justification.

Privacy must be balanced against legitimate State interests through constitutionally appropriate safeguards.

Application to biometric health: A government agency collecting fingerprints, facial templates, or health-linked biometric information must justify the collection under the applicable legal framework. The more sensitive and consequential the processing, the greater the need for effective safeguards.

This judgment supplies the principal constitutional foundation for the Biometric Health Doctrine.

PRIVACY+1

Case 2: K.S. Puttaswamy (Retd.) v. Union of India (Aadhaar judgment, 2018)

Citation: (2019) 1 SCC 1 · Supreme Court of India

Facts: The Court examined the constitutional validity of the Aadhaar framework, including the collection, retention, and use of biometric and demographic information.

Judgment: The majority upheld the Aadhaar scheme in substantial part, while invalidating or restricting certain provisions and uses. Justice D.Y. Chandrachud's dissent raised substantial concerns about informational privacy, exclusion, and the risks of the system's design.

SCI Web API+1

Legal principles:

A privacy-intrusive system must satisfy the applicable constitutional test of legality, legitimate State purpose, and proportionality.

Biometric authentication must be considered in the context of its purpose and safeguards.

Restrictions on data use and disclosure are important to lawful processing.

Authentication failures can have serious consequences where access to essential entitlements depends on successful verification.

Application to biometric health: If a patient cannot obtain a medical benefit because fingerprint authentication fails, the system must be assessed for legal authority, proportionality, available alternatives, and the consequences of exclusion. A system designed to verify identity should not automatically become a barrier to urgent medical treatment.

The case does not establish a universal right to refuse every biometric system. Instead, it requires a contextual examination of the applicable law and constitutional safeguards.

Case 3: Mr. X v. Hospital Z (1998)

Citation: (1998) 8 SCC 296 · Supreme Court of India

Facts: The dispute concerned the disclosure of a patient's HIV-positive status in connection with a proposed marriage.

Judgment: The Supreme Court held, in the circumstances before it, that the patient's confidentiality was not absolute and that disclosure could be justified to protect the prospective spouse from a serious health risk.

Legal principles:

Medical information is ordinarily confidential.

Confidentiality may be subject to legally recognised exceptions.

The competing interests of patient privacy and protection from serious harm must be assessed in context.

Application to biometric health: Linking a patient's fingerprint or facial identity to an HIV diagnosis, genetic condition, or other sensitive medical information raises substantial confidentiality concerns. Any disclosure must have an appropriate legal basis and must not exceed what is justified by the circumstances.

This case should not be interpreted as a general permission to disclose medical information to employers, insurers, relatives, or other third parties.

Indian Kanoon

Case 4: Suchita Srivastava v. Chandigarh Administration (2009)

Citation: (2009) 9 SCC 1 · Supreme Court of India

Facts: The case concerned reproductive autonomy and a decision about termination of pregnancy involving a woman with an intellectual disability.

Judgment: The Court recognised reproductive choice as an aspect of personal liberty under Article 21 and emphasised the importance of consent.

Legal principles:

Reproductive autonomy is protected by personal liberty.

Consent cannot simply be replaced by another person's preference.

Disability does not automatically extinguish personal autonomy.

Application to biometric health: A biometric fertility-screening or reproductive-health system should not be used to impose reproductive choices or make sensitive decisions without a valid legal basis. Biometric authentication also does not substitute for informed consent to a medical procedure.

This principle is particularly relevant when biometric information is linked to fertility services, pregnancy monitoring, or reproductive-health databases.

Case 5: Selvi v. State of Karnataka (2010)

Citation: (2010) 7 SCC 263 · Supreme Court of India

Facts: The Court examined the involuntary administration of narcoanalysis, polygraph examinations, and brain electrical activation profile tests during criminal investigations.

Judgment: The Court held that involuntary administration of the techniques in question violated constitutional protections, including Article 20(3) and the right to personal liberty under Article 21.

Legal principles:

Bodily and mental autonomy receive constitutional protection.

Compelled investigative techniques may violate fundamental rights.

Scientific testing does not become constitutionally permissible merely because it may assist an investigation.

Application to biometric health: The case supports careful scrutiny of coercive biological testing. However, it does not hold that all biometric collection is unconstitutional or that ordinary clinical monitoring is equivalent to narcoanalysis or brain-mapping techniques.

Where biological measurements are taken under compulsion, the legal analysis must consider the nature of the test, its purpose, the applicable law, and the degree of intrusion.

Case 6: District Registrar and Collector v. Canara Bank (2005)

Citation: (2005) 1 SCC 496 · Supreme Court of India

Facts: The dispute involved statutory powers to inspect private documents and records held by a bank.

Judgment: The Court emphasised the importance of privacy in personal records and examined the limits of governmental access to private information.

Legal principles:

Confidential records attract privacy protection.

State access to private information must be supported by lawful authority.

Statutory powers must be interpreted consistently with constitutional protections.

Application to biometric health: Hospital databases containing biometric identifiers, medical histories, and diagnostic information should not be treated as freely accessible merely because the records are stored electronically. Access and disclosure must comply with the governing legal framework.

The case is not specifically about biometric health records, but its privacy reasoning is relevant to access and confidentiality.

6. Comparative legal principles

The Biometric Health Doctrine is also informed by international data-protection frameworks.

Under Article 9 of the GDPR, biometric data processed for the purpose of uniquely identifying a natural person and health data fall within special categories of personal data, subject to specified exceptions and conditions. The UK's ICO similarly explains that biometric data used for unique identification may constitute special-category data.

ICO+1

These approaches are useful for comparison but should not be treated as directly applicable Indian law.

7. Indian statutory framework

A. Digital Personal Data Protection Act, 2023

The Act establishes a framework for processing digital personal data, including obligations relating to lawful processing, consent where required, security, and individual rights.

An important qualification is necessary: the Act's provisions have phased commencement dates. The Digital Personal Data Protection Rules, 2025 were notified in November 2025, but not every provision became operative on the date of notification. As of 28 October 2026, the commencement schedule must be checked before relying on a particular provision in a dispute.

India Code+2

For a biometric-health system, the legal analysis should identify the provisions actually in force, the nature of the data processing, and any applicable exemptions or other statutory regimes.

B. Aadhaar Act, 2016

The Aadhaar Act regulates Aadhaar enrolment, authentication, and the handling of Aadhaar information. Its restrictions are particularly relevant where healthcare benefits or identity verification depend on Aadhaar.

A hospital should distinguish between verifying identity for a lawful purpose and using Aadhaar authentication as a universal condition for every form of medical care.

C. Information Technology Act, 2000

Section 43A and the Sensitive Personal Data or Information Rules, 2011 have historically been relevant to certain forms of negligent handling of sensitive personal information by body corporates. Their continuing application must be assessed in light of the phased transition under the DPDP framework and any applicable amendments.

Section 72A may also be relevant to disclosure of personal information in circumstances covered by that provision.

D. Clinical and medical regulation

Where a biometric system is used to diagnose, monitor, or guide treatment, additional questions may arise under applicable medical-device regulation, clinical-practice standards, and professional duties. A technology used merely to authenticate a patient's identity should be distinguished from a system making clinical recommendations.

8. Applying the doctrine to common healthcare situations

Situation 1: Fingerprint authentication at hospital registration

The hospital should establish why fingerprint authentication is needed, protect the collected data, and provide an appropriate alternative where legally required or operationally necessary. Failed authentication should not be treated as proof that a patient is ineligible for treatment.

Situation 2: Wearable biometric health monitoring

Continuous physiological monitoring may support treatment, but the provider must consider the validity of the measurements, data security, informed participation, and the consequences of false alerts or missed abnormalities.

Situation 3: AI analysis of facial or voice characteristics

A system claiming to detect illness from facial movements or voice must be evaluated for scientific validity and appropriate clinical use. Patients should not automatically be labelled as mentally ill, unfit for employment, or high-risk based on unvalidated biometric inferences.

Situation 4: Sharing biometric-linked medical records

Hospitals should define authorised access, prevent unnecessary disclosure, maintain appropriate security controls, and document the legal basis for sharing information with laboratories, insurers, research institutions, or public authorities.

9. Liability and remedies

When a biometric-health system causes harm, the legal route depends on who operates it, what happened, and which law applies.

Constitutional remedies: Article 32 or Article 226 proceedings may be available for violations of fundamental rights by public authorities, subject to the relevant requirements.

Statutory remedies: Complaints and remedies may be available under applicable data-protection, Aadhaar, medical-device, or other legislation.

Civil liability: Negligence, breach of confidence, contractual breach, or other recognised causes of action may be relevant.

Professional accountability: Healthcare professionals may face disciplinary consequences where their conduct violates applicable professional standards.

Criminal liability: This may arise where the facts satisfy the elements of an applicable criminal offence.

Not every data breach automatically establishes a right to compensation, and not every inaccurate biometric result constitutes negligence. The claimant must establish the elements required by the relevant legal route.

10. A practical legal test for biometric health systems

The following six-step test summarises the proposed doctrine for legal analysis.

Lawful authority: Is there a valid legal basis for collecting and processing the biometric information?

Legitimate purpose: Is the stated purpose sufficiently clear and legally permissible?

Necessity and proportionality: Is biometric processing necessary, and could a less intrusive method achieve the same purpose?

Consent and autonomy: Where consent is required, is it informed, meaningful, and appropriately obtained?

Security and fairness: Are the information and system protected, and are foreseeable errors and discriminatory outcomes addressed?

Accountability and remedies: Can affected individuals obtain explanations, challenge adverse decisions, and seek available remedies?

This test is a proposed analytical framework, not a separate statutory test expressly enacted under the name “Biometric Health Doctrine.” Its components derive from established legal principles and must be applied according to the governing law.

11. Conclusion

The Biometric Health Doctrine places human dignity, privacy, bodily autonomy, equality, and accountability at the centre of healthcare technology.

The most important Indian authorities are K.S. Puttaswamy (2017), the Aadhaar judgment (2018), Mr. X v. Hospital Z (1998), Suchita Srivastava (2009), Selvi (2010), and District Registrar v. Canara Bank (2005). Together, they provide a foundation for examining privacy intrusions, confidentiality, consent, biological testing, and the lawful handling of sensitive records.

The governing principle is not that biometric healthcare is inherently unlawful. Rather, biometric technology must serve a justified healthcare purpose within a lawful, proportionate, secure, and non-discriminatory framework. Medical care and human dignity should not become casualties of authentication failures or unchecked technological decision-making.

Academic note: This is a general legal analysis, not legal advice for a particular dispute. For a case-specific opinion, the exact technology, institution, purpose of collection, and applicable statutory provisions would need to be identified.