1. Introduction

Wellness programme data usage limits refer to the legal, ethical and organisational restrictions governing how an employer collects, accesses, analyses, stores, shares and uses information generated through employee wellness programmes.

These programmes may include:

Physical health assessments, medical screenings and biometric measurements.

Mental health counselling, stress assessments and employee assistance programmes (EAPs).

Fitness applications, wearable devices and activity trackers.

Health-risk assessments, nutrition programmes and smoking-cessation initiatives.

Absence-management, occupational health and return-to-work support.

Aggregated workforce wellbeing dashboards and predictive analytics.

The central legal principle is that employee wellness data should be used only for a legitimate, clearly defined purpose, with appropriate safeguards against unnecessary access, disclosure, discrimination and secondary use.

An employer's ability to offer a wellness programme does not automatically give it unrestricted access to an employee's medical or behavioural information. The legal position depends on the jurisdiction, the nature of the information, the programme's design, the employment relationship and the applicable data-protection and labour laws.

This explanation focuses primarily on Indian law, with relevant comparative principles from UK, European and US case law. The cases below are actual judicial decisions; where a case is from another jurisdiction, its relevance to Indian employers is explained rather than treating it as binding Indian precedent.

2. Meaning and scope of wellness programme data

Not all these categories receive identical statutory treatment in every jurisdiction. Nevertheless, medical and mental health information ordinarily requires especially careful handling.

3. Applicable legal framework in India

A. Constitutional right to privacy

Article 21 of the Constitution protects life and personal liberty. In Justice K.S. Puttaswamy (Retd.) v. Union of India (2017), the Supreme Court recognised privacy as a fundamental right, including informational privacy.

For wellness programmes, the judgment supports several important principles:

Health information is not automatically available to an employer merely because it relates to an employee.

Collection of information should have a legitimate justification.

Intrusive processing should be proportionate to the purpose pursued.

Appropriate safeguards should protect personal information from misuse.

Employees' dignity and autonomy should be respected.

The constitutional framework primarily governs State action, while its principles may also inform statutory interpretation and employment-related disputes involving private employers.

NHRC

+1

B. Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection (DPDP) Act, 2023, establishes a framework for processing digital personal data. The DPDP Rules, 2025, were notified with a phased commencement schedule. As of 17 October 2026, the main processing obligations under sections 3–17 are scheduled to commence 18 months after 13 November 2025, i.e. on 13 May 2027, subject to the applicable commencement notifications. Employers should therefore distinguish enacted provisions from provisions already in force.

MeitY

+2

Once the relevant provisions apply, the DPDP framework will be particularly important for wellness programmes because it addresses:

Lawful processing and notice.

Consent and certain specified legitimate uses.

Data security and breach response.

Rights of individuals in relation to their personal data.

Retention, erasure and accountability.

Important: Do not assume that an employee's consent to participate in a wellness programme authorises every possible use of the information collected. Consent for fitness coaching, for example, is not necessarily consent for sharing individual health results with a line manager or using them in promotion decisions.

C. Information Technology Act and SPDI Rules

Until the relevant repeal and commencement arrangements take effect, the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, remain important to the analysis of digital health information.

The SPDI Rules expressly address certain categories of sensitive personal data, including medical records and history, physical, physiological and mental health conditions, and biometric information. Their applicability depends on the nature of the organisation, the information and the processing activity.

Relevant compliance considerations include consent, disclosure restrictions, reasonable security practices, privacy policies and permitted retention.

D. Employment, disability and medical confidentiality

Employers must also consider applicable employment contracts, standing orders, workplace policies, occupational health obligations, disability law and other sector-specific requirements.

For example, a fitness-for-duty assessment may legitimately communicate whether an employee can safely perform a particular task. That does not ordinarily mean the employer needs the employee's entire psychiatric history, counselling notes or unrelated medical records.

The appropriate principle is to disclose the minimum information necessary for the employment decision, subject to applicable legal duties and safety requirements.

4. Core restrictions on wellness programme data

1. Purpose limitation

Collect information for a defined purpose, such as voluntary fitness support, occupational health or an employee assistance programme. Do not silently repurpose it for performance scoring, promotion decisions or disciplinary investigations.

2. Data minimisation

Collect only the fields needed for the stated purpose. A general wellbeing survey may need an employee's responses but not a complete medical file, exact GPS history or continuous heart-rate readings.

3. Access restrictions

Separate clinical records from ordinary HR files. Limit identifiable medical information to authorised healthcare professionals or other personnel who have a valid, documented need to access it.

4. Confidentiality and disclosure controls

Managers may need to know about approved adjustments or functional restrictions, but they should not automatically receive diagnoses, therapy notes or individual wellness scores.

5. Retention and deletion

Establish retention periods based on purpose, applicable law, clinical obligations and legitimate recordkeeping requirements. Delete or anonymise information when it is no longer needed, unless retention is legally required.

6. Fairness and non-discrimination

Do not treat a low activity score, a mental health diagnosis or participation in counselling as proof of poor performance, unreliability or lack of promotion potential.

These are practical governance principles. The precise statutory duty attached to each principle depends on the applicable law and its commencement status.

5. Important case laws: Detailed analysis

The following eight decisions provide a useful legal foundation. Some are Indian constitutional or medical-confidentiality cases; others are comparative employment or privacy cases. They should not be represented as direct rulings on every aspect of employee wellness data.

Case 1: Justice K.S. Puttaswamy (Retd.) v. Union of India (2017)

Court: Supreme Court of India Citation: (2017) 10 SCC 1

Facts and issue: A nine-judge Constitution Bench considered whether the right to privacy is protected as a fundamental right under the Indian Constitution, in proceedings arising from challenges concerning privacy and Aadhaar.

Legal principles established:

Privacy is protected under Article 21 and other constitutional freedoms.

Informational privacy is an important aspect of personal privacy.

Interference with privacy must satisfy applicable requirements of legality, legitimate purpose and proportionality.

The State has responsibilities to protect privacy and develop appropriate safeguards.

Application to wellness programmes: An employer should not collect continuous biometric information merely because technology makes it possible. It should establish why the data is necessary, whether less intrusive alternatives exist and how access will be restricted.

For example, if an organisation wants to reduce workplace stress, anonymous workforce surveys may achieve the purpose without collecting identifiable psychiatric diagnoses from each employee.

Practical conclusion: This is the foundational Indian authority for a privacy-conscious approach to wellness data. Its constitutional holding directly binds State actors; private-sector employers must also consider the applicable statutory and contractual framework.

Case 2: District Registrar and Collector, Hyderabad v. Canara Bank (2005)

Court: Supreme Court of India Citation: (2005) 1 SCC 496

Facts and issue: The case concerned statutory powers permitting inspection of private documents held by a bank and the privacy implications of access to those records.

Legal principles established: The Court considered the relationship between privacy, confidentiality and access to personal documents. The judgment recognised that records held by another person or institution can still contain private information deserving protection.

Application to wellness programmes: A wellness vendor or healthcare provider should not be treated as an unrestricted source of employee information simply because the employer pays for the service.

Suppose a company contracts with a counselling provider. The company may reasonably need aggregate service-utilisation figures to assess programme effectiveness. That does not automatically justify access to individual counselling notes.

Practical conclusion: Organisations should define contractual confidentiality obligations, restrict access to personal records and require a proper legal basis for disclosure.

Case 3: Kharak Singh v. State of Uttar Pradesh (1963)

Court: Supreme Court of India Citation: AIR 1963 SC 1295

Facts and issue: The case involved police surveillance of a person suspected of criminal activity, including intrusive monitoring and domiciliary visits.

Legal principles established: The Court invalidated certain intrusive surveillance measures. Although the judgment's treatment of privacy was subsequently developed and clarified by the larger Bench in Puttaswamy, it remains an important historical authority on personal liberty and surveillance.

Application to wellness programmes: Continuous monitoring of employee movements, sleep patterns, physiological signals or off-duty activities can raise serious privacy concerns when it is excessive or unrelated to a legitimate workplace objective.

For example, an employer should be cautious about requiring employees to wear a fitness tracker around the clock and collecting their weekend activity data when the programme is intended only to encourage voluntary exercise during working hours.

Practical conclusion: Monitoring should be limited to what is justified by the programme's genuine purpose. Puttaswamy supplies the modern constitutional framework for analysing such intrusions.

Case 4: Selvi v. State of Karnataka (2010)

Court: Supreme Court of India Citation: (2010) 7 SCC 263

Facts and issue: The Court considered the constitutionality of involuntary narcoanalysis, polygraph examinations and brain electrical activation profile tests in criminal investigations.

Legal principles established: The Court held that involuntary administration of the techniques in question violated constitutional protections, including the right against self-incrimination and personal liberty. Its reasoning also addressed bodily integrity and mental privacy.

Application to wellness programmes: Employers should not compel employees to undergo intrusive psychological assessments, disclose deeply personal information or submit to invasive examinations without examining the legal basis, necessity and safeguards.

A compulsory psychological profiling exercise that reveals intimate mental or behavioural characteristics is materially different from an ordinary voluntary wellbeing questionnaire.

Practical conclusion: The decision supports respect for bodily and mental autonomy. It does not establish a blanket prohibition on all employer health assessments; occupational assessments may be permissible where supported by applicable law and justified requirements.

Case 5: X v. Hospital Z (1998)

Court: Supreme Court of India Citation: (1998) 8 SCC 296

Facts and issue: The dispute involved disclosure of a patient's HIV-positive status in the context of a proposed marriage. The case examined medical confidentiality and circumstances in which disclosure may be justified.

Legal principles established: The Court recognised medical confidentiality while also considering circumstances in which competing rights and legitimate interests may justify disclosure.

Application to wellness programmes: Health confidentiality is important, but it is not always absolute. A narrowly tailored disclosure may be legally justified where an applicable duty, sufficiently compelling safety concern or other recognised legal ground exists.

For example, a healthcare professional might need to communicate a genuine work-related restriction to an employer. That does not necessarily justify disclosing the employee's full diagnosis to the employee's entire management team.

Practical conclusion: Disclosure should be justified, proportionate and limited to the necessary recipient and information. Employers should not interpret this decision as general permission to circulate employee medical information.

Case 6: Suchita Srivastava v. Chandigarh Administration (2009)

Court: Supreme Court of India Citation: (2009) 9 SCC 1

Facts and issue: The case concerned reproductive autonomy and the decision-making rights of a woman with an intellectual disability in relation to pregnancy.

Legal principles established: The Court recognised reproductive choice as an aspect of personal liberty under Article 21 and emphasised the importance of individual autonomy and consent.

Application to wellness programmes: The decision offers a broader autonomy principle relevant to reproductive-health and family-planning benefits offered by employers.

An organisation should not pressure employees to participate in fertility assessments, pregnancy-related wellness initiatives or reproductive-health data collection as a condition of career progression or access to unrelated employment benefits.

Practical conclusion: Wellness initiatives involving intimate health decisions should preserve individual autonomy and avoid coercive practices. The case concerns reproductive autonomy, not a comprehensive employee-data processing code.

Case 7: EEOC v. Flambeau, Inc. (2016)

Court: United States Court of Appeals for the Seventh Circuit Citation: 846 F.3d 941

Facts and issue: The dispute involved an employer's wellness programme, health-risk assessment and biometric screening, and whether the programme fell within the relevant US statutory framework governing employee medical examinations and inquiries.

Legal principles and significance: The case examined the application of the Americans with Disabilities Act's insurance-related provisions and the statutory wellness-programme exception. It illustrates that a programme's legal status depends on its actual design and the applicable statutory requirements.

Application to Indian employers: The decision is comparative, not binding in India. It demonstrates why employers should assess the exact information collected, whether medical examinations are involved, the consequences of non-participation and whether incentives operate as meaningful pressure.

An Indian employer should not assume that calling a programme “voluntary” automatically resolves every consent, privacy or discrimination issue.

Practical conclusion: Programme design matters more than the label attached to it. A voluntary programme with genuine safeguards differs from one that effectively penalises employees for withholding medical information.

Case 8: EEOC v. Orion Energy Systems, Inc. (2016)

Court: United States District Court for the Eastern District of Wisconsin Citation: 2016 WL 5107019

Facts and issue: The litigation concerned an employer's wellness programme, medical examinations and the financial consequences imposed on an employee who declined to participate.

Legal principles and significance: The dispute highlighted the interaction between wellness incentives, employee medical privacy and disability-discrimination requirements under US law. It should not be read as a universal prohibition on wellness incentives; the legal analysis depends on the statutory provisions and facts.

Application to Indian employers: If an employer charges employees substantially more for benefits because they refuse to provide identifiable medical information, the arrangement should be reviewed for coercion, fairness, contractual compliance and any applicable discrimination protections.

For example, an employer should assess whether employees who decline biometric screening can access comparable benefits without being disadvantaged in an unreasonable or unlawful manner.

Practical conclusion: Participation incentives should be assessed carefully. Genuine choice, transparency, proportionality and safeguards are preferable to policies that pressure employees to disclose intimate health information.

6. Comparative summary of the cases

7. Common legal risks and recommended controls

Risk 1: Sharing individual health results with HR

Example: The wellness provider sends employees' blood pressure readings, diagnoses or mental health scores to the HR department.

Control: Establish role-based access. Where HR needs a fitness conclusion or workplace adjustment, provide the minimum necessary functional information rather than the complete clinical record.

Risk 2: Using wellness information for performance ratings

Example: A manager gives an employee a lower rating because the employee reports stress, has a disability or rarely participates in fitness activities.

Control: Prohibit secondary use of wellness data for ordinary performance appraisal, promotion and disciplinary decisions unless a separate lawful and justified basis applies.

Risk 3: Excessive wearable-device monitoring

Example: The employer tracks employees' location, sleep, heart rate and activity outside work without demonstrating why such monitoring is needed.

Control: Prefer voluntary, limited collection; disable unnecessary tracking; define clear access and retention rules; and consider whether aggregate or on-device processing can achieve the objective.

Risk 4: Inadequate vendor governance

Example: A wellness application shares identifiable employee information with advertising partners or uses it to train unrelated commercial analytics systems.

Control: Conduct vendor due diligence, restrict secondary uses contractually, establish security and incident-reporting requirements, and review subcontractors and onward disclosures.

Risk 5: Indefinite retention

Example: Health-risk assessments remain in employee files long after the programme ends.

Control: Set category-specific retention schedules and deletion procedures. Retain records longer only where an applicable law, clinical duty, litigation hold or other justified requirement supports it.

8. Suggested corporate wellness data policy

A compliant policy should contain the following elements.

Purpose statement: Identify the precise purposes for collecting wellness information.

Data inventory: Specify each category of personal data, including any biometric, mental health or location information.

Notice and consent: Explain collection, intended use, recipients, retention, available choices and the consequences of refusing participation.

Separation of records: Keep clinical records separate from routine HR systems wherever practicable.

Access controls: Define which personnel may access identifiable information and under what circumstances.

Secondary-use prohibition: Prevent reuse for advertising, employee ranking or unrelated employment decisions without an independently valid legal basis.

Vendor management: Address confidentiality, security, permitted processing, onward sharing and deletion in contracts.

Retention and disposal: Define retention periods and secure deletion procedures, subject to legal recordkeeping requirements.

Employee rights and complaints: Provide a channel for questions, correction requests, grievances and other applicable rights.

Incident management: Establish procedures for investigating unauthorised access, disclosure, loss or misuse.

Equality safeguards: Review whether the programme disadvantages employees with disabilities, chronic illnesses, pregnancy-related needs or other protected characteristics.

Periodic audits: Review the programme at launch, after material changes and periodically thereafter.

9. Implementation checklist

Compliance review

0 of 10

Document the purpose and lawful basis for each data category.

Confirm the applicable privacy law and commencement dates.

Issue a clear employee notice before collecting information.

Make participation genuinely voluntary wherever practicable and appropriate.

Separate medical records from ordinary HR and performance records.

Restrict manager access to necessary work-related conclusions.

Review vendor contracts, security and secondary-use restrictions.

Set retention, deletion and incident-response procedures.

Assess disability, discrimination and employee-relations risks.

Audit the programme and document corrective actions.

Copy checklist

10. Consequences of misuse

Depending on the facts and applicable law, improper handling of wellness information may expose an organisation to:

Constitutional or judicial scrutiny where State action or relevant public-law obligations are involved.

Claims or proceedings under applicable data-protection and information-technology laws.

Contractual disputes involving employees, healthcare providers or wellness vendors.

Employment disputes involving confidentiality, discrimination, retaliation or unfair treatment.

Regulatory investigations and consequences arising from a data breach.

Reputational damage and reduced employee trust, particularly where mental health or medical records are exposed.

An employer should not assume that every inappropriate use automatically creates a standalone privacy cause of action. The available remedy depends on the applicable statutory provision, the legal relationship, the facts and the relevant commencement dates.

11. Conclusion

Wellness programme data usage limits are designed to preserve the balance between legitimate employee wellbeing objectives and personal privacy. An employer can encourage healthier workplaces, identify occupational risks and provide appropriate support without creating an unrestricted database of employee medical and behavioural information.

The most defensible approach is to collect the least information necessary, define the purpose before collection, restrict access, separate clinical and employment records, prevent unjustified secondary use, and establish transparent retention and security controls.

The Indian Supreme Court's decisions in Puttaswamy, District Registrar v. Canara Bank, Selvi and Suchita Srivastava, together with the medical-confidentiality principles in X v. Hospital Z, provide important legal guidance. The US wellness cases add comparative lessons about screening and participation incentives.

Legal qualification: The eight cases are not all direct rulings on employee wellness data. Their relevance varies by jurisdiction and legal issue. For an Indian employer, the precise policy should be checked against the provisions actually in force, the applicable employment and disability laws, contractual obligations, and the phased implementation of the DPDP Act and Rules as at the date of the proposed processing.