Outbound voice agents: reminders, follow-ups and the consent line

A hospital in India can likely use an AI voice agent to call patients, provided each call sits inside the purpose the patient agreed to under DPDP 2023, follows TRAI's rules for automated commercial calls, and lets the patient stop the calls from inside the call itself. Treat that as the working reading to take to counsel. An appointment reminder for a visit the patient booked sits well inside that line. A health-package offer read out by the same agent sits outside it, and collections calls sit closest to the edge.

Nextdot's live voice deployments are inbound, and no outbound voice is live at any Nextdot client. This piece is the buyer-side analysis a CIO, the legal desk and the Head of Patient Access should run before anyone points an agent outward.

Three outbound calls, three different risk profiles

Appointment reminders are the easy case. The patient booked the slot, gave a number for that booking, and expects to hear about it. The call carries almost no clinical content.

Post-discharge follow-up is harder. The agent asks how the patient is recovering, whether they are taking the prescribed medicines, whether a symptom has returned. Health data now moves in both directions, and an answer can include something a clinician needs to hear today.

Collections is the hardest. The call concerns an unpaid bill, which is financial data attached to health data, often reaching a family member rather than the patient. It is also the call a patient is most likely to report as unwanted.

Treat these as three deployments with three separate approvals, whatever the vendor pitch.

Purpose limitation is where the consent line sits

Under DPDP 2023, the hospital is the Data Fiduciary, and consent, notice and the patient's rights run to it. The vendor running the agent processes data on the hospital's instructions.

Section 6(1) requires consent to be free, specific, informed, unconditional and unambiguous, and limited to the data necessary for the specified purpose. Section 7(a) allows processing without fresh consent where the patient voluntarily provided the data for a specified purpose and has not objected. Section 5 requires a notice that tells the patient what data is used and for what.

Read together, these suggest a practical test for every outbound call: would a patient who gave this number for this purpose expect this call? A patient who books an appointment and gives a mobile number expects a reminder about that appointment. The same patient did not agree to a call about a cardiac screening package, even though the hospital holds the number and the agent can dial it. The data is identical. The purpose differs, and counsel should confirm the lawful basis for each.

Post-discharge follow-up needs its purpose written into the discharge-stage notice, in plain language, before the first call. Collections needs the same treatment, and the legal desk should decide whether that call belongs on an AI agent at all.

Timing matters. MeitY notified the DPDP Rules 2025 on 13 November 2025, and the substantive obligations on consent, notice, security safeguards and retention come into force on 14 May 2027 (Source: MeitY, DPDP Rules 2025 notification, 13 November 2025). Design an outbound programme to them now. The broader DPDP fixes for AI systems are covered in "DPDP 2023: The Six Things Every Enterprise Must Fix Before Deploying AI".

What TRAI adds on top of DPDP

DPDP governs the data. TRAI governs the call. The Telecom Commercial Communications Customer Preference Regulations 2018, amended by TRAI's Second Amendment notified on 12 February 2025, set the telecom-side rules (Source: TRAI, TCCCPR Second Amendment Regulations, 12 February 2025). Five provisions raise questions for counsel and the access provider.

Classification decides most of what follows. The amended definition of a Service Voice Call covers a call to the sender's own customer about a product or service already in use, with no promotional content, and such calls are not subject to the explicit-consent requirement that applies to promotional calls. Ask counsel whether a reminder for a booked appointment fits that definition, and get the answer in writing. The same regulation treats any commercial voice call with promotional content mixed in as promotional. One line about a health check offer at the end of a reminder can convert the call.

Automated calling must be declared. Amended regulation 4 requires senders to notify their originating access provider in advance, in writing, about the use of auto-dialers or robo-calls and the objective of those calls. Ask the access provider, and counsel, whether a conversational AI agent placing calls at volume falls within that description, and file the intimation on the cautious reading.

Number series follow the category. TRAI's explanatory memorandum to the 2025 amendment says promotional robo-calls should use 140-series numbers, and service and transactional robo-calls the 1600 series or another series allotted for the purpose. DoT allotted the 1600 series to government and BFSI entities (Source: DoT letter, 23 December 2024), and TRAI's Direction of 19 November 2025 mandates it for RBI, SEBI and PFRDA regulated entities. A hospital sits in neither group, so ask the access provider which series is open to it for service calls.

Patients can block the category. Subscribers can block commercial communication by category through 1909, and health is one of the listed categories. Promotional calls to a patient on that block list need explicit digital consent. Service calls to existing patients are treated differently, one more reason to keep reminders clean of promotion.

Complaints move fast. The amendment gives a recipient seven days to complain about an unsolicited commercial communication, and penalties escalate with repeat violations. Ask counsel which calling-hour band applies, and hard-code it in the dialler.

Disclosure is harder on an outbound call

"AI Disclosure in Patient Calls: What Hospitals Will Have to Decide" covers disclosure in full. Outbound calling sharpens it: a voice the patient did not summon starts speaking about their health, often to an elderly or unwell person.

Nextdot's position does not change with direction. Disclosure is the deployer's decision, because the hospital is the Data Fiduciary and owns the patient relationship. Nextdot ships disclosure as a configurable capability on every voice deployment and recommends enabling it. For outbound, the case for enabling it is stronger. The EU AI Act's Article 50 transparency duty, in force since 2 August 2026, tests the obvious-interaction exemption against a reasonably observant person from the actual audience, with a lower threshold where elderly people are present (Source: European Commission, Article 50 guidelines, July 2026). Ask counsel whether it reaches an Indian-only deployment. Either way, it is the reference standard a patient complaint is likely to be measured against.

Put the disclosure and the hospital's name in the first sentence. An unidentified voice gets hung up on, and the next call gets treated as spam.

Opt-out has to work inside the call

Section 6(4) of DPDP gives the patient the right to withdraw consent at any time, with withdrawal as easy as giving consent. For voice, the design requirement follows: if the agent can call a patient, the patient must be able to stop the calls by saying so on the call.

It fails in three common places.

The agent does not recognise the request. "Please don't call again", "band karo yeh calls" and "talk to my son instead" are all withdrawal or redirection signals. The intent set has to include them, tested, in every language the agent speaks.

The opt-out does not travel. A patient who stops voice reminders and keeps receiving WhatsApp and SMS reminders has, in practice, not been heard. The suppression list has to sit above channels, owned by the hospital, and the agent has to read it before every dial.

The record does not exist. Every withdrawal needs a log entry with time, call identifier and the words used. TRAI's 2025 amendment also sets a 90-day wait before a sender may seek consent again from a customer who has revoked it. A hospital cannot honour that without a dated record of the revocation.

Where the agent should stop and hand over

The post-discharge call meets unplanned situations most often. A patient reports chest pain, breathlessness or confusion. A relative says the patient died last week. The person who answers is a neighbour.

Clinical red flags go to a human on a warm transfer with context, following the escalation design in "The Handoff Is the Product". The agent verifies identity before it speaks any health detail, and when the wrong person answers, it leaves a callback request with the hospital's name and nothing else. Voicemail gets the same treatment: no diagnosis, no medicine names, no bill amounts.

What to settle before an outbound pilot

A hospital planning outbound voice should have written answers to these before the first call:

1. Which of the three call types is in scope, with a separate purpose statement and notice for each.
2. Counsel's view on the TRAI classification of each call type, the number series, and the regulation 4 intimation to the access provider.
3. The disclosure setting, decided by the hospital, with the vendor's written recommendation on file.
4. The opt-out intents per language, the cross-channel suppression list, and the revocation log.
5. The escalation tree for clinical red flags, wrong-person answers and bereavement.
6. Calling hours, retry limits and the maximum number of attempts per patient per week.

A vendor who cannot answer each of these in writing is proposing a dialler with a voice attached. Put the list in the RFP, and score the written answers before anyone discusses price.

Frequently asked questions