Sharing medical documents safely: photos, PDFs and messaging apps

Why the way you share matters

Medical documents contain some of the most personal information about a person: diagnoses, medicines, test results, and often addresses and identity numbers. Once a copy is sent, it can be forwarded, backed up or left on a device indefinitely. At the same time, a document that is blurred or cropped is of little use to the doctor who receives it.

India’s Digital Personal Data Protection Act, 2023 sets out duties for organisations that process people’s digital personal data. Whatever the legal position, the practical goal is the same for patients and clinics alike: send a clear copy, to the right person, through a channel that limits who else can see it.

Taking a photo a doctor can actually read

• Place the page flat on a plain, dark surface in good, even light. Avoid flash, which causes glare on glossy paper.
• Hold the phone directly above the page so the text is not slanted, and fill the frame with the whole page.
• Keep the patient name, the date and the laboratory or hospital name in the picture; a result without them cannot be trusted or compared.
• Take one photo per page, in page order, and check each photo by zooming in before sending it.
• For multi-page reports, a phone document-scanner feature that produces a single PDF is usually better than many separate photos.

PDFs, photos and file names

When a laboratory or hospital provides a PDF, send the PDF rather than a photo of a printout: it is sharper and keeps every page together. Name files so they make sense out of context, for example 2026-05-02 discharge summary City Hospital, rather than IMG_4432. A consistent naming habit also makes your own records far easier to search later.

Choosing a channel

Where your clinic or hospital offers a patient portal, an official email address or a document upload link, prefer it. These channels are designed for records, can be tied to your file and are controlled by the organisation responsible for your care.

Messaging apps are convenient and widely used, but they bring their own risks: a mistyped number, a message sent to a family group, automatic backups, and photos saved into the recipient’s personal gallery. If you use one, confirm the recipient’s number with the clinic first, send to an individual chat rather than a group, and avoid sending more than was asked for.

Send only what is needed

A cardiologist asking for your last lipid profile does not need your full insurance file. Reports sometimes include information about other people — a family member tested at the same time, for example — which should be removed or not sent. Sending less reduces the damage if a message goes astray.

Password-protected files

If you protect a PDF with a password, share the password through a different channel from the file — for example, send the file by email and tell the password by phone. A password sent in the same message as the file protects nothing.

Keep your own archive

Clinics and hospitals keep records, but they change software, close, or dispose of old files after a retention period, so a personal archive is worth keeping. For most families a folder per year on a computer or a trusted cloud drive, with files named by date, type and facility, is enough.

Protect that archive as you would financial documents: lock the device, use a strong password on the account that stores it, turn on two-step verification where the provider offers it, and keep one backup in a separate place. When one family member manages records for another, agree who holds the archive and how it will be handed over if that ever needs to change.

Before you press send

• Is the recipient confirmed with the clinic, and is this an individual chat rather than a group?
• Is every page readable when you zoom in?
• Does it contain only what was asked for?
• Have other people’s details been removed?
• If the file has a password, is the password going by a different channel?

Shared and public devices

Avoid downloading or photographing medical documents on shared or public computers and phones. If you must, sign out of every account afterwards and delete downloaded files. On your own phone, consider moving medical photos out of a gallery that syncs automatically to shared family albums.

If a document goes to the wrong person

Act quickly. Ask the recipient to delete it and not to forward it, delete it from your own sent messages where the app allows, and tell the clinic if the mistake involved one of their channels. Clinics should have a process for handling misdirected information and should record what happened.

For clinics: make the safe way the easy way

• Give patients one official channel for documents and tell them what it is, rather than asking them to send files to a staff member’s personal number.
• Explain what you need and why, and what will happen to the documents after they are used.
• Use individual staff accounts rather than shared logins, so access can be traced and removed.
• Store received documents with the patient’s record and remove copies from phones and inboxes once filed.

How Vaidence handles documents

The public demo at vaidence.com/demo contains only fictional records and transmits nothing you type. In a clinic deployment, documents are uploaded into an environment configured for that clinic, access is limited to the people named in the clinic’s agreement, and patient data is never used to train public AI models. Please do not send patient records to Vaidence by email.

This guide is general information about good practice and is not legal or medical advice.