Rohan got the letter in November. His health insurance premium was going up — again — this time by 23%. He called his insurer. They said it was based on “risk assessment.” He pushed harder. Eventually someone told him, in the polished language of the insurance industry, that his profile had been “updated.” He’d switched to a new blood pressure medication eight months ago. He’d filled the prescription at a pharmacy chain. He’d told his insurer nothing.
Somewhere between the pharmacy counter and his insurance company’s actuarial model, his prescription history had been sold.
This isn’t a hypothetical. This is how the health data broker industry works, and it operates at a scale that makes the general data broker economy look modest.
Who sells your medical data? A handful of giants sit at the center. IQVIA holds prescription and clinical data on roughly 900 million patients. Optum aggregates medical claims on more than 270 million Americans. In India, Practo, 1mg, and PharmEasy hold prescription and consultation records for tens of millions. They sell or license this data to pharmaceutical companies, insurers, marketers, and analytics firms. Your rights depend on where you live: GDPR erasure in the EU and UK, and DPDPA deletion rights in India (now phasing in). This complements the general data broker economy.
The companies at the center of it
IQVIA is the largest health data company in the world. Most people have never heard of it. IQVIA was formed through the 2016 merger of IMS Health and Quintiles. It operates in more than 100 countries and holds data on approximately 900 million patients — a figure from their own marketing materials. They sell prescription data, clinical trial data, patient-level longitudinal records, and physician-targeting intelligence to pharmaceutical companies. Their revenue runs above $14 billion annually. They are not a research institute. They are a data company.
Optum — a subsidiary of UnitedHealth Group — aggregates medical claims data on more than 270 million Americans. That’s the majority of the US population. Optum combines insurance claims, pharmacy benefit management, and electronic health record data into one of the most comprehensive health databases ever assembled. UnitedHealth is both an insurer and a data company. The tension between those two roles is obvious. The conflict of interest is rarely discussed.
Veeva Systems handles pharmaceutical CRM — connecting drug company sales representatives to physician data, prescribing patterns, and contact databases. A pharmaceutical sales rep may walk into a doctor’s office knowing exactly which drugs that doctor has been prescribing, and to how many patients. That’s Veeva’s data at work.
In India, the picture is different in scale but not in kind. Practo, which operates in 20+ countries, holds appointment records, consultation notes, prescription histories, and lab results for tens of millions of users. 1mg processes prescription uploads, medical records, and lab test data across a user base in the hundreds of millions. PharmEasy — despite its financial difficulties — aggregated prescription data on a scale that made it one of India’s largest digital health platforms.
None of these companies are secret. All of them make money, directly or indirectly, from health data flows. The mechanism that connects your prescription to an insurance company’s pricing model runs through them.
How your health data gets collected
Start with the pharmacy. Every prescription filled in a pharmacy generates a record, whether paper or digital. It captures the drug, the dose, the prescribing doctor, the date, and the patient’s insurance details. Pharmacy benefit managers (PBMs) process these claims on behalf of insurers. In doing so, they collect a complete longitudinal record of every medication you’ve ever filled. Express Scripts, CVS Caremark, and OptumRx are the three largest PBMs in the US. Between them, they process the majority of American prescription claims. That data doesn’t stay siloed.
Insurance claims are even richer. Every time you see a doctor, the visit is coded — a diagnosis code from the International Classification of Diseases (ICD), a procedure code, a facility code, a date. Insurers collect this across years and decades. Health data brokers buy, aggregate, and resell these claim-level records. The patient’s name is often stripped out, but enough attributes remain (age, geography, condition codes, drug history) that re-identification is trivial.
Electronic health record (EHR) systems are the repository for everything your doctor knows about you. Systems like Epic, Oracle Health (formerly Cerner), and Meditech hold your diagnoses, medications, test results, clinical notes, and imaging records. Hospitals enter into data-sharing agreements with analytics vendors and research organizations. Some of these arrangements are legitimate. Some are aggressive. Most patients have no idea they’ve happened.
Health apps and wearables add another layer. Fitbit data has been the subject of Google’s acquisition and subsequent privacy controversy. Apple Health aggregates step counts, heart rate, sleep patterns, and — if you’ve connected other apps — menstrual cycle data, medication logs, and mental health check-ins. Period tracking apps like Flo and Clue collect data about reproductive health that is, in certain political climates, deeply sensitive. These apps are not covered by HIPAA in most cases, because HIPAA applies to healthcare providers and insurers — not consumer apps. They can share data with advertisers, analytics platforms, and third-party partners under terms most users have never read.
Patient support programs run by pharmaceutical companies are a particularly opaque collection point. Drug manufacturers run these programs — co-pay cards, adherence apps, nurse hotlines — ostensibly to help patients afford or manage their medications. They also generate detailed data on which patients are taking which drugs, how consistently, and with what side effects. This data often flows back to the company’s commercial operations.
In India, the Ayushman Bharat Digital Mission (ABDM) is building the infrastructure for a national health ID system. The ABHA (Ayushman Bharat Health Account) ID is designed to link your health records across hospitals, clinics, labs, and pharmacies into a unified longitudinal record. The stated goal is care coordination and accessibility. The data governance implications are still being worked out — and the opt-out mechanisms, while they exist, are buried in the ABHA app and confusingly documented.
What gets sold, and to whom
Pharmaceutical companies are the largest buyers of health data, by revenue. They buy physician-level prescribing data to identify which doctors write the most prescriptions in a given therapeutic category. They then target those doctors with sales rep visits, speaker programs, and conference invitations. This practice — called “detailing” — has been legal and routine for decades. IQVIA’s core business model is built on supplying this data.
They also buy patient-level data, with varying degrees of de-identification. It shows which patient populations are being treated, with what drugs, and what outcomes are documented in claims data. This informs clinical trial recruitment, drug positioning, and market sizing.
Insurance companies use health data for underwriting — the process of deciding how much risk a given policyholder represents and what premium to charge. When a data broker sells prescription history to an insurer, the insurer can use that information to infer conditions the policyholder never disclosed. The ACA in the US prohibits insurers from using pre-existing conditions in pricing — but enforcement gaps exist, and outside the ACA market, the restrictions are different. In India, IRDAI regulations govern health underwriting, but data sourcing practices are not yet specifically restricted.
Employers in some US states have purchased wellness data on employees. The stated goal is better benefits programs. But it also blurs the line between wellness and surveillance. In India, this practice is murky. There is no law that clearly prohibits an employer from purchasing health data about employees from a data broker, and no enforcement authority that has tested this question.
Marketing companies build audience segments based on health conditions. Say you’ve searched for diabetes management resources, filled a statin prescription, or joined an online health forum. You may then appear in a “likely diabetic” or “cardiovascular risk” audience segment that advertisers can buy. These segments are sold through programmatic advertising platforms. You may see ads for insulin brands, cardiac rehabilitation programs, or weight loss drugs. These are often served because your condition was inferred from data you generated somewhere else.
Debt collectors have used health data to target people based on vulnerability. Patients who have accumulated medical debt become targets for collection agencies. Their financial stress can be inferred from credit data combined with health-condition data. The agency then knows not just that they owe money, but that they may be dealing with a serious illness. This is real, documented, and very difficult to stop.
The India-specific gap
India’s Digital Personal Data Protection Act 2023 applies a unified personal data framework. Health data is personal data under the DPDPA. Heightened obligations apply to Significant Data Fiduciaries designated by the central government, rather than being tiered by data category. The act requires explicit, informed, purpose-specific consent before processing personal data. The DPDPA is, in principle, a meaningful protection.
In practice, enforcement is still ramping up. India notified the DPDP Rules and stood up the Data Protection Board in late 2025. The body adjudicates complaints and can impose penalties, but 2026 is a phased “soft enforcement” window, with the heaviest penalties for core obligations arriving by mid-2027. In the meantime, health apps operating in India can collect your prescription history, share it with analytics partners, and use it for purposes you didn’t specifically agree to. There is limited practical enforcement to stop them yet.
The privacy policies of major Indian health platforms are instructive. They tend to be long and written in legalese. They contain broad consent clauses that permit data sharing with “affiliates,” “service providers,” and “business partners” — categories capacious enough to include data brokers. Users who click through onboarding flows without reading these policies have, technically, consented to data sharing they would find alarming if described plainly.
ABDM opt-out is possible but not simple. You can disable data sharing through the ABHA app — the setting is under “Privacy Settings” — but the UI assumes familiarity with how the system works. Millions of people who have been auto-enrolled in ABHA through Ayushman Bharat hospital visits may not know they can opt out.
The gap between legislative intent and on-the-ground practice is wide. It will narrow when enforcement begins. Until then, the burden is on individuals.
Why anonymization doesn’t protect you
Health data brokers routinely argue that their data is de-identified — that names and direct identifiers have been stripped. This is technically true and practically meaningless.
A 1997 study by Latanya Sweeney demonstrated that 87% of Americans could be uniquely identified using just three data points: ZIP code, birth date, and sex. Health data is far richer than that. A dataset with your age, gender, diagnosis codes, prescriptions, geography, and healthcare dates is trivially re-identifiable. It can be matched against insurance enrollment records, voter rolls, or any other dataset holding a few of those fields.
IQVIA’s “anonymized” prescription data has been the subject of academic re-identification research repeatedly. Researchers have re-identified specific physicians from supposedly anonymized prescribing records. The patterns are distinctive enough. A dataset containing a person’s rare condition diagnosis, specific drug regimen, and ZIP code can often be matched to a single individual even without a name.
De-identification is a legal defense, not a privacy guarantee.
What you can actually do
Start with ABDM. You may have received an ABHA health ID, either by registering yourself or through an Ayushman Bharat-linked hospital. If so, open the ABHA app and navigate to Privacy Settings. You can restrict which healthcare providers and apps can access your linked records. This takes five minutes and meaningfully limits what flows out of the national health stack.
Review app permissions on Practo, 1mg, and PharmEasy. Each has a privacy policy that describes data sharing with third parties. Go into your device settings and revoke access to anything unnecessary — contacts, camera, location. More importantly, consider whether you need these apps to retain your full health history. You may be able to use them for specific transactions and then delete the data.
India’s DPDPA gives you erasure rights under Section 12. Once the Data Protection Board is operational, you’ll be able to demand that apps holding your health data delete it. Even now, you can write to the grievance officers these apps are required to designate and request deletion. Some will comply voluntarily, because the legal framework exists even if enforcement doesn’t yet.
For health app choices going forward: prefer apps that explicitly state they do not sell user data and that specify exactly which third parties receive your information. Vague “we may share with partners” language is a red flag. An app willing to be specific about its data practices is one that expects to be held accountable.
If you’re in the EU or UK, your position is stronger. Data brokers holding health data under GDPR must have explicit consent for each specific processing purpose. You can request deletion under Article 17, and supervisory authorities like the ICO (UK) and national DPAs across Europe have actually fined companies for GDPR violations involving health data. File complaints. They get processed.
Period tracking apps, mental health apps, and condition-specific apps deserve particular scrutiny — these hold data that is sensitive beyond ordinary health information. If you use them, look at whether they share with advertising networks. Many do.
The deeper problem is not something you can solve individually. IQVIA holds data on 900 million patients. Optum knows more about American healthcare than any hospital system. Your prescription history can travel from a pharmacy to an insurer without your knowledge. Fixing that requires enforcing laws that already exist, and passing laws that don’t yet. Both are slow processes.
In the meantime, you can reduce the surface area. It’s not perfect. It’s not nothing.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.