Founders ask me which bioinformatics licence they need. The honest answer is that there isn't one. There's a stack of rules, and which ones hit you depends on what you touch - samples, patients or just data.
I'll walk through four ideas from the directory, from the most regulated to the least. First, the important bit. This is not legal advice. Check every point with a lawyer before you launch.
Why there's no single licence
India doesn't license "bioinformatics" as an activity. What it regulates is the stuff around it - labs that test human samples, software that drives medical decisions, and personal data. So the question to ask isn't "what licence do I need?". It's "what does my product actually do to a person?".
Case 1: genetic screening camps
Heritrace runs voluntary genetic testing camps with community associations whose members share a known high-risk gene variant. The first test checks for butyrylcholinesterase deficiency, which can make some anaesthetics dangerous. Members get a wallet card for surgeons. Our estimate is ₹60 L–1.1 Cr over 6–9 months.
This is the one with the most rules, even though you partner with a lab:
- NABL ISO 15189 accreditation, held by your partner lab, before you send the first sample.
- DPDP Act consent before any camp, with separate consent for testing and for any research use.
- Research and ethics rules if you ever publish or reuse group data [Requires validation].
There's a social rule too, and it matters as much as the legal ones. Linking a gene to a named community can be misused, so group results must stay private. Get this wrong and no licence will save you.
Case 2: monitoring between psychiatry visits
Midtide is software for outpatient psychiatrists. Between visits, patients answer short standard questionnaires on a chat app and can share sleep and step data. The psychiatrist gets a one-page trend summary. It costs ₹50–90 L over 6–9 months.
Midtide does monitoring, not diagnosis. That line decides the licence question:
- CDSCO medical device software guidance (2026). Software that drives clinical decisions can count as a device. Show trends, and leave the judgement to the doctor.
- DPDP Act. Mental health answers are about as sensitive as data gets. Consent, storage and access logs need to be right from day one.
- Crisis handling. Not a licence, but a duty. A slow response to a self-harm answer would mean serious harm. Write the escalation path before launch.
Case 3: a satellite collision desk
Closepass isn't biology, but it's a clean example of a data business that rides on someone else's licence. It's an outsourced desk that reads close-approach alerts for Indian satellite startups and plans manoeuvres for the client to approve. It costs ₹55 L–1.1 Cr over 6–9 months.
Closepass needs no space licence, because the client stays the operator of record. IN-SPACe authorisation sits with each satellite operator under the Indian Space Policy 2023. Your job is to fit inside their permissions, and to get liability right in the contract.
The same pattern works for a lot of bioinformatics startups. If your partner lab holds the accreditation and you only analyse data then your own licence load is light. Your contract load isn't.
Case 4: factory heat storage
Emberbank puts electrically heated brick stores next to small factory boilers. It's here as the opposite case, where physical safety comes first. If the unit makes steam under pressure, the state boiler inspectorate is likely involved [Requires validation]. It's also the costliest of the four at ₹3–6 Cr over 18–24 months.
I include it because founders sometimes treat "deep tech" as one thing. It isn't. Hardware that can hurt someone draws the hardest rules, then lab samples, then health data, then plain data.
A simple way to sort your own idea
Ask three questions in this order:
- Do you handle human samples? If yes then you need an accredited lab, yours or a partner's.
- Does your software shape a medical decision? If yes then read the CDSCO software guidance and get a written view on device status.
- Do you hold personal data? You almost certainly do, so DPDP Act consent and storage apply.
Then add the baseline every company needs - company or LLP registration with the MCA, and GST once you cross the threshold.
What I'd do first
Write a one-page "what we do and don't do" note before you build anything. Screening or diagnosis? Monitoring or decision support? Send it to a regulatory lawyer and ask for a written view. It costs a little now and saves you a rebuild later.
For more, see the biotechnology ideas and the ideas without heavy licences.
Not as a single licence. The rules come from what you touch: lab accreditation for samples, CDSCO rules for medical software and the DPDP Act for personal data.
Can I run genetic testing without my own lab?
Yes, through an NABL ISO 15189 accredited partner lab. You still need proper consent and careful data handling.
Does health monitoring software need a CDSCO licence?
It depends on whether it drives clinical decisions. Showing trends to a doctor sits on the lighter side, but get a written view before launch.
Talk to Yash
If you're building in genetics or health data and want to map which rules apply before you spend on a build, I can help you work through it. Talk to Yash →
For illustration only. Ideas are hypothetical and names fictional; sourced facts may be out of date. Nothing here is legal, financial or professional advice, and Yash Khatri is not personally liable for any use of it. Read the full disclaimer.
For illustration only. Names are fictional and ideas hypothetical; sourced facts are real but may be out of date. Nothing here is legal, financial or professional advice, and Yash Khatri is not personally liable for any use of it. Read the full disclaimer.