From fitness trackers to medical devices: Where India draws the regulatory line

A decade ago, a wearable told you how many steps you had taken. Today, the same form factor in the shape of a watch, a ring, a patch or an earbud provides estimated heart rate variability, flags possible atrial fibrillation, tracks skin temperature and menstrual cycles, monitors blood oxygen saturation, and, increasingly, reads glucose levels without a single finger-prick. The global wearables market is projected to keep growing at a rapid pace through the rest of this decade and India with its large smartphone base, rising lifestyle-disease burden, and appetite for preventive health, is one of its fastest-growing markets.

The commercial pitch for most of these products is careful and they are sold as tools for “general wellness”, not diagnosis or treatment. However, the underlying technology does not always respect that framing. A sensor that can estimate blood oxygen for a fitness enthusiast is, technically, doing the same thing a pulse oximeter does in a clinical setting. The question this raises for Indian regulators is that at what point does a consumer wellness product cross into “medical device” territory, and what follows once it does?

The threshold question: Intended use, not the sensor inside

Under the Medical Devices Rules, 2017 (“MDR”) framework, a product is a “medical device” not because of what it technically measures, but because of what its manufacturer says it is for. The MDR’s definition turns on intended use including diagnosis, monitoring, treatment, alleviation, or prevention of disease or injury. Two products built on near-identical hardware can sit on opposite sides of the regulatory line purely because of how they are labelled, marketed and intended to be used.

This “intended use” test is deliberately technology-neutral, and it has served CDSCO well for traditional medical devices, however, it sits uneasily with a wearable that ships as a fitness accessory and is then, via a firmware update six months later, marketed as capable of detecting a health condition. A device that is recorded as a medical device must meet the MDR’s risk-based classification, obtain the corresponding manufacturing or import license, comply with quality management and post-market surveillance obligations, and answer to CDSCO. A device that stays outside that definition largely escapes this apparatus.

Software powering the hardware

With the rapid integration of artificial intelligence, much of the innovation in consumer wellness now involves software rather than hardware. The algorithm that interprets a raw sensor signal is often where the real the real risk now sits. CDSCO’s Guidance Document on Medical Device Software clarifies how existing MDR classification applies to software and it is explicit that general wellness/ fitness applications without a medical purpose fall outside its scope. This carve-out is precisely where most consumer wearables today try to sit, and precisely where the pressure is building, as features that look diagnostic (such as arrhythmia detection, sleep apnea risk scoring, fall detection etc.) get bundled into products which are marketed as lifestyle products. 

The same tension plays out with smart rings and watches offering ECG-like analysis, and with skin patches that straddle drug delivery and cosmetic use. Each of these product categories forces the same underlying question: does the manufacturer’s own intended-use statement, and the substance of what the product actually outputs to the user, place the product inside or outside the MDR’s net?

The road ahead

For manufacturers and platforms building in this space, three practical implications follow. First, marketing and labelling claims are not a workaround, they are the primary determinant of regulatory status, and an inconsistency between what a product’s app tells a user and what its marketing disclaims can itself invite scrutiny. Second, the software deserves as much attention as the hardware as a simple sensor paired with an ambitious algorithm may land the product deeper into the MDR’s classification tiers than the hardware alone would suggest. Third, data governance under the DPDP Act now needs to be built in parallel with MDR classification, since a product that stays outside the medical device net does not thereby escape data protection obligations. 

For CDSCO, there lies a familiar challenge, a bright line “intended use” test provides clarity but invites workarounds around it, while a more functional test is harder to administer consistently.