The commonest mistake a clinic makes on its first corporate enquiry is quoting a per-employee price on the phone. HR asks "what do you charge for a basic check-up?", the doctor says a number, and everything after that is a loss: the number was set for a walk-in who arrives alone, not for 180 employees arriving in batches at a factory 40 kilometres away, with reports due in a week and one invoice at the end.
A corporate health checkup contract suits a small clinic or diagnostic centre, but it is a different operation from OPD, and the money is made or lost in the parts nobody discusses on the first call.
Inside a package
Packages run in two or three tiers, defined by what gets added. The base is height, weight, BMI, blood pressure, complete blood count, fasting blood sugar, lipid profile, liver and kidney function, urine routine, and a physician's consultation ending in a fitness opinion. The middle tier adds ECG, chest X-ray, thyroid profile and HbA1c; the top tier, usually for management grades, adds abdominal ultrasound, treadmill test, vision and audiometry.
Pricing per employee, without guessing
Price from your own arithmetic. Start with the direct cost of the tests from your lab's last three months: reagents, consumables, film and anything you outsource. Add staff hours at the throughput you can achieve, remembering that a camp is a line moving at the speed of its slowest station, usually phlebotomy or the physician. Add travel, setup and idle time on site. Then add the back-office cost of registration, report collation and delivery, and chasing the invoice, the line everyone underestimates before their first camp.
Put margin on that, then publish a slab structure (up to 50, 51 to 200, above 200) so the volume discount is a rule, not a negotiation you lose in the room. Quote per employee per tier, and put the exclusions in writing: repeat tests for abnormal results, specialist consultations arising from a finding, and anyone turning up outside the agreed dates.
The legal layer, stated precisely
Sales material overstates this. There is no general statutory requirement in India for every employer to give every employee an annual health check-up. What exists is narrower.
Under Section 41C of the Factories Act 1948, an occupier of a factory involving a hazardous process must keep accurate and up-to-date health or medical records of workers exposed to chemical, toxic or other harmful substances, and must provide medical examination of every worker before assignment to a job handling a hazardous substance, then while in that job and after leaving it, at intervals not exceeding twelve months. That is a real pre-employment plus annual obligation, and it attaches to hazardous processes, not offices.
Under Section 87, where a State Government declares a process dangerous, it may make rules for periodical medical examination of persons employed or seeking employment in it and require the occupier to pay the fees. So the schedule your factory client is subject to comes from that state's rules; ask their safety officer which apply.
Separately, Schedule 4 of the Food Safety and Standards (Licensing and Registration of Food Businesses) Regulations, 2011 requires that food handlers and employees of a food business be "medically examined once in a year to ensure that they are free from any infectious, contagious and other communicable diseases", with a record signed by a registered medical practitioner kept for inspection. Meat handlers get one before employment and at least every twelve months. That clause is the best lead list a small clinic has: every canteen, hotel, bakery and food factory nearby carries a recurring, inspectable obligation.
I could not verify any such requirement under state shops and establishments legislation, so do not sell an office client a package on that basis. On your own registration obligations, see our Clinical Establishments Act guide.
Consent, and what the employer may receive
The employer is paying. The employer is not therefore entitled to the findings. The Digital Personal Data Protection Act 2023 creates no special category for health data. The word "sensitive" does not appear in it; a haemoglobin value is personal data under section 2(t) like any other. Section 7(i) lets a data fiduciary process personal data "for the purposes of employment or those related to safeguarding the employer from loss or liability", which is the clause an employer will point at. It does not hand them everyone's lipid profile. The defensible operating rule:
The employee gets the full report, addressed to them, whatever the employer asked for.
The employer gets a fitness status (fit, fit with conditions, needs review) for each named employee where a statutory examination requires it, plus aggregate findings with no names.
Anything more needs the employee's own consent, recorded per employee, not buried in the HR onboarding form.
Put that in the contract before the camp, and the consent wording on the registration slip each employee signs, in a language they read. Two obligations land on you, not the employer: section 8(5) requires reasonable security safeguards against a data breach, and section 8(6) requires intimation of a breach to the Data Protection Board and each affected person. The rules were notified on 13 November 2025 and the main obligations bite from 13 May 2027, time enough to stop sending reports through a shared WhatsApp group.
Running the camp
Get the employee list in advance as a spreadsheet, with employee ID, name, age, sex, department and mobile number, and pre-register everyone the day before. Registering 180 people at a folding table on the morning is where camps fail. Assign slots by department, not whole shift. Take fasting samples before 10 am, and tell the client in writing that anyone who ate breakfast needs a repeat visit at their cost. Set stations in sequence, give each employee a serialised slip, and screen off the consultation area. Send one senior person whose only job is the HR contact and the consent slips.
The back office is the real work
Fifty employees in a camp generate one contract, one invoice, fifty reports that must reach fifty individuals, and one summary for HR, all due on an agreed date. Three things to fix before your second camp. Bulk registration: import the employee list beforehand with the company tagged on every record, so you never type a name twice and can pull "all employees of X Ltd, March 2026" as one list. Bulk report delivery: reports go to each employee's own phone or email, not to HR for onward distribution, which is the DPDP-safe route and the one that stops HR becoming your helpdesk. One invoice, not fifty: a corporate account that accumulates line items across the camp into a single invoice with employee counts by tier. Our piece on where clinic billing leaks revenue applies with more force here: one unbilled tier on a 200-employee camp is a large number.
On tax, read the text yourself. Sl. No. 74 of Notification 12/2017-Central Tax (Rate) puts health care services by a clinical establishment at Nil, and the notification's definition of a clinical establishment includes a place carrying out "diagnostic or investigative services of diseases". Whether your package fits is a question for your accountant, in writing, before the first invoice.
Where ExaHealth helps, and where it does not
Some of this load maps onto features ExaHealth publishes and some does not. Its list covers lab report delivery on WhatsApp with no app for the patient to install, one-tap invoicing with tracking of who has paid, role-based staff access so a nurse records vitals without prescribing, separate schedules and staff per location, an audit trail of who opened which record, and data hosted in India. Those cover report delivery, the confidentiality rule above and the audit question a corporate client's compliance team will ask. Bulk registration from a spreadsheet, bulk report despatch and single-company invoicing are not on that list, so ask before assuming a camp of 200 will fit.
Start with one employer you already treat patients from. Get the contract, consent slip and invoice format right on a group of thirty, then sell the second camp on having done it. To check what ExaHealth covers of that back office, ask the team directly.
Sources
Factories Act 1948, Section 41C: every occupier of a factory involving a hazardous process…
Food Safety and Standards (Licensing and Registration of Food Businesses) Regulations,…
DPDP Act 2023 creates no special category for health or sensitive personal data. The word…
GST: health care services by a clinical establishment are Nil-rated under Sl. No. 74,…