The exponential growth of IoT-enabled smart city applications, especially in healthcare, necessitates secure and efficient authentication schemes that operate within embedded device constraints. This paper proposes a lightweight and privacy preserving mutual authentication scheme in order to allow the secure communication between devices and gateway nodes in IoT-based smart city environments while lowering computational costs. The proposed approach leverages the use of simple cryptographic operations (XOR, concatenation, and hashing) to mutually authenticate and generate session keys, as well as protect identities, with negligible performance cost. Thereby three major contributions of this work are offline device registration preventing illegal access, which leads to challenge-response authentication resistant to replay, impersonation and man-in-the-middle attacks, and finally formal security verification through AVISPA to demonstrate protection against identified threats. When compared with existing protocols, our scheme leads to improvements in computational, communication overhead and security strength. Results verified the framework's provision for IoT systems with limited resources, precisely in health sector where data form and secrecy are critical factors. Scalability improvements and fog/edge computing integration will be the subject of future work as we aim toward wider implementation in smart cities. This research contributes on the lightweight authentication methods and practical approach to secure IoT infrastructure in the context of changing urban environments. Here we propose a new scheme for privacy based mutual authentication for IoT based healthcare solution. Our proposed model is explicitly designed for the constrained computing power of IoT devices employ a lightweight cryptography actions like XOR, consultation and hashing In this way, the scheme enables secure session creation between authentic devices and the gateway nodes, thereby minimizing the vulnerability of illegal access to sensitive health care infrastructure, due to this design. Through rigorous security and performance assessments, we show that our scheme is both superior and more efficient than several existing authentications protocols in the literature.