Data and consent for Hi Doctor integrations

An integration with Hi Doctor can receive health data, which is special-category data under the GDPR. This page shows how that data flows to your product, what the OAuth scopes and disconnection controls do, and what you must establish before using real patient data. It is not legal advice. Last reviewed: 2026-11-04

​

How does patient data reach an integration?

1. The patient signs in on hi-doctor.ai and approves the connection. Their password is never entered in your product when they connect through MCP.
2. Hi Doctor issues a token limited by the approved scopes and by what that account can do.
3. Your integration, or the assistant the patient uses, calls a tool or an endpoint with that token.
4. Hi Doctor checks the request again and returns only what that account may see.

Whatever a response contains is then visible to your integration and to the provider that runs the patient’s assistant. That includes a medical document or a link to one.

​

Who can see what?

Hi Doctor’s own processing of patient data is described in its privacy policy. For the Partner API, the controller and processor roles are set out in the partner agreement and the data processing agreement (DPA).

​

How broad are the OAuth scopes?

The MCP connector’s scopes, including separate write scopes, are listed on Permissions. They work at the level of a whole area, such as consultations or messages. There is no field-level consent. A patient cannot untick a single permission on the approval page, so request only the scopes your product needs.

​

How should you handle prescription and invoice links?

Prescription and invoice tools return a link instead of the document itself. Some links work without signing in. Give a link only to the patient, never repeat it in a shared place, and do not store it. See Security.

​

What happens when a patient disconnects?

The patient removes the connector in their app’s settings, which stops that app from signing in again. The MCP server also publishes a standard OAuth token revocation endpoint (revocation_endpoint in its authorization server metadata). When a client revokes a token there, the whole connection ends and every token issued for it stops working. If a client does not revoke, an access token already issued keeps working until it expires, at most one hour after it was issued. Stopping future access is different from deleting copies. Data your integration has already received stays where you stored it until you delete it, so you need your own retention and deletion process.

​

What must you establish before using real patient data?

OAuth permission is account authorisation. It does not by itself satisfy every requirement for processing health data. Establish with your own advisers:

• your purpose, and the legal basis for it under Article 6 of the GDPR
• the condition under Article 9 that allows you to process health data
• who is controller and who is processor, and the agreements that follow
• the privacy notice your users see before they connect
• how you limit scopes, stored fields, retention and logs to what you need
• whether a data protection impact assessment is required
• which other providers receive the data, and where they process it

A connection does not give you permission to reuse a patient’s records for advertising or for any purpose the patient was not told about.

​

Checklist before launch

• Request the fewest scopes that make your product work.
• Check on every use that the signed-in person is the account holder.
• Ask the patient for a clear yes before anything with consequences, such as sending a message, submitting a questionnaire or starting a payment.
• Keep tokens and confidential links out of logs and shared places.
• Revoke the token when a user disconnects inside your product.
• Tell users how to disconnect, and what happens to data you already hold.

​

Frequently asked questions

​

Is OAuth consent enough to process health data?

No. OAuth permission authorises access to an account. You still need your own legal basis, an Article 9 condition, a privacy notice and the right agreements.

​

Can a patient approve only some permissions?

No. Scopes cover a whole area such as consultations or messages, and the patient approves them together. Request only the scopes your product needs.

​

What happens when a patient disconnects?

The app can no longer sign in. If the client revokes a token, every token for that connection stops working; otherwise an access token expires at most one hour after it was issued.

​

Do we have to delete data after a patient disconnects?

Disconnecting stops new access but does not delete what you already stored. Your own retention and deletion process must handle it.

​

Can we store prescription or invoice links?

No. Some links work without signing in, so give them only to the patient and do not store or repeat them.

​

Who is the controller of patient data?

Hi Doctor’s own processing is described in its privacy policy. For your integration, establish controller and processor roles with your advisers; for the Partner API, they are set out in the partner agreement and DPA.

​

Next steps