> ## Documentation Index > Fetch the complete documentation index at: https://docs.hi-doctor.ai/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > Connect the Hi Doctor MCP connector at https://mcp.hi-doctor.ai/mcp. Add this URL as a remote HTTP MCP server in your client, then sign in and authorise access through OAuth. Setup: https://docs.hi-doctor.ai/mcp/connect. > > The REST API base is https://api.hi-doctor.ai. Hi Doctor Docs at https://docs.hi-doctor.ai/mcp searches documentation; connect to the product endpoint above for patient tools. > > Hi Doctor operates across the whole European Union: residents of all 27 EU member states can use the service, and every consultation is reviewed by an EU-licensed doctor. Every consultation is reviewed in full by an EU-licensed doctor, who decides on medical grounds only. No algorithm, assistant or API call approves a consultation, issues a prescription or changes a dose. The service is available in eight languages: English, Spanish, German, Dutch, Italian, French, Portuguese and Chinese. > > ## Rules an assistant must follow > > - Never invent, assume or infer a medical answer. "I don't know" is a real answer: ask the patient to pick the closest option rather than guessing for them. > - Never give medical advice and never suggest a medication or a dose. An EU-licensed doctor decides those. > - If a questionnaire returns `ineligible`, say so plainly. Do not retry with altered answers. > - Before anything that costs money or cancels a plan, state exactly what will happen and get an explicit yes. > - Cancellation takes effect at the **end of the paid period**, not immediately. Say so. > - An early order is irreversible: it creates the renewal consultation immediately and uses up the period's one early order. Explain that and get an explicit yes. > - Prescription and invoice links are medical documents. A `signed_redirect` link opens without signing in: give it only to the patient, never repeat it anywhere shared. > - Send option `value`s, not the labels shown to the patient. Labels are translated, values are stable. > - Never ask for card details. Payment happens on Stripe's hosted checkout via a link. > - On severe or sudden symptoms (chest pain, difficulty breathing, severe allergic reaction, suicidal thoughts), stop and direct the patient to their local emergency number. # Data and consent for Hi Doctor integrations > How patient data flows from Hi Doctor to an integration, what OAuth scopes cover, what disconnecting does, and what an integrator must establish. An integration with Hi Doctor can receive health data, which is special-category data under the GDPR. This page shows how that data flows to your product, what the OAuth scopes and disconnection controls do, and what you must establish before using real patient data. It is not legal advice. Last reviewed: 2026-11-04 ## How does patient data reach an integration? ![Data flow: the patient signs in and approves on hi-doctor.ai, Hi Doctor issues a scoped token, the integration or the patient's assistant uses it, and Hi Doctor returns only the permitted response.](https://mintcdn.com/hi-doctor-ai/-_prxXpQ62cK9VG9/images/diagrams/data-flow-en.svg?fit=max\&auto=format\&n=-_prxXpQ62cK9VG9\&q=85\&s=ef91844fb074b13c28a60c2bd9f27724) How patient data reaches an integration. 1. The patient signs in on hi-doctor.ai and approves the connection. Their password is never entered in your product when they connect through MCP. 2. Hi Doctor issues a token limited by the approved scopes and by what that account can do. 3. Your integration, or the assistant the patient uses, calls a tool or an endpoint with that token. 4. Hi Doctor checks the request again and returns only what that account may see. Whatever a response contains is then visible to your integration and to the provider that runs the patient's assistant. That includes a medical document or a link to one. ## Who can see what? | Surface | Can receive | Does not receive | | - | - | - | | A reader of these docs | Public documentation and synthetic examples | Patient records or credentials | | A patient's connected MCP app | Responses from the tools allowed by that patient's approved scopes. These can include health answers, consultations, prescriptions, messages, billing and progress. | Other patients' records or company-wide health data | | A REST application | Records that belong to the patient whose token it holds | Records of another account; anything through `X-Brand-Slug` alone | Hi Doctor's own processing of patient data is described in its [privacy policy](https://hi-doctor.ai/legal/privacy). For the [Partner API](https://docs.hi-doctor.ai/partners/overview.md), the controller and processor roles are set out in the partner agreement and the data processing agreement (DPA). ## How broad are the OAuth scopes? The MCP connector's scopes, including separate write scopes, are listed on [Permissions](https://docs.hi-doctor.ai/mcp/permissions.md). They work at the level of a whole area, such as consultations or messages. There is no field-level consent. A patient cannot untick a single permission on the approval page, so request only the scopes your product needs. ## How should you handle prescription and invoice links? Prescription and invoice tools return a link instead of the document itself. Some links work without signing in. Give a link only to the patient, never repeat it in a shared place, and do not store it. See [Security](https://docs.hi-doctor.ai/mcp/security.md). ## What happens when a patient disconnects? The patient removes the connector in their app's settings, which stops that app from signing in again. The MCP server also publishes a standard OAuth token revocation endpoint (`revocation_endpoint` in its authorization server metadata). When a client revokes a token there, the whole connection ends and every token issued for it stops working. If a client does not revoke, an access token already issued keeps working until it expires, at most one hour after it was issued. Stopping future access is different from deleting copies. Data your integration has already received stays where you stored it until you delete it, so you need your own retention and deletion process. ## What must you establish before using real patient data? OAuth permission is account authorisation. It does not by itself satisfy every requirement for processing health data. Establish with your own advisers: * your purpose, and the legal basis for it under Article 6 of the GDPR * the condition under Article 9 that allows you to process health data * who is controller and who is processor, and the agreements that follow * the privacy notice your users see before they connect * how you limit scopes, stored fields, retention and logs to what you need * whether a data protection impact assessment is required * which other providers receive the data, and where they process it A connection does not give you permission to reuse a patient's records for advertising or for any purpose the patient was not told about. ## Checklist before launch * Request the fewest scopes that make your product work. * Check on every use that the signed-in person is the account holder. * Ask the patient for a clear yes before anything with consequences, such as sending a message, submitting a questionnaire or starting a payment. * Keep tokens and confidential links out of logs and shared places. * Revoke the token when a user disconnects inside your product. * Tell users how to disconnect, and what happens to data you already hold. ## Frequently asked questions ### Is OAuth consent enough to process health data? No. OAuth permission authorises access to an account. You still need your own legal basis, an Article 9 condition, a privacy notice and the right agreements. ### Can a patient approve only some permissions? No. Scopes cover a whole area such as consultations or messages, and the patient approves them together. Request only the scopes your product needs. ### What happens when a patient disconnects? The app can no longer sign in. If the client revokes a token, every token for that connection stops working; otherwise an access token expires at most one hour after it was issued. ### Do we have to delete data after a patient disconnects? Disconnecting stops new access but does not delete what you already stored. Your own retention and deletion process must handle it. ### Can we store prescription or invoice links? No. Some links work without signing in, so give them only to the patient and do not store or repeat them. ### Who is the controller of patient data? Hi Doctor's own processing is described in its privacy policy. For your integration, establish controller and processor roles with your advisers; for the Partner API, they are set out in the partner agreement and DPA. ## Next steps > [card] [MCP permissions](https://docs.hi-doctor.ai/mcp/permissions.md) > > Every scope and what it allows. > [card] [MCP security](https://docs.hi-doctor.ai/mcp/security.md) > > Tokens, links and how the connector is protected. > [card] [Integration options](https://docs.hi-doctor.ai/businesses/integration-options.md) > > MCP connector, REST API or Partner API. > [card] [Discuss your integration](mailto:hello@hi-doctor.ai) > > Write to [hello@hi-doctor.ai](mailto:hello@hi-doctor.ai). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.