The seven permissions
Tools that need more than one permission
Most tools need one permission, listed in the patient reference. These need more than one:
If a tool has several actions, the actions you lack a permission for are left
out of its schema.
Defaults
If the app does not ask for specific permissions, a patient account receives all seven: profile, consultations, messages, questionnaires, health tracking, payment and record changes. Payment is included in the default. The approval page shows it in its own box because it is the permission that can lead to a charge. An app can ask for fewer permissions. You cannot untick individual permissions on the approval page: to grant fewer, the app must request fewer. Scope values the server does not recognise, or that do not apply to the account, are dropped.Which permissions can cost money or cannot be undone?
Preparing checkout is safe in itself: nothing is charged until you enter payment details on Stripe’s page and confirm. These actions need more care:- Ordering the next refill early (Payment) creates the renewal consultation immediately, uses the one early order allowed in the paid period, and cannot be undone.
- Checking a checkout session (Payment) can complete a paid session and create its consultation.
- Deleting your account (Record changes) anonymises the account. Records that must legally be kept are retained.
What is never allowed?
No connected app can:- approve an action on a person’s behalf: approval happens only on Hi Doctor, after that person signs in;
- approve a consultation, issue a prescription or change a dose: those are medical decisions, explained on Safety;
- read a patient’s data unless the signed-in account is that patient;
- get past the clinical eligibility checks on a questionnaire;
- see your password, which is entered only on hi-doctor.ai.
Missing permissions
Tools that need a permission you did not approve are left out of the app’s tool list. If an app calls one anyway, Hi Doctor answers with aninsufficient_scope challenge that names the permission needed. Apps that
support this send you back to hi-doctor.ai to approve it, then repeat the
request. In other apps, disconnect and connect again, approving the permission
this time.
What changes for existing connections
A connection keeps exactly the permissions it was granted: a refresh can narrow the granted scopes but never widen them. Connections approved before 7 October 2026 therefore lack Record changes, and their tokens cannot prepare approval links: tools such ashidoctor_message_send return reconnect_required. Disconnect the app and
connect it again to approve the current set once.
Disconnecting
Removing the connector in your AI app ends its access. How long access already issued lasts is explained on Connect.Frequently asked questions
What permissions does Hi Doctor give an AI app by default?
All seven patient permissions: profile, consultations, messages, questionnaires, health tracking, payment and record changes. An app can request fewer.Can I untick a permission on the approval page?
No. To grant fewer permissions, the app must request fewer. The approval page shows Payment and Health tracking in their own boxes so you can see them clearly.Can a connected app charge my card?
No. Card details never reach the connector. A charge only happens when you complete Stripe’s checkout yourself, and ordering a refill early waits for your approval.Can an AI app change my prescription or dose?
No. Those are medical decisions made by an EU-licensed doctor, and no permission or tool allows them.What happens if an app calls a tool I did not approve?
Hi Doctor answers with an insufficient_scope challenge naming the permission. The app can send you back to approve it, or you can disconnect and connect again.Why does an older connection return reconnect_required?
Connections approved before 7 October 2026 cannot prepare approval links. Disconnect the app and connect it again.Next steps
- Approval links: how actions with consequences wait for your approval.
- Security: how sign-in, tokens and permissions are enforced.