Skip to main content
The Hi Doctor Partner API is built to share only the medical data each side needs, under the GDPR. Your partner agreement and data processing agreement (DPA) set the controller and processor roles, and live mode stays off until both are signed. You record the patient’s consent with every submission; Hi Doctor signs every webhook and logs every read of patient data. Last reviewed: 2026-11-04

​
Who is controller and who is processor?

Hi Doctor processes patient data in line with the GDPR. The controller and processor roles of Hi Doctor and your organisation are as set out in the partner agreement and DPA. Live mode is not enabled until both are signed. You collect the patient’s consent before you submit a consultation, and you send a record of it with every submission (see Consent).
  • Show the patient Hi Doctor’s terms and privacy notice in the version Hi Doctor gives you, and record that version as notice_version. When Hi Doctor publishes a new notice, submissions with the old version fail with 422 consent_notice_outdated until you show the new one.
  • Ask for each consent separately and actively. Pre-ticked boxes are not consent.
  • Record when the patient consented (accepted_at) and keep your own evidence of it; send its reference as evidence_reference.
  • Consent to Hi Doctor’s medical service is separate from any marketing consent you collect for yourself. Hi Doctor does not send marketing to patients created through the Partner API unless they opt in with Hi Doctor directly.
Record the withdrawal with POST /v1/partner/patients/{id}/consent-withdrawal/ (scopes patients:read and consultations:write). Repeating the call keeps the first withdrawal time.

​
Which data does a partner receive?

The Partner API is designed to share only what each side needs:
  • Partners receive statuses, decision categories, structured information requests and structured prescription data. They never receive doctor notes, chat messages, prescription documents or doctor identities.
  • Information requests are structured: reason codes, question keys and document kinds, never free text.
  • Uploads are returned as identifiers only; file names are never echoed.
  • Send only the answers the questionnaire asks for. Do not add extra personal data.

​
Test and live separation

Test keys only reach test data and live keys only reach live data. Test consultations never reach a doctor, are never billed and test uploads are never attached to a medical record.

​
How should I protect API keys?

  • Keep keys on your servers, in a secret manager. Never in client apps, URLs or logs.
  • Give each system its own key with the smallest set of scopes.
  • Rotate keys regularly and revoke a key at once if you suspect a leak. See Authentication.

​
How are webhooks secured?

  • Every webhook is signed per the Standard Webhooks specification, with HMAC-SHA256 over the webhook-id, the webhook-timestamp and the body. Verify it before trusting the body, and reject timestamps more than 300 seconds from your clock. See Webhooks.
  • Endpoints must use HTTPS on a public host. Redirects are not followed.
  • Signing secrets are stored encrypted at Hi Doctor and are never written to logs.

​
Access logging

Hi Doctor records when each API key was last used and from which IP address, updated at most once a minute. The Business portal shows the last-used time per key and the network it was used from: the IP address masked to its /24 (IPv4) or /48 (IPv6) network, never the full address. Every successful read of patient, consultation, information request or prescription data, through the API or the Business portal, is also recorded in an access log: the partner, the mode, the API key or portal member, the route and the ids of the records disclosed. The log holds identifiers only, never the data read, and is kept for 180 days.

​
How do I report a security issue?

Write to hello@hi-doctor.ai with “Security” in the subject.

​
Frequently asked questions

​
Is the Partner API GDPR compliant?

Hi Doctor processes patient data in line with the GDPR. The controller and processor roles of Hi Doctor and your organisation are set out in the partner agreement and DPA, and live mode is not enabled until both are signed. Your platform does, before you submit a consultation. You send a record of it with every submission, including the notice_version the patient saw.

​
Do partners receive doctor notes or prescription documents?

No. Partners receive statuses, decision categories, structured information requests and structured prescription data, never doctor notes, chat messages, prescription documents or doctor identities.

​
How long is the access log kept?

For 180 days. It holds identifiers only, never the data that was read.

​
Are webhook signing secrets stored securely?

Yes. Signing secrets are stored encrypted at Hi Doctor and are never written to logs.

​
Can Hi Doctor send marketing to patients I create?

Not unless they opt in with Hi Doctor directly. Consent to Hi Doctor’s medical service is separate from any marketing consent you collect for yourself. It is kept as Hi Doctor’s retention policy requires. Nothing is deleted.

​
Next steps

Submit a consultation

The consent object and its fields.

Go-live checklist

Agreements and checks before live mode.
Commercial questions: read the partnership FAQ or write to hello@hi-doctor.ai.