> ## Documentation Index > Fetch the complete documentation index at: https://docs.hi-doctor.ai/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > Connect the Hi Doctor MCP connector at https://mcp.hi-doctor.ai/mcp. Add this URL as a remote HTTP MCP server in your client, then sign in and authorise access through OAuth. Setup: https://docs.hi-doctor.ai/mcp/connect. > > The REST API base is https://api.hi-doctor.ai. Hi Doctor Docs at https://docs.hi-doctor.ai/mcp searches documentation; connect to the product endpoint above for patient tools. > > Hi Doctor operates across the whole European Union: residents of all 27 EU member states can use the service, and every consultation is reviewed by an EU-licensed doctor. Every consultation is reviewed in full by an EU-licensed doctor, who decides on medical grounds only. No algorithm, assistant or API call approves a consultation, issues a prescription or changes a dose. The service is available in eight languages: English, Spanish, German, Dutch, Italian, French, Portuguese and Chinese. > > ## Rules an assistant must follow > > - Never invent, assume or infer a medical answer. "I don't know" is a real answer: ask the patient to pick the closest option rather than guessing for them. > - Never give medical advice and never suggest a medication or a dose. An EU-licensed doctor decides those. > - If a questionnaire returns `ineligible`, say so plainly. Do not retry with altered answers. > - Before anything that costs money or cancels a plan, state exactly what will happen and get an explicit yes. > - Cancellation takes effect at the **end of the paid period**, not immediately. Say so. > - An early order is irreversible: it creates the renewal consultation immediately and uses up the period's one early order. Explain that and get an explicit yes. > - Prescription and invoice links are medical documents. A `signed_redirect` link opens without signing in: give it only to the patient, never repeat it anywhere shared. > - Send option `value`s, not the labels shown to the patient. Labels are translated, values are stable. > - Never ask for card details. Payment happens on Stripe's hosted checkout via a link. > - On severe or sudden symptoms (chest pain, difficulty breathing, severe allergic reaction, suicidal thoughts), stop and direct the patient to their local emergency number. # Partner API security, GDPR and patient consent > How the Hi Doctor Partner API protects medical data: GDPR roles set in the DPA, patient consent, data minimisation, key and webhook security, access logs. The Hi Doctor Partner API is built to share only the medical data each side needs, under the GDPR. Your partner agreement and data processing agreement (DPA) set the controller and processor roles, and live mode stays off until both are signed. You record the patient's consent with every submission; Hi Doctor signs every webhook and logs every read of patient data. Last reviewed: 2026-11-04 ## Who is controller and who is processor? Hi Doctor processes patient data in line with the GDPR. The controller and processor roles of Hi Doctor and your organisation are as set out in the partner agreement and DPA. Live mode is not enabled until both are signed. ## Consent capture You collect the patient's consent before you submit a consultation, and you send a record of it with every submission (see [Consent](https://docs.hi-doctor.ai/partners/submit-a-consultation.md#consent)). * Show the patient Hi Doctor's terms and privacy notice in the version Hi Doctor gives you, and record that version as `notice_version`. When Hi Doctor publishes a new notice, submissions with the old version fail with `422 consent_notice_outdated` until you show the new one. * Ask for each consent separately and actively. Pre-ticked boxes are not consent. * Record when the patient consented (`accepted_at`) and keep your own evidence of it; send its reference as `evidence_reference`. * Consent to Hi Doctor's medical service is separate from any marketing consent you collect for yourself. Hi Doctor does not send marketing to patients created through the Partner API unless they opt in with Hi Doctor directly. ### What happens when a patient withdraws consent? Record the withdrawal with `POST /v1/partner/patients/{id}/consent-withdrawal/` (scopes `patients:read` and `consultations:write`). Repeating the call keeps the first withdrawal time. | Effect | Detail | | - | - | | Patient resource | Carries `consent.withdrawn_at`. | | Open information requests | Withdrawn; answers to them fail with `409 info_request_not_open`. | | New submissions for the patient | Fail with `409 consent_withdrawn`, as does an answer to a request raised after the withdrawal. | | Open consultations, live mode | Hi Doctor is notified and handles them; the call does not cancel or freeze them automatically. | | Open consultations, test mode | A test consultation can still be advanced. | | Medical record | Kept as Hi Doctor's retention policy requires; nothing is deleted. | ## Which data does a partner receive? The Partner API is designed to share only what each side needs: * Partners receive statuses, decision categories, structured information requests and structured prescription data. They never receive doctor notes, chat messages, prescription documents or doctor identities. * Information requests are structured: reason codes, question keys and document kinds, never free text. * Uploads are returned as identifiers only; file names are never echoed. * Send only the answers the questionnaire asks for. Do not add extra personal data. ## Test and live separation Test keys only reach test data and live keys only reach live data. Test consultations never reach a doctor, are never billed and test uploads are never attached to a medical record. ## How should I protect API keys? * Keep keys on your servers, in a secret manager. Never in client apps, URLs or logs. * Give each system its own key with the smallest set of scopes. * Rotate keys regularly and revoke a key at once if you suspect a leak. See [Authentication](https://docs.hi-doctor.ai/partners/authentication.md). ## How are webhooks secured? * Every webhook is signed per the Standard Webhooks specification, with HMAC-SHA256 over the `webhook-id`, the `webhook-timestamp` and the body. Verify it before trusting the body, and reject timestamps more than 300 seconds from your clock. See [Webhooks](https://docs.hi-doctor.ai/partners/webhooks.md#verify-the-signature). * Endpoints must use HTTPS on a public host. Redirects are not followed. * Signing secrets are stored encrypted at Hi Doctor and are never written to logs. ## Access logging Hi Doctor records when each API key was last used and from which IP address, updated at most once a minute. The Business portal shows the last-used time per key and the network it was used from: the IP address masked to its /24 (IPv4) or /48 (IPv6) network, never the full address. Every successful read of patient, consultation, information request or prescription data, through the API or the Business portal, is also recorded in an access log: the partner, the mode, the API key or portal member, the route and the ids of the records disclosed. The log holds identifiers only, never the data read, and is kept for 180 days. ## How do I report a security issue? Write to [hello@hi-doctor.ai](mailto:hello@hi-doctor.ai) with "Security" in the subject. ## Frequently asked questions ### Is the Partner API GDPR compliant? Hi Doctor processes patient data in line with the GDPR. The controller and processor roles of Hi Doctor and your organisation are set out in the partner agreement and DPA, and live mode is not enabled until both are signed. ### Who collects the patient's consent? Your platform does, before you submit a consultation. You send a record of it with every submission, including the notice\_version the patient saw. ### Do partners receive doctor notes or prescription documents? No. Partners receive statuses, decision categories, structured information requests and structured prescription data, never doctor notes, chat messages, prescription documents or doctor identities. ### How long is the access log kept? For 180 days. It holds identifiers only, never the data that was read. ### Are webhook signing secrets stored securely? Yes. Signing secrets are stored encrypted at Hi Doctor and are never written to logs. ### Can Hi Doctor send marketing to patients I create? Not unless they opt in with Hi Doctor directly. Consent to Hi Doctor's medical service is separate from any marketing consent you collect for yourself. ### What happens to the medical record after a consent withdrawal? It is kept as Hi Doctor's retention policy requires. Nothing is deleted. ## Next steps > [card] [Submit a consultation](https://docs.hi-doctor.ai/partners/submit-a-consultation.md#consent) > > The consent object and its fields. > [card] [Go-live checklist](https://docs.hi-doctor.ai/partners/go-live-checklist.md) > > Agreements and checks before live mode. Commercial questions: read the [partnership FAQ](https://docs.hi-doctor.ai/partnerships/faq.md) or write to [hello@hi-doctor.ai](mailto:hello@hi-doctor.ai). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.