Consent is the part of a health product nobody wants to build and everybody gets audited on. "The user ticked a box at sign-up" does not satisfy GDPR Article 9, does not survive a data-protection review and does not let a person take access away from one app without deleting their account. This guide describes what a patient consent platform has to do and how Anpheros Platform does it, so you can reuse it instead of rebuilding it.
Consent as an object, not a flag
In Anpheros a consent is a grant: one person, one application, a set of scopes, a purpose, an expiry. It is created when the person approves access on the consent page, it is listed where the person can see it, and it can be revoked at any time. Reads are checked against it on every request.
- Scopes say what the application may read or write: observations, conditions, medications, allergies, documents, and so on, optionally narrowed by category (for example lab results but not symptoms).
- Duration is chosen by the person: 30, 90, 180 or 365 days. There is no "forever".
- Revocation takes effect on the next request. The application receives a
consent.revokedwebhook. - Purpose is recorded with the grant and shown to the person.
How an application asks
Through OAuth 2.1 with PKCE, with SMART on FHIR standalone launch for apps that already speak SMART. The person signs in, sees which application is asking, which scopes and for how long, and approves or declines. The application gets a token limited to that one patient and those scopes; a project key never stands in for a person's consent.
GET https://platform.anpheros.com/oauth/authorize?client_id=…&scope=patient/Observation.read …
POST https://platform.anpheros.com/oauth/token
Access tokens live 30 minutes, refresh tokens 30 days. Discovery documents are at /.well-known/oauth-authorization-server and /.well-known/smart-configuration.
What the patient sees
GET /me/patients/{id}/grants lists every application with access, its scopes and expiry. …/grants/{grant}/access-log lists what each one read or wrote, under the consent and with the project's own key. With format=fhir the log comes back as a Bundle of FHIR R4 AuditEvent resources shaped after the IHE Basic Audit Log Patterns. In Anpheros Daily this is the "Connections" screen; your own app can show the same.
Reads versus writes
With consent an organisation sees the whole record, including what other clinics wrote, but can change or delete only what it wrote itself. Every version of every resource records the project that wrote it; a write by another project is refused with an explanation. Every write produces a Provenance resource naming the application, the organisation on whose behalf it acted, and the person.
AI agents propose, the person decides
A write made under a person's consent by an application registered as an AI agent is not applied at once. The platform validates it and answers 202 Accepted with a proposal id; nothing changes in the record. The person sees the proposal, what it is and which application sent it, and accepts or rejects it. An accepted proposal is written exactly as sent and marked as AI-written. This is how an assistant connected through MCP can help fill a record without ever writing to it unsupervised.
Sharing without an application: SMART Health Links
A person can also share their record by QR or link. POST /me/patients/{id}/shl creates a SMART Health Link for the emergency subset (allergies, medications, problems, immunizations) or the full International Patient Summary, with an optional passcode and expiry. Every opening is in the access log, and the link can be switched off at once. Any SMART Health Link reader can open it.
The complete model, with every rule, is at developers.anpheros.com/guides/consent-model.
Frequently asked questions
Is consent stored as a FHIR Consent resource?
The grant is the operational object checked on every request; the record also carries FHIR Consent and Provenance resources so other systems can read what was agreed and who wrote what. The access log is available as FHIR AuditEvent.
Can a patient give access to only part of the record?
Yes. Scopes are per resource type, with category filters, and the person chooses them on the consent page. An app can ask for lab results only, or medications only.
What happens when consent expires?
Requests under that grant return 403 from the expiry onward. The application can ask again; the person decides again. Nothing is deleted.
Does revocation delete what the app already read?
No system can un-read data. Revocation stops further access immediately and is recorded; what the application stored on its side is governed by its own obligations under GDPR.
Can a clinic access a record without the patient's consent?
A project sees the patients it created itself. Reading a record created elsewhere requires the person's grant. There is no administrative override.
Keep your medical record with you
Anpheros Daily keeps symptoms, lab results, medications and documents in one place, in a standard format, under your control. The Basic plan is free.