Form builder, consent and document management
In a clinic, consent is more than a signed sheet of paper; it is evidence of who agreed to what, under which version of the text and by which means. HekimBis keeps the privacy notice, explicit consent and procedure-specific clinical consent as separate records and stores each one's text version and evidence. You build your own forms, have patients fill them in the portal or at the clinic, and find the signed document in the patient file.
Privacy notice, explicit consent and clinical consent are separate records
The privacy notice is shown first and recorded with its version. Explicit consent is taken as a separate action, only for a procedure that really requires it. Clinical consent is then taken separately, with a text specific to the procedure and its signature components.
- Privacy notice
- Tells the patient why, how and with whom data will be processed. The text version, the time shown and the channel are recorded as evidence that it was displayed.
- Explicit consent
- Taken only for a specific procedure that really needs it, on a separate screen and through a separate user action. It is stored with its text version and can be withdrawn.
- Separate permission types
- Marketing permission, service communication and the basis for processing health data are separate records, and giving one never stands in for another.
- Withdrawal and expiry
- Consent can be withdrawn, and the procedures affected by the withdrawal are visible. An expiry date can be attached to a consent, and a new consent is requested when it passes.
- Clinical consent
- Recorded with the procedure-specific text, the signer, the version, the time, the channel and the evidence components.
Every record shows separately who agreed to what, under which text version, through which channel and when. That is why, later on, it is always clear which consent a procedure in a patient's file rests on.
Notice, explicit consent and clinical consent are taken in order and separately
The patient first sees the privacy notice, followed, where needed, by explicit consent, the procedure-specific clinical consent and the signature. If the patient withdraws consent, the affected procedures become visible, and when a consent expires a new one is requested.
Withdrawal
If the patient withdraws consent, new data processing stops and the affected operations are visible. Past records that must be kept by law are not deleted.
- The process is complete here.
- Photo sharingNew processing stopsAffected
The names, times and records on the screen are examples.
All steps
- 01 Notice shown (Patient) The notice text is shown to the patient; the text version and the time shown are recorded.
- 02 Explicit consent (separate action) (Patient) Taken only for an operation that really needs consent, on a separate screen, with a separate action. Independent of the notice.
- 03 Clinical approval (Staff) A procedure-specific text is shown; the patient signs (pad, OTP, timestamp, witness where needed).
- 04 Evidence record (Record) The signer, text version, time, channel and evidence components are recorded one by one; the document becomes a PDF and cannot be changed.
- 05 Withdrawal (Patient) If the patient withdraws consent, new data processing stops and the affected operations are visible. Past records that must be kept by law are not deleted.
Alternative path from 02 Explicit consent (separate action); it returns to the main flow at 02 Explicit consent (separate action).
- 02a Single combined checkbox: rejected (Record) A flow that tries to gather notice and explicit consent in one box is not accepted by the system; two separate screens and two separate actions are required.
Alternative path from 04 Evidence record; it returns to the main flow at 03 Clinical approval.
- 04a Expired: re-consent (Record) If the consent has expired or the text version has changed, re-consent is requested; the old record stays with its old version.
05 Withdrawal
You build your own forms
With the form builder you define conditional sections, required fields, scoring, drafts and versions, and add a signature field to the form.
A specialty pack brings ready-made forms and templates, and you add your own local section. Every form is versioned, and a signed record stays pinned to the form version it was created with.
A PDF is generated from the document template and does not change after the clinical signature. Consent types cover procedure, treatment, photo, communication, data sharing, parent or guardian and remote-service consents, and the patient completes the form in the portal or at the clinic.
A completed form is attached to the patient file together with its signature components and appears in the related appointment, treatment plan and document list. For a form completed on behalf of a parent or guardian, the relationship evidence and scope are recorded.
Signature evidence is made of three groups of components
The signer, the text version, the time, the channel and each evidence component are recorded individually.
- Signature pad and biometric trace
- The patient signs on a pad, and the trace of the stroke is stored together with the signature. The document is generated as a PDF and does not change after signing.
- OTP and timestamp
- For remote consents, a one-time code sent to the patient's phone supports that the approval came from that person, and the timestamp fixes when it was given.
- Staff witness and audit trail
- Where needed, a staff member witnesses the signature. Every component and action is written to the audit trail.
Photo series are taken at the same angle, with the same label and separate consent
In aesthetics, dermatology, hair transplantation or wound follow-up, a before-and-after comparison is meaningful only with photographs taken from the same angle in the same light.
HekimBis records photo and video series with a standard angle and label and compares them side by side with earlier images. Taking and using a photograph depends on a photo consent that is separate from the treatment consent. It states the purpose (record, follow-up, education, sharing), can be withdrawn and is requested again when it expires.
Images and documents added by file upload, camera or scanner are stored with a category, tags and a version, and can be previewed and searched. Photo and video series sit in the patient file together with their before-and-after comparison.
Share a document with a time-limited link
When you need to send a report, a consent form or a document to a patient or another organization, HekimBis creates a secure link that is time-limited, revocable and single-use.
When the link was opened, by whom and whether it has expired stay on record, and a link can be revoked at any time. Uploaded files go through malware scanning, file-type validation, and size and quota checks, and retention and an access log are defined.
Documents are stored with a category, tags and a version, and can be previewed and searched. A document added with a camera or scanner follows the same path.
Frequently asked questions
Who can see form and consent records?
Form and consent records are visible according to role, branch and care relationship, and every read and download is written to the audit trail. Access to a document sent through a sharing link is recorded separately.
Why are the privacy notice and explicit consent separate?
The privacy notice tells people why, how and with whom their personal data will be processed, while explicit consent is a separate action given freely and revocably, only for a specific procedure that really requires it. HekimBis keeps the two on separate screens and in separate records. For the legal content of your texts, we recommend working with your health-law adviser.
Is a signature made on a signature pad a valid electronic signature?
The signature pad, biometric trace, OTP, timestamp and staff witness are components that support the integrity of the evidence. If a qualified electronic signature (NES) or mobile signature is needed, that is a separate provider and certificate flow.
What happens if a patient withdraws consent?
Withdrawal stops new data processing, and the screen shows which procedures are affected. Past records that the law requires to be kept are not deleted silently. The legal basis, retention period and deletion effect of each flow are defined separately.
Can I create forms myself?
Yes. With the form builder you define conditional sections, required fields, scoring, drafts and versions. A specialty pack brings ready-made forms and you add your own local section, while parts of the central form such as security and the separation of consent stay in place. Every form is versioned, and a signed record stays pinned to the form version it was created with.
Is separate consent needed for photographs?
Yes. Photo consent is a record separate from the treatment consent and states the purpose of the photograph. In specialties such as aesthetics, dermatology and hair transplantation it comes with the photo protocol in the specialty pack.
Can patient consent be collected through the portal?
Yes. The pre-visit questionnaire, consent and file upload can all be completed in the patient portal. The patient fills in the form and uses the signature components, and the record is attached to the patient file. If consent is given on behalf of a parent or guardian, the relationship evidence and scope are recorded.
Which consent types can be defined?
Procedure, treatment, photo, communication, data sharing, parent or guardian and remote-service consents can be defined. Marketing permission, service communication and the basis for processing health data are kept apart.
How is a PDF generated from a document template?
A PDF is generated from the form or document template and the document cannot be changed after the clinical signature. It is attached to the patient file with its signature components and stored with a category, tags and a version.
How is consent taken on behalf of a parent or guardian?
Parent or guardian consent is a consent type of its own. The relationship evidence, the scope of authority and its duration are recorded, and the consent is attached to the patient file and the procedure concerned.
How is consent taken for a remote service?
For an online consultation, identity verification, separate information and consent are taken before the call and stay on record with it. For remote consents, an OTP and a timestamp support the integrity of the evidence.
Can I see whether a document I shared has been opened?
Yes. For a time-limited secure link, the time it was opened and an access log are kept, and the link can be revoked before it expires.
Are consent texts versioned?
Every privacy notice, explicit consent and clinical consent text is versioned. Which version the patient approved, when and through which channel stays on record, and when a text is updated the earlier record stays tied to its own version.
Keep reading
Related pages
Features
Specialties
- Plastic surgeryPre-op planning, photo series, implant lot records, and post-op follow-up.
- General surgeryPre-op assessment, surgical planning, consent, and wound follow-up.
- GETAT (complementary medicine)Procedure type, body area, material lots, session plans, and license scope checks.
- DermatologyLesion and body maps, dermoscopy photo series, and separate photo consent.
Software guides
Company and support
Guides
- How Small Moments in the Patient Experience Shape Clinic SuccessPatient experience is not a survey question; it is an operational chain from booking to follow-up. A practical framework for managing waiting, communication and trust.
- A Practical KVKK and Health Data Compliance Guide for ClinicsHealth data is special-category personal data. The difference between the privacy notice, explicit consent and clinical consent, access control, data subject requests and breach notification.