Patient consent and data requests in the CRM

Why track consent in the CRM

A patient's consent is your proof that the clinic processes their data lawfully: what exactly they agreed to, when, and under which wording. A paper form in a folder can't answer "did they agree to AI call analysis?" or "which version of the text did they sign?". In 95sales, every consent is an entry in the patient or lead record that's visible at a glance and can't be quietly rewritten.

Health data is held to a higher standard than ordinary contact details: GDPR treats it as a special category, and so does Ukraine's personal data protection law. How to build protection more broadly is covered in the guide medical data protection.

Which consents you can record

Patient and lead records have a Consents block. Each consent is recorded separately:

For each entry, the CRM stores whether the person agreed or refused (withdrew), how consent was obtained (signed on paper, electronically, verbally by phone, automated phone message, website form), the form version, the date and the employee who recorded it. Withdrawing consent adds a new entry instead of deleting the old one, so the full history is kept.

Consent form version

In the Data protection settings, the clinic sets the current version of its consent form and can open the form to print. When the wording changes, the clinic bumps the version, and each record shows which version the person signed. That matters in an audit: you can show that a patient who came last year signed the earlier text, and new patients signed the current one.

Consent for AI call analysis

AI call analysis in 95sales runs only under the rules your clinic chooses. Settings offer two modes:

1. Only with the person's consent. A call is transcribed and scored only if the record or phone number has consent for AI analysis.
2. Notice at the start of the call. The clinic confirms that every call opens with a notice about recording and analysis, and that refusals are entered in the CRM. Calls are then analyzed unless the person has refused. Only the company's top manager can turn this mode on.

In either mode, a person's refusal of AI analysis blocks transcription and scoring of their calls. Names and phone numbers are masked before anything is sent to the AI. How the analysis itself works is on the AI call analysis page.

Data requests: export or erase

When someone writes "send me everything you have on me" or "delete my data", management handles it from the record:

• All of the person's data exports everything the CRM holds on a patient or lead in one file (GDPR Articles 15 and 20): the record, notes, payments, calls with transcripts, consents and the list of documents. Document scans are downloaded from the record separately.
• Delete upon request works from a written request, with a legal basis and confirmation by record number. For a lead who never became a patient, the whole record is deleted together with calls, comments and files. For a patient, the name, phone numbers, relative, diagnosis and notes are erased and call recordings and scans are deleted, while doctor notes, visits and payments stay under the record number, because the law requires medical and accounting records to be kept.

Both actions are recorded in the activity log.

Retention periods

The clinic decides how long to keep data that doesn't need to live forever:

Doctor notes, visits and payments are never deleted automatically: their retention is set by law, not by a CRM setting.

What the CRM doesn't do for you

The CRM gives you the tools, but it doesn't replace your lawyer or data protection officer. The clinic decides the wording of the consent form, the legal bases for processing and how it answers requests. The Data protection settings list the subprocessors that help 95sales run the service, with links to the data processing agreement (DPA) and privacy policy. Encryption, roles and the activity log are described on the data security page, and doctor notes on doctor notes with ICD-10.

How to get started

1. Approve your consent form wording and enter its version in settings.
2. Choose the AI call analysis mode: consent only, or a notice at the start of the call.
3. Set retention periods for call recordings and lost leads.
4. Train the front desk to record consent at the first visit, in the patient record.
5. Decide who handles people's data requests.