Skip to content
Audience: DPO / Compliance

Patient consents and marketing (PKE)

Consent and a channel switch are two different things — here is what Heltio records, what it confirms by e-mail, and what blocks a send despite consent having been given.

Last reviewed:

The Polish Electronic Communications Law requires consent for direct marketing separately for each channel. A single consent "to marketing" is not enough. Heltio therefore records consents broken down by channel: e-mail, SMS, in-app notification, telephone, postal mail.

What Heltio records

Every consent record carries the type of consent, the channel (where relevant), the version of the document it refers to, the moment it was given and the moment it was withdrawn, the IP address and the browser identifier.

The patient consent types visible in the portal under My Consents:

Privacy Policy · Data Processing · Marketing (and separately Marketing — Email, Marketing — SMS, Marketing — Push Notifications, Marketing — Phone Calls, Marketing — Postal Mail) · Third-Party Sharing · Cookies · Visit audio recording (AI transcription)

Separately, on the practice side, two administrative consents accepted at sign-up are recorded: Data Processing Agreement and Processor Agreement.

The text of every consent document is stored with a checksum. At start-up the app recomputes those checksums and refuses to boot if any of them does not match — the document a consent refers to cannot be quietly swapped out.

In the portal, under Marketing messages, there are two separate things — and the app says so outright: "Two separate settings: your consent, and whether we may actually send to a channel. Both have to allow it before you hear from us."

  • Your consent — the legal basis. The buttons Give consent and Withdraw consent. The states: Consent given, No consent, Consent withdrawn, Waiting for you to confirm by e-mail.
  • Channels we may use — the switches Allow marketing e-mails and Allow marketing texts. Turning one off stops sending immediately, but does not withdraw the consent.

Confirmation by e-mail

Consent to e-mail marketing given by the patient requires a confirmation back: the app sends a link, and until it is clicked it sends nothing — "We sent you a confirmation link. Nothing is sent to you until you click it, and the link is valid for 24 hours." The number of resends is limited; once it is exhausted the app asks the patient to check their inbox, spam folder included.

The portal gives the reason outright. Six are possible:

  • "This channel is switched off below, so nothing is sent on it."
  • "Confirm by e-mail to finish turning this on."
  • "We do not have an e-mail address for you." / "We do not have a phone number for you."
  • "You have objected to marketing, so nothing is sent."
  • "Processing of your data is restricted, so nothing is sent."

The last two follow from requests under Articles 21 and 18 — see Data subject rights.

Transactional communication is not marketing

An appointment reminder, a booking confirmation, an invoice and a message from a practitioner do not need marketing consent — the basis is the contract or a legal obligation. The line is thin, and it is where a dispute is most often lost: a reminder with a promotional postscript stops being transactional. Keep the content apart.

This is the only patient consent that the AI features require outright. A recording cannot be anonymised before being sent to the transcription provider, so it needs its own consent, additionally confirmed before every recording. The patient can revoke it themselves in the portal; revocation immediately deletes recordings, transcripts and drafts that have not been applied. Details: Patient consent for AI processing.

Cookies on heltio.pl

The banner has four categories: Essential (cannot be switched off), Preferences, Analytics and Marketing. None of the optional ones is ticked in advance. The description of the marketing category says honestly that it is not used today. You can change your choice later with the Manage cookie preferences button on the cookie policy page.

Was this article helpful?