Skip to main content
Appendix

Consent & Identity

The consent modal is where the patient-physician relationship forms — directly with Appendix. Your app initiates it; Appendix owns the care.

What the patient sees

  1. Intro. Your app icon alongside the Appendix mark, with a plain-language explanation: a physician reviews, the patient confirms what's sent, and what your app can see. Under the default outcome-only visibility that's "your app only ever learns the outcome"; under full visibility the modal states plainly that your app can see the request details, demographics, the physician conversation, and prescription details.
  2. Review. Exactly what's being submitted on the patient's behalf — the clinical summary and their contact info (plus "for me / for my child" if you've enabled dependents).
  3. Consent. The patient attests the information is accurate and consents to a care relationship with Appendix's physicians. If your app uses full data visibility, a third, separate checkbox names your app and asks the patient to agree that it can see the interaction — the request, demographics, the physician conversation, and prescription details. Without that acknowledgment the request cannot proceed.
  4. Verify identity. A one-time identity check (name + DOB) handled securely by Stripe Identity. A returning patient who has verified before can skip this.
  5. Confirmation. The request is now with Appendix's physicians.

Why attestation matters

The clinical narrative is usually authored by your app's AI. The required "I confirm this information is accurate" checkbox places the accuracy representation on the patient — where it belongs, since it's their health information — and makes the submission clinically trustworthy.

Data visibility and consent

The Patient data visibility setting on your dashboard's consent-modal card controls what the patient is asked to agree to. Outcome only (the default): everything the patient shares with their physician stays with Appendix, and your app learns status and prescription count. Full visibility: the modal discloses that your app can read the interaction back, the patient acknowledges it with a dedicated checkbox, and your app can then call the details endpoint. The mode is captured per request at creation — changing the setting affects new requests only, never the terms a patient already accepted.

Branding the modal

Set your app name, app icon, and website in the developer dashboard. The icon renders as a circular badge next to the Appendix mark at the top of the modal — use a square image, at least 128×128px. Preview the result any time with the "Preview the modal" link in the dashboard.

Email verification & accounts

The patient confirms control of their email via a one-time code (delivered by Appendix), which also creates their Appendix account. One verified identity is reusable across every app that integrates Appendix — lower friction for the patient and safer medicine for the physician (a single longitudinal record across apps catches interactions and duplicate therapy).

What you must not do

  • Don't represent that your app diagnoses, treats, or prescribes — attribute care to Appendix.
  • Don't coach, fabricate, or tune the clinical narrative to obtain a specific outcome.
  • Don't collect consent or identity yourself — it's established through Appendix's consent modal. (The one exception is the enterprise developer-consented flow, under a signed agreement — see below.)
  • No controlled substances; Appendix-served states only.

Enterprise: developer-consented patients

Organizations with an enterprise agreement can obtain and document patient consent themselves and skip the consent modal entirely — creating patients via POST /prescribing/patients and submitting with patient_id. See Developer-Consented Patients (Enterprise).