Healing Process policy suite

Consent, Capacity, Carer and Proxy Access Policy

1. Purpose

To ensure that consent, capacity, parental responsibility, best-interest decisions and carer or proxy access are handled lawfully, transparently and safely throughout capture, sharing, messaging and review.

2. Scope and status

This policy applies to patient and carer accounts, enrolment, photographs, messages, export, research and provider deployments. It is not legal advice and must be adapted to the applicable jurisdiction, age group, care setting and provider policy.

Deployment-specific policy framework

3. Policy principles

• Consent to care, consent to photography, data-protection lawful basis, account terms and research consent are distinct and must not be conflated.
• Capacity is decision-specific and time-specific. A communication or language barrier does not itself mean a person lacks capacity.
• Use the least restrictive, most person-centred route and involve the individual as far as practicable.
• Carers and representatives use their own verified identity and only the access authorised for the person and purpose.

4. Mandatory requirements

• Present age- and role-appropriate information explaining what is captured, who may see it, why it is used, response limits and withdrawal or alternative routes.
• Record the person giving consent or other authority, the decision, scope, date/time, information version and any expiry or review point.
• Where capacity is in doubt, route to an authorised professional; the app must not make a capacity determination.
• For a person lacking capacity, record the provider’s lawful authority and best-interest process where applicable, including consultation and restrictions on access.
• Verify parental responsibility or other legal authority rather than assuming it from relationship or possession of a device.
• Allow revocation or amendment of proxy access promptly, while preserving the audit history and care records that must be retained.
• Prevent account sharing and clearly attribute every capture, message, review and export to the acting identity.
• Obtain a separate governance approval for research or model-development use; care-pathway enrolment does not constitute consent for those purposes.

5. Procedure and escalation

• The enrolment workflow selects patient, authorised carer/proxy or professional role and records the evidence or provider confirmation required.
• A material change in purpose, recipient, functionality or service model triggers renewed information and, where necessary, renewed consent or authority.
• A disputed proxy relationship or suspected coercion leads to access restriction and safeguarding review through the provider.
• Withdrawal is actioned according to the processing basis and records duties; users are told what will stop and what valid records may remain.

6. Roles and responsibilities

Provider clinical team

assesses capacity and consent for care and determines best-interest or parental-responsibility arrangements.

Data Protection Lead

maps lawful processing and transparency requirements.

Product team

implements role-specific information, attribution, expiry and revocation controls.

Support

does not grant proxy access without approved verification and escalation.

Users

keep credentials private and act only within their authority.

7. Records, confidentiality and retention

Keep information versions, consent/authority records, capacity or best-interest references, proxy verification, access changes, withdrawal, disputes and associated audit logs.

Records created under this policy must be accurate, attributable, access-controlled and linked to the applicable retention schedule. Where a provider is the controller or authoritative record holder, its documented instructions and legal duties apply.

8. Monitoring, assurance and review

Review annually and after legal, pathway or product change. Monitor unauthorised access, proxy disputes, consent defects, withdrawal handling and user comprehension.

Material non-compliance is reported through the relevant clinical-safety, patient-safety, data, security, safeguarding, HR, contractual or whistleblowing route. Corrective actions receive an owner, target date and effectiveness check.

9. Training and communication

The policy owner identifies which roles require awareness, operational or specialist training. Training is accessible, version-controlled, role-specific and refreshed after material change or evidence that understanding is inadequate. Providers communicate local procedures and contact routes before users are granted access.

10. Related documents

• Safeguarding Policy
• Data Protection and Confidentiality Policy
• Research, Pilot and Service Evaluation Policy

11. Approval record