Consent & GDPR

The consent service records what a member has agreed to share, keeps an immutable trail of every change, and drives the GDPR Article 17 right-to-erasure workflow.

Field reference: full columns, types and nullability live in the catalog: glossary terms ConsentRecord, AuditItem, DeletionRequest. This page is the narrative.

ConsentRecord

A ConsentRecord is keyed (party_locator, consent_type), at most one per member per type (a UNIQUE constraint), with a granted boolean capturing the current preference. consent_type is free TEXT (no DB CHECK); the conventional types are below, but the column accepts any string.

Conventional consent_type	Controls
NHS_DATA_SHARING	Sharing health data with NHS systems for care coordination
WEARABLE_SYNC	Ingesting wearable data for wellness programmes
EMPLOYER_WELLBEING_REPORTING	Including anonymised metrics in employer dashboards
RESEARCH_PARTICIPATION	Using de-identified data in research
MARKETING_COMMUNICATIONS	Receiving marketing messages

AuditItem: the change trail

Every consent change appends an AuditItem (consent.consent_audit): party_locator, consent_type, old_value, new_value, changed_by, changed_by_type, reason, occurred_at. It is append-only: who changed what, from what to what, when, and why. (A single cross-domain audit log is aspirational; today this is consent-scoped.)

GDPR deletion

A DeletionRequest drives erasure under UK GDPR Article 17:

delete_type	Effect
SOFT	PHI is anonymised; the record remains for referential integrity.
HARD	Data is purged / tombstoned.

It tracks status (default PENDING) and an attempt_count for retries, with requested_at/completed_at. delete_type and status are free text.

Regulated retention overrides erasure

Billing and claim records subject to statutory retention (FCA / regulatory) must be kept even after an erasure request; deletion anonymises PHI while preserving the required audit records.

Invariants

• One ConsentRecord per (party_locator, consent_type).
• AuditItem rows are inserted on every change and never updated or deleted.

Caveats

• consent_type, delete_type and status are free TEXT with no DB CHECK.
• Records are keyed by party_locator (text), not a Party UUID FK.
• ConsentItem exists in the model but is aspirational; it overlaps the implemented ConsentRecord + AuditItem and has no table.