Data areas and patient-data consent

A clinic decides, by data area, what its integrations and assistants may use. Every operation belongs to exactly one area, and it runs only while that area is on.

The areas

Area id	Name in Brelio	Contains	Default
`agenda`	Agenda y citas	Appointments, free slots, each professional’s schedule	On
`team`	Servicios y equipo	Centers, professionals, services	On
`patients`	Pacientes: datos administrativos	Name, contact details, record data	Off
`clinical`	Pacientes: historia clínica y notas	Sessions, notes, clinical documents	Off
`billing`	Facturación	Invoices, payments, packages	Off
`integrations`	—	Keys, apps, webhooks and these settings	Always on

integrations cannot be turned off: it holds the controls that cut access. No operation uses clinical or billing yet. An owner changes the areas in Configuración › Integraciones › Resumen. A change applies to the next request.

Patient data needs two decisions

An operation on patient data (patients, clinical) runs only when both are true:

The clinic turned the area on. An owner accepts the patient-data terms (they are versioned) and the decision is recorded with who and when.
The credential was accepted. Each credential needs its own acceptance before it touches patient data:
- an MCP connection or a personal key: by its person, the first time it is needed;
- an organization key or a partner app: by the owner who creates it.

Until the reviewed patient-data terms are published, the patient areas cannot be turned on in production (409 PATIENT_DATA_TERMS_PENDING), so every patient operation answers 403 DATA_AREA_OFF.

What you see when an area is off

Operations of that area are refused:

403 DATA_AREA_OFF

{
  "type": "https://api.brelio.app/problems/data-area-off",
  "title": "Request refused",
  "status": 403,
  "code": "DATA_AREA_OFF",
  "detail": "patients.list uses the patients data area («Patients: administrative data»), which this organization does not allow integrations to use. An owner can turn it on in Brelio's integration settings.",
  "request_id": "…",
  "params": { "operationId": "patients.list", "area": "patients" },
  "hint": "An owner can turn the area on in Brelio; until then, use operations of other areas."
}

Patient fields inside other areas come back as null. For example, GET /v1/agenda still lists appointments, but patientId is null unless the patients area is on and the credential was accepted. Your code must accept null there. Webhooks follow the same rule at delivery time: events about patients are not delivered, and patient fields in other events are sent as null. When the area is on but the credential was not accepted yet, the call answers:

403 PATIENT_DATA_CONSENT_REQUIRED

{
  "type": "https://api.brelio.app/problems/patient-data-consent-required",
  "title": "Request refused",
  "status": 403,
  "code": "PATIENT_DATA_CONSENT_REQUIRED",
  "detail": "patients.list returns patient data, and nobody has accepted patient data for this credential yet. Its person (or the owner who created it) accepts it in Brelio.",
  "request_id": "6731564c-80c0-487c-bbf0-e7041f66d19e",
  "params": { "operationId": "patients.list" },
  "hint": "The credential's person accepts patient data in Brelio; organization keys and apps are accepted by an owner."
}

Over MCP, the same refusal carries a link in params.consent_url (https://brelio.app/<clinic>/conectar/<connection>). Clients that support URL elicitation open it for the person; others show it. After accepting, retry the call. Operations without patient data keep working before any acceptance.

Read the clinic’s policy

An integration with Gestionar integraciones can read the current state:

curl https://api.brelio.app/v1/platform-policy \
  -H "Authorization: Bearer $BRELIO_API_KEY"

Response

{
  "data": [
    { "id": "agenda", "label": "Schedule and appointments", "description": "Appointments, free slots and each professional's schedule.", "patientData": false, "enabled": true, "version": 0, "updatedAt": null },
    { "id": "team", "label": "Services and team", "description": "Centers, professionals and services.", "patientData": false, "enabled": true, "version": 0, "updatedAt": null },
    { "id": "patients", "label": "Patients: administrative data", "description": "Name, contact details and record data.", "patientData": true, "enabled": false, "version": 0, "updatedAt": null },
    { "id": "clinical", "label": "Patients: clinical history and notes", "description": "Sessions, notes and clinical documents.", "patientData": true, "enabled": false, "version": 0, "updatedAt": null },
    { "id": "billing", "label": "Billing", "description": "Invoices, payments and packages.", "patientData": false, "enabled": false, "version": 0, "updatedAt": null }
  ],
  "terms": { "id": "patient-data-terms", "version": 1, "reviewed": false, "available": false }
}

GET /v1/platform-policy/decisions lists every decision (who turned an area on or off, who accepted patient data for which credential), newest first.

An integration can only cut access

An integration may turn an area off, for example to stop its own access at once:

curl -X PATCH https://api.brelio.app/v1/platform-policy/agenda \
  -H "Authorization: Bearer $BRELIO_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{"enabled": false, "expectedVersion": 0}'

Turning an area on always takes a person in Brelio (403 DATA_AREA_ENABLE_IN_BRELIO).

Volume ceiling

One credential can receive at most 2,000 patient records per hour. Past that, calls answer 429 RATE_LIMITED and the clinic’s owners are alerted. See rate limits.

Get started

Concepts

Guides

MCP reference

Reference

Data areas and patient-data consent

The areas

Patient data needs two decisions

What you see when an area is off

Read the clinic’s policy

An integration can only cut access

Volume ceiling

​The areas

​Patient data needs two decisions

​What you see when an area is off

​Patient-data consent

​Read the clinic’s policy

​An integration can only cut access

​Volume ceiling

The areas

Patient data needs two decisions

What you see when an area is off

Patient-data consent

Read the clinic’s policy

An integration can only cut access

Volume ceiling