Security & Compliance

Procedure and OT Consent on WhatsApp: What a Defensible Record Contains, and How CuraVerto Handles It

Anexshe Revedha·Cofounder & COO, CuraVerto·26 September 2026·7 min read

The usual failure in procedure consent is not the absence of a form. It is a form that cannot answer questions afterwards. Which wording did the patient actually see? Was it read before the day, or handed over on a trolley? Who signed, the patient or a relative, and who witnessed? A paper file often cannot say, and a WhatsApp photo of a paper form says even less.

This post is a practical description, not legal advice. Whether a particular consent process is sufficient for a particular procedure is a question for your counsel and, for hospital settings, your accreditation body. What follows is what a well-built record contains, and how CuraVerto's OT consent flow behaves today.

What a defensible consent record contains

The exact wording that was shown
Not "a consent form on file" but the text itself, as it stood when the patient read it. If the wording changes later, the earlier record should still show what the earlier version said.
Who is being consented, for what
The patient, the procedure, and the planned time. Surgical consent and anaesthesia consent are different decisions and are usually recorded separately.
Who signed, in what capacity
The patient, or a guardian. If a guardian signs, their name and relationship to the patient belong on the record.
A witness who is not the signer
Someone other than the person signing, identified by name, ideally signing as well.
When, and by which route
A date and time, and whether it was signed in the clinic or through a link. Two routes are not the same evidence, and the record should say which one it is.
A history that cannot be quietly rewritten
Changes and withdrawals recorded as new entries rather than edits to an old one, plus an audit trail of who did what.

How CuraVerto's OT consent flow works today

The OT consent link belongs to CuraVerto's IPD operation theatre module, which is part of the Plus plan and is switched on clinic by clinic. It covers two consents for a booked operation: surgical consent and anaesthesia consent. The design is built around one idea: the patient can read at home, but the signature that counts is the one given in the clinic with a witness.

  • The clinic sends the patient a link on WhatsApp from the OT case, using an approved message template. If the patient has no WhatsApp number on file, the send is refused and the staff member is told to copy the link instead.
  • The link is signed, tied to that one clinic, that one case and that one patient, and expires after 72 hours. Nothing in the address or in what the patient submits can point it at another patient or another clinic.
  • The page shows the clinic name, the procedure, its planned time in the clinic's time zone, and the two consent wordings. The patient ticks "I have read this" before the signing area appears.
  • The patient may pre-sign each consent, as themselves or as a guardian. For a guardian, the name and relationship are required. The signature is drawn on screen.
  • The page tells the patient plainly that this does not replace signing in the clinic, and that they will sign again with a witness on the day of the operation.

What the system enforces underneath

CuraVerto stores the wording the patient was shown. If the clinic edits the wording between the patient loading the page and pressing submit, the submission is refused and the patient is asked to reload and read it again. A link can pre-sign each consent only once, so a link cannot be replayed. A consent already signed in the clinic cannot be overwritten by a later link signature. A suspended clinic's links stop working, and a case that is no longer booked or ready stops accepting them.

The in-clinic signature is a separate step that records the signer, the witness by name and a witness signature, and CuraVerto refuses a witness who is the same person as the signer. A link pre-signature does not satisfy the gate that lets the case proceed to theatre. Only the witnessed in-clinic consent does. The link is a courtesy to the patient, not a shortcut for the clinic.

The public link route logs no token, phone number or signature, and it writes at most one audit entry per link and consent type, so it cannot be used to flood the audit log.

What this does not claim

CuraVerto records what was shown, who signed and when. It does not make a consent legally sufficient, and it does not choose the clinical content of the wording for you. The consent wording is the clinic's own text, and its adequacy for a specific procedure, patient and jurisdiction is a matter for the treating team and counsel. A digital signature drawn on a phone is a record of an act, and how a court or a regulator weighs it depends on the case.

The other consent surfaces, briefly

CuraVerto separates consent into distinct records rather than one blanket. Appointment-level consent links, sent on WhatsApp, are signed tokens with a 24 hour expiry that the patient completes once, with the confirmation stored as a new record. Consent to data uses such as reminders and broadcasts is recorded per purpose, and withdrawing any of them is a new entry, not an edit. IVF consent has its own patient page and follows the clinic's ART documentation. In each case the consent table is insert-only: a withdrawal or a change is a new row that points at the old one.

Related reading

Frequently asked questions

Consent you can show afterwards, not just a signed sheet

CuraVerto stores the wording shown, the signer, the guardian details and the in-clinic witness for operation theatre consents, with an insert-only history. The OT module is part of the Plus plan at ₹49,999 per year excluding GST.

See CuraVerto pricing →Check your clinic's DPDP readiness freeChat on WhatsApp

Prefer not to use WhatsApp? Leave your number and we will call.

We use your name, clinic and number only to contact you about CuraVerto. See our privacy policy.

More from the blog

Security & Compliance
Clinic Audit Logs: How to See Who Changed What in a Patient Record
Security & Compliance
Do You Need DLT Registration for WhatsApp Reminders in India? (2026)
Security & Compliance
Schedule H and H1 Compliance for Digital Prescriptions in India