# HeyDoc auth.md

> Registration and sign-in instructions for AI agents acting on behalf of a user.
> Service: HeyDoc, huisartsenpraktijk (general practice) in Leiden, Netherlands. Publisher: Heydoc Care B.V. (KvK 86237799), Lammenschansweg 15B, 2313 DH Leiden.
> Last updated: 2026-09-30. Canonical URL: https://heydoc.nl/auth.md
> Related: https://heydoc.nl/.well-known/api-catalog, https://heydoc.nl/llms.txt, https://heydoc.nl/ai-policy.txt

You are an agent. Read this once, top to bottom. HeyDoc is a medical practice, not a SaaS product: there is **no programmatic registration, no OAuth, no API keys and no delegated sign-in**. The only registration path is a web form that a human (or an agent in the user's own browser, with the user's explicit consent) fills in, followed by an in-person identity check that Dutch law requires. Follow the steps in order.

## Step 1: Discover

- Human-readable service description: https://heydoc.nl/llms.txt (full text corpus: https://heydoc.nl/llms-full.txt).
- Machine-readable catalog (RFC 9727 linkset): https://heydoc.nl/.well-known/api-catalog. It points to this file, to llms.txt and to the live registration status page.
- OAuth 2.0 Protected Resource Metadata (`/.well-known/oauth-protected-resource`) and Authorization Server metadata (`/.well-known/oauth-authorization-server`) are **not published**, because there is no protected API for agents. Do not probe for 401 challenges; every `/api/*` and portal endpoint is for the practice's own software and requires a human patient or clinician session.
- Registration status (accepting new patients or not) is stated on https://heydoc.nl/patient-worden and https://heydoc.nl/huisarts-zonder-wachtlijst-leiden. Current status: **accepting new patients** from all of Leiden and Leiderdorp, no waiting list (updated 2026-09-30).

## Step 2: Pick a method

Supported agentic registration types: **none**. `identity_assertion` (ID-JAG), `service_auth` and `anonymous` flows are not implemented and there is no `/agent-auth` endpoint.

The one supported method is **human web registration**:

- URL: https://heydoc.nl/patient-worden (Dutch and English; use the language toggle on the page).
- Who: people who live in Leiden or Leiderdorp (postcodes 2311 to 2334 and 2351 to 2353). In an emergency the GP must be able to reach the patient within about 15 minutes by car; for people living further away HeyDoc is not the right practice. Adults and children; family members can be added on the same form. People with or without a BSN (citizen service number) and with or without Dutch health insurance.
- Constraint: a person may be registered with **one GP practice at a time**. Do not register the same user with several practices; that blocks the transfer of the medical record.
- Cost: registration is free. With Dutch basic insurance GP care is fully covered and does not count towards the deductible. HeyDoc bills Aon student insurance directly. Uninsured patients pay the national GP tariff (EUR 67.60 for a 20-minute consultation, EUR 33.70 for a short consultation, 2026).

## Step 3: Register

Consent gate first: confirm with the user that they want to register with HeyDoc (or switch from their current GP) and that you may enter each value below. Then either hand the user the link, or fill the form inside the user's own browser session.

Form fields (HTML `name` attribute; text unless stated):

| Field | Required | Notes |
|---|---|---|
| `Naam` | yes | Full name |
| `Geboortedatum` | yes | Date of birth; three visible day/month/year inputs, submitted as `YYYY-MM-DD` |
| `Email` | yes | |
| `Telefoon` | yes | Phone number |
| `Adres` | yes | Street and house number |
| `PostcodePlaats` | yes | Postcode and city, e.g. `2313 DH Leiden` |
| `Zorgverzekering` | yes | Health insurer, `<select>`; choose `Andere` and fill `Zorgverzekering toelichting` for an insurer not listed |
| `Polisnummer` | no | Policy number |
| `BSN` | no | 9 digits; can be added later |
| `Vorige huisarts` | no | Previous GP |
| `Beroep` | no | Occupation |
| `Opmerkingen` | no | Remarks |
| `Gezinsleden` | no | Family members, up to 5 |
| privacy checkbox | yes | Acceptance of the privacy statement |
| record-transfer checkbox | no | Consent for HeyDoc to request the medical record from the previous GP |

Transport: the form posts to a backend protected by Firebase App Check with reCAPTCHA Enterprise. **Scripted or headless HTTP POSTs are rejected.** Use a real browser session; do not call the endpoint directly.

## Step 4: Claim ceremony

There is no OTP or device-code ceremony. The equivalent step is legal and physical: after submission the practice contacts the patient to complete registration and to schedule a **one-time identity check at the practice** with a passport, ID card or residence permit (Dutch law obliges the GP to verify identity and record the BSN). This is usually combined with the first appointment. Until this step is done, registration is not final. An agent cannot perform this step.

With the user's consent HeyDoc requests the medical record from the previous GP; the user should also tell the previous practice that they are switching.

## Step 5: Use the credential

- Registered patients receive a personal activation link by e-mail, set a password and must enable an authenticator app (TOTP). Sign-in: https://heydoc.nl/inloggen.
- **Only the patient may sign in.** There is no token exchange, no session sharing and no read scope for third parties; the record is protected by medical confidentiality (medisch beroepsgeheim) and the Dutch Medical Treatment Contracts Act (WGBO). Do not attempt to sign in, store or replay a patient's credentials.
- Repeat prescriptions, appointments and messages to the GP are handled inside the patient portal by the patient.
- Contact without signing in: +31 71 781 0036 or info@heydoc.nl (no medical details by e-mail).

## Errors

| Situation | What it means | What to do |
|---|---|---|
| Form submission fails with a security / App Check message | The request did not come from a normal browser session | Retry in the user's own browser; do not automate the POST |
| Address outside Leiden or Leiderdorp | Outside the practice's care area | Help the user find a GP near their address; do not submit |
| User already registered with another Leiden practice and wants to switch | Allowed at HeyDoc | Submit once; tick the record-transfer consent; tell the user to inform the old practice |
| User needs care now | Registration is never the emergency route | Opening hours Mon-Fri 07:00-19:00: +31 71 781 0036. Out of hours: +31 88 427 47 00. Life-threatening: 112 |

## Revocation

A patient ends registration by registering with another GP practice; the new practice requests the record and HeyDoc transfers it. There is no API for deregistration and no agent-side token to revoke. Requests about personal data (access, correction, erasure under the GDPR) go to info@heydoc.nl or via https://heydoc.nl/privacy.

## Not offered

No OAuth 2.0 authorization server, no OAuth Protected Resource Metadata, no A2A agent card, no MCP server, no WebMCP tools, no outbound bots. If this changes, https://heydoc.nl/.well-known/api-catalog is updated first. Public content may be indexed and cited under the terms in https://heydoc.nl/ai-policy.txt and https://heydoc.nl/robots.txt (Content Signals: search=yes, ai-input=yes, ai-train=yes).

## Contact

Integration or accessibility questions: info@heydoc.nl. Security reports: https://heydoc.nl/.well-known/security.txt.