The ones a practice actually asks.

A consent form records that someone signed something. A comprehension record says what they were shown, in which version and which language, what they answered — including the answers that were wrong — what was explained again, and whether it landed the second time.

Candour produces the second thing. It supports the consent discussion you have at the chair and it never replaces it. What it is not, and does not become, is a consent form.

Yes. Nothing about this removes a minute of the conversation at the chair — it changes what is written down about it.

What tends to happen in practice is that the conversation becomes better targeted, because you can see which concept the patient got wrong before you start talking rather than afterwards.

Montgomery v Lanarkshire Health Board [2015] UKSC 11 is the Supreme Court decision that changed how English and Scottish law judges whether a patient was told enough before treatment.

Before it, that question was answered largely by asking what a responsible body of doctors would have disclosed. If your peers would not have mentioned a risk, not mentioning it was generally defensible.

After it, the question is about the patient rather than the profession: were they told about the risks a reasonable person in their position would think significant, and about anything this particular patient would obviously think significant if you know — or ought to know — that about them.

The practical shift is that two people having the same treatment can need two different conversations. A small risk of lip numbness is a footnote for most people and the whole decision for someone who plays a wind instrument for a living. A risk of a few days off work reads differently to someone who is self-employed. What a patient does for a living, what they have told you they are worried about, and anything in their history that changes the weight of a risk are all part of it.

For a practice, the consequence is about records rather than about paperwork volume. A signed form that is identical for every patient having that treatment does not show that this conversation was tailored to this person — because it is the same form either way.

Candour’s part in that is narrow and worth stating plainly: the clinician marks what they judge material to this patient and writes why in their own words, that risk is then always tested, and both the reasoning and the answer are sealed into the record. Whether the discussion itself was adequate is a clinical judgement and stays one — no software makes that judgement, and this one does not claim to.

The concept is explained again, in different words, and then asked again with different wording from a held-back question. Both attempts stay in the record — a concept passed second time is a different record from one passed first time, and flattening the two would be losing the only interesting part.

If it is still wrong after that, it is flagged as a gap and handed to the clinician. Treatment is not stopped, and the gap does not disappear.

A refusal is recorded as a refusal, with its reason, and the session continues. Someone who cannot read the screen, cannot use the tablet, or simply does not want to has not done anything wrong, and a record that treated it as a failure would be a record nobody would use twice.

Where capacity is genuinely in doubt, that is a different route rather than a worse score — see the capacity question below.

Five routes, chosen from the patient’s age and the clinician’s assessment rather than from a checkbox. Under 13, a person with parental responsibility completes it. Between 13 and 15, the clinician assesses Gillick competence and the answer decides who answers. At 16 and over, an adult for these purposes.

Where an adult’s capacity is in doubt, the Mental Capacity Act two-stage test is recorded — whether there is an impairment, and whether it stops this particular decision being made — along with the support that was offered. Where capacity is absent, what is recorded is a best-interests decision naming who was consulted, because that is what it is, and calling it consent would be wrong.

Each sealed record stores a hash of its own contents and the hash of the record before it. Verification recomputes both and checks the positions run in order.

So: alter a record and leave its hash, and the recomputation disagrees. Alter both together, and the next record’s link no longer matches. Remove one, and the sequence has a hole in it.

What it does not prove: someone able to rewrite every row from the altered record to the end of the chain could produce a chain that verifies. That is what tamper-evident means, and it is not the same as tamper-proof. Whether any of it is worth anything in a dispute is not a question a supplier gets to answer.

English, Urdu, Punjabi, Polish, Romanian, Bengali.

A translation is an overlay on your own template, keyed to your own questions, so the record, the flags and the chain entry are identical whichever language was used. A clinician who reads the language has to approve the translation before a session can run in it, and the database refuses the session if they have not — the same posture the product takes towards any content a clinician has not read.

Where the system has an API that permits it, yes: the appointment, the planned treatment, the tooth and the diagnosis come across, and one note goes back into the patient’s notes pointing at the record.

Most of the UK dental market runs systems with no usable public API. For those, CSV import is the integration rather than a fallback, and the console tells you which of the two you have instead of offering a button that always fails.

Staff at the practice the record belongs to, under role-based access. A practice manager in a group never sees another practice’s patients; a group owner sees across sites.

That separation is row-level security in the database rather than a filter in application code, so a query that forgets to narrow by practice returns nothing instead of returning someone else’s patients.

Not emptied, no. A deletion request produces a redaction with a logged reason, keeping the audit shell and the hash — the chain is append-only by design, which is exactly why it can detect a change, and which is also why erasure works this way rather than the obvious way.

That tension is real and it belongs in a practice’s data protection impact assessment rather than in a marketing sentence.

Not yet. No explainer, risk statement or comprehension question in the library has been reviewed by a registered clinician, and that is the single largest outstanding item before any real patient is involved.

The product refuses to show unverified content to a patient — the gate is enforced in the database, not in the interface — but a gate can only stop unreviewed content from being shown. It cannot judge whether reviewed content is correct. The compliance page lists this and the rest of what is outstanding.

Nothing is published, because nothing is decided. The pricing page sets out the two shapes under consideration, what will never be metered, and what happens to your records if you stop paying — which is the part worth reading before the number exists.