A consent form and a pre-procedure image may concern the same client yet remain in different places across a clinic. That fragmentation makes retrieval depend on individual memory and leaves access decisions unclear. Connecting both items to fields on a Zoho record creates one shared gateway. Record access, field permissions, and data-transfer restrictions remain separate controls, and none automatically completes the others.
A sound design first decides which record will hold each document. It then addresses who may see that record, which profiles may open particular fields, and which channels may carry sensitive data. Encryption, deletion, and legal assessment are separate parts of the same design. The form and image can meet in one file without blurring the boundary of each control.
Why consent forms remain on phones
The signed consent sheet remains in the room, the pre-procedure photograph stays on a phone, and the client record sits in the system. One employee's memory is often the only connection among them. When that person takes leave, the folder cannot be found, the photograph must be matched again, and routine work becomes an exercise in reconstructing scattered pieces.
The problem is not limited to storage location. The team must also determine which copy is authoritative and which procedure record belongs with the image. When content is divided among a phone, paper, and the system, the underlying access decision disappears from view. Permissions cannot rest on solid ground until the organisation defines a clear record context for the files.
Connect documents to the record
Zoho limits file and image upload fields per module by edition. Standard allows two, Professional five, Enterprise ten, and Ultimate fifteen. Free has no custom fields. Each file can be up to 20 MB and is scanned for viruses before acceptance. These limits shape the document structure before a team starts adding separate fields for forms and pre-procedure images.
An image field accepts up to ten images in one upload and supports jpg, png, jpeg, gif, and bmp. Attachments and notes inherit accessibility from their parent record. Adding an attachment or note requires read access, or read and write access, to that record. Connecting a document to the record therefore does not create an independent island of access.
Access follows the record
A user can see a record when they own it, sit above its owner in the hierarchy, cover its territory, or receive access through a sharing rule. Access to the consent form and image consequently begins with the people who can see the client record. The attachment should not be treated as having a second, independent ownership structure.
There are four documented ways to give access to a clinician or adviser outside the owner's hierarchy. A user field pointing to that person can carry a record access level, or the record can be shared individually. A data-sharing rule or territory management can also provide access. Each module allows up to five single-user fields and one multi-user field under this setup.
Restrict the field by profile
Seeing the record does not mean seeing every field it contains. Field-level permission offers Read & Write, Read Only, and Don't Show. It is assigned by profile, is not specific to a layout, and applies across every layout in the module. This distinction is available in Professional and higher editions, but it is absent from Standard.
Two fields sit side by side on the record. The adviser uploads a file to the first field, which that profile permits, and can see it. Because the second field is set to Don't Show for that profile, another authorized profile uploads its file; the adviser cannot see the field or file. This permission decision is made before either upload. Zoho field permissions are configured under Field Permission in Setup > Customization > Modules and Fields. This control sits on top of record access rather than replacing it.
What health-data marking restricts
Personal fields can be marked Normal or Sensitive, with up to thirty marked fields per module. Auto Number, Formula, User, and Lookup fields cannot be marked, nor can First Name or Last Name. The documented effect is to restrict data movement through four channels: export, API access, transfer to Zoho applications, and transfer to third parties.
HIPAA settings allow up to ten selected modules and up to twenty-five fields marked as personal health data in each module. File Upload and Image Upload are supported, while Lookup, multi-select lookup, and auto number are not. The framework is limited to Leads, Contacts, Vendors, and custom modules. Team modules, Deals, and Accounts are outside this list. An in-scope institution separately signs a Business Associate Agreement with Zoho; that obligation is distinct from the technical setting.
Encryption and deletion answer different questions
Attachments are encrypted by default as soon as they enter CRM. Encryption is available in standard modules other than Tasks, Calls, and Meetings, as well as in custom modules. A field marked unique cannot also be encrypted. Global search supports only exact-text matching for encrypted fields. These properties remain separate from record and field permissions that determine visibility.
Deleting a record does not immediately remove it permanently. The record remains in the recycle bin for sixty days and is permanently deleted only after that period; attachments follow the same sixty-day path. The product does not provide an automatic record-level retention-period setting. Encryption and lifecycle decisions should therefore be treated as distinct questions in the document design.
Separate product controls from legal assessment
Enabling GDPR or HIPAA settings in Zoho does not itself establish an organisation's legal compliance. The product documentation says these sections are not legal advice and directs compliance questions to the organisation's legal counsel. No conclusion about compliance with Turkish law can be drawn from the settings. The explainable technical scope is limited to marked fields and restricted transfer channels.
The edition plan also needs explicit boundaries. Upload fields number two in Standard, five in Professional, ten in Enterprise, and fifteen in Ultimate; Free has no custom fields. Field permissions start with Professional, while territory management starts with Enterprise. The edition threshold for compliance settings remains unknown and needs verification in Setup. Personal-field and HIPAA marking require Manage Compliance Settings permission.
Questions to resolve before configuration
Unresolved points should remain questions before configuration: Can a file upload field be used in custom-view criteria or reports? Which editions expose the HIPAA and GDPR tabs? Can file and image fields be created in the Appointments module, and can that module be selected for HIPAA? Does Don't Show affect access to the file through the API or export?
The retention period for the audit log also remains unwritten until verified. The onam-kvkk and hasta-kabul patterns in the Clinical CRM Pattern Library are the relevant visual references for this topic. They are not published on eksenium.com or represented as live in a clinic or used with real patient data.
