Patients update consent in the Patient Portal. The Consent Service stores the decision; the de-identification pipeline excludes withdrawn records on the next dataset refresh.