Consent is part of the query, not a promise
This is the difference that matters, and it is worth being precise about. In most tools, "only send to people who consented" is a filter somebody remembered to apply, or a claim in a settings screen.
Here, the audience is defined as patients who agreed to marketing email and have an email address. That condition is part of how the audience is worked out, not a box on top of it. There is no setting that adds anyone else, and no import path that bypasses it, because the list is never exported and rebuilt somewhere else in the first place. Consent is recorded with its time and source when the patient gives it, as described in lead management.