Best way to smoothly onboard whilst adhering to text message laws

Our team have just discovered the harsh laws surrounding the opt-in/opt-out for receiving promotional SMSs.

Our current workflow is this (we are a prescription management application):

  1. User sees the doctor for the first time
  2. Doctor recommends the app to the user
  3. Doctor sends prescription to the app through his software (API)

4. User receives an SMS notifying them they have a new prescription and to download the app to view

  1. User sends prescription to a pharmacy etc

As you can see at point 4, there was no prior permission given by the user to opt-in for SMS messages from our company. We have 2 possible options

  1. Use a chatbot style to begin and make the patient begin the onboarding flow e.g Send the word 'Start' to 1800 400 400 to receive your prescription and a download link for the app. The user then receives an SMS which outlines if they have a prescription or not and flags for the permissions then.
  2. Use a QR code on a pamphlet and takes them to a webpage which asks for their permission to use SMS and a link to download the app.

Has anyone been through this conundrum before?