Not affiliated with Certinal.

Overview

Technical view

Architecture

Capture, evidence and enforcement, plus the integrations a hospital deployment needs. Each component says whether it is built, built with a simulated provider behind it, or on the roadmap.

1. Capture

Where the patient sees a notice and decides

  • Built

    Purpose and notice catalogue

    Purposes, pathways and versioned Rule 3 notices in four languages; every notice version is hashed. Hindi, Tamil and Telugu are machine-translated.

  • Built

    Tiered capture

    Inline (Tier A), one-screen (Tier B) and ceremony (Tier C) flows, matched to risk, all producing the same receipt.

  • Built, provider simulated

    Identity evidence

    Server-issued, session-bound identity tokens (built). The OTP, ABHA and voice providers behind them are simulated; face liveness runs on the device.

  • Built

    Teach-back grading

    A model grades the patient’s own words within a daily budget; a labelled rubric grades otherwise. The grade reaches the receipt only through a server token.

2. Evidence

What makes a consent provable

  • Built

    Receipt signer

    SHA-256 over canonical JSON, Ed25519 signature, key id. Public key published as JWKS for offline verification.

  • Built

    Verifier

    Re-hashes stored content, then checks the signature: verified, content changed, signature mismatch, unsigned legacy, or unknown key.

  • Built

    Hash-chained audit trail

    Every issue, withdrawal, acknowledgement and breach milestone chained by hash and re-checked on load. Production: an append-only table with update and delete blocked by trigger.

  • Built

    FHIR R4 Consent export

    Each receipt maps to a Consent resource with a permit or deny provision per purpose; status goes inactive when nothing granted remains in force.

3. Enforcement

Where the DPO acts

  • Built

    Withdrawal cascade

    A signed event per withdrawal with cease-processing notices to each processor and an acknowledgement clock. The processors are simulated.

  • Built

    Breach command

    Rule-matrix severity and duties; CERT-In 6h, Board and patient intimation, and the 72h report as live clocks. AI drafts and advises within budget.

  • Built

    Readiness and audit pack

    Seven DPDP controls computed from the registry, and a PDF that re-verifies every receipt in the period when it is generated.

  • Built

    Consent yield

    Opt-in by purpose and server-assigned copy arm, with confidence intervals and a chain-scale value model.

4. Integrations

The hospital and national stack

  • Roadmap

    HIS / EMR

    FHIR export is built; write-back of consent status onto the encounter is the first integration to build.

  • Roadmap

    ABDM consent manager

    Interoperate with the NHA Health Information Exchange consent manager for record-sharing consents; not built.

  • Roadmap

    Key custody

    Per-hospital signing keys in an HSM or cloud KMS with rotation and a key history in the JWKS; the demo derives its key from a deployment secret.

  • Roadmap

    Board and CERT-In filing

    Drafts are generated today; electronic filing is not built.

Design decisions that carry the weight

  • Asymmetric signatures, not a shared secret. A regulator or insurer verifies a receipt with the public key; nobody has to trust, or be given access to, the hospital's systems.
  • The server signs only what it established. Identity level and teach-back score arrive as short-lived server tokens bound to the session; anything the browser asserts is ignored.
  • Append, never edit. Withdrawal and renewal are new signed events that reference the receipt by hash, so history cannot be quietly rewritten.
  • Rules decide, models assist. Legal duties, clocks and severity are deterministic; models grade comprehension and draft text inside a daily spend ceiling, and every output is schema-checked.