Not affiliated with Certinal.

Data Fiduciary
Kestrova Health · Hyderabad cluster (fictional)
Overview

Synthetic tenant: Kestrova Health (fictional), 442 receipts. Sixty days of activity are generated deterministically and anchored to the current hour, so expiry and breach clocks are live. Every receipt is signed at load with Ed25519 key ksv-47c7d4987f3a and re-verified by the same code the public verify API runs. Consents you sign in the patient journeys appear at the top of the registry, held only in your browser.

Consent evidence overview

Every number below is computed from the 442 receipts in the registry on this page load. Nothing is typed in.

Receipts verified
435 / 442
6 paper imports unsigned · 1 changed after signing
Withdrawals propagated
33 / 44
7 in progress · 4 outside the 48h window
Next breach deadline
2h 15m
INC-2026-031: Report to CERT-In
DPDP readiness
98%
Seven controls, derivation below

Latest receipts

Full registry

DPDP readiness 98%: how it is computed

Weighted sum of seven controls; weights total 100.

Sec 6(1)Consent bound to an identity check at the required assuranceFrom the registry99% × 20

436 of 442 receipts with a grant meet the assurance level their pathway and purposes require.

6 fall short (6 of them unsigned paper imports at L0): re-consent at the next visit.

Sec 5 · Rule 3Each receipt names the exact notice version and language it was shownRecomputed now99% × 15

436 of 442 receipts carry a notice hash that matches a published notice when re-hashed now (16 notice variants checked).

6 cite no published notice: paper forms whose wording cannot be proven.

Sec 6(1) informedTeach-back evidence on high-risk inpatient grantsFrom the registry100% × 15

19 of 19 inpatient receipts granting treatment or lab sharing carry a server-graded teach-back (15 graded by the live model, 4 by the rubric).

Sec 8(5)Every receipt verifies: content re-hashed, signature checkedRecomputed now98% × 20

435 of 442 receipts re-hashed and signature-checked with Ed25519 just now. 6 unsigned paper imports. 1 whose content changed after signing.

Open an integrity investigation for each changed receipt; the signed original is the record of truth.

Sec 6(4) · 6(6)Withdrawals acknowledged by every processor within 48hFrom the registry89% × 15

44 withdrawals: 33 fully acknowledged in time, 7 still inside the window, 4 outside it.

Slowest processor: Partner-offers network (4 late). The 48h window is internal policy for "a reasonable time".

Sec 8(6) · Rule 7Breach clocks met: CERT-In 6h, Board and patients without delay, report in 72hFrom the registry100% × 10

9 of 9 breach clocks met or still running across 3 incidents.

Rule 6 logsAudit trail is hash-chained and intactRecomputed now100% × 5

566 events re-chained just now; head 70e25ad3ec9a.

Receipts by pathway (60 days)

  • Video teleconsultation (Tier A · inline)101
  • E-pharmacy order (Tier A · inline)63
  • OPD visit (Tier B · quick)253
  • Inpatient admission (Tier C · ceremony)19

Digital captures only; the 6 unsigned paper imports are counted in the registry, not here.

Opt-in rate, optional purposes

From verified receipts only.

  • Insurance and TPA sharing74% n=19
  • Lab test referral50% n=101
  • Updates to family contact50% n=271
  • Appointment and refill reminders60% n=252
  • Health tips and seasonal alerts43% n=252
  • Partner offers (insurance, pharmacy)19% n=252
Copy test and value model

Identity assurance and language

  • L0 · Paper, unverified6
  • L1 · OTP or app session417
  • L2 · ABHA or witnessed OTP15
  • L3 · Voice + OTP2
  • L4 · Passport + liveness2
हिन्दी 107తెలుగు 135English 191தமிழ் 9

Hindi, Tamil and Telugu copy is machine-translated in this demo.

What is real and what is simulated

Real Simulated in the demo Not built
  • Signed consent receipts

    Ed25519 · key ksv-47c7d4987f3a

    Ed25519 key derived from a deployment secret. Production would hold a per-hospital key in an HSM or cloud KMS. The public key is published, so anyone can verify a receipt offline.

  • Tamper detection

    Re-hash, then signature check

    Every verification recomputes the hash from the stored content first, so an edited receipt fails even when its stored hash and signature were never changed.

  • Server-bound evidence

    Identity and teach-back tokens

    The server signs only identity and comprehension facts it established itself, carried in 10-minute session-bound tokens.

  • Live AI

    Teach-back, drafting, second opinion

    Teach-back grading and advisory triage use Claude Haiku 4.5; Board and patient drafts use Claude Sonnet 4.5. Every call is inside a site-wide daily budget; past it, the deterministic engine runs and says so.

  • Legal clocks and duties

    Deterministic rules

    Board and patient intimation, the 72-hour report and the CERT-In 6-hour clock are computed by rules. No model decides a legal duty.

  • Withdrawal cascade

    Signed notices; processors simulated

    Each withdrawal is a signed event with one cease-processing notice per processor. The processors and their acknowledgements are simulated.

  • Identity providers

    OTP, ABHA and voice simulated

    No SMS is sent and the demo code is 123456. ABHA linkage and voice match are simulated and recorded as such; face liveness runs on the device.

  • Hospital data

    Synthetic tenant

    Kestrova Health, its patients, processors and incidents are fictional. Receipts you sign live only in your browser.

  • ABDM consent manager (HIE-CM) bridge

    Roadmap

    Designed for, not built in this version.

  • HIS/EMR write-back (FHIR export only)

    Roadmap

    Designed for, not built in this version.

  • Real SMS OTP and ABHA verification

    Roadmap

    Designed for, not built in this version.

  • Board and CERT-In e-filing

    Roadmap

    Designed for, not built in this version.