8 safeguards for medical information

We follow the MIC/METI guideline for service providers; clinics assess us under the MHLW guideline (v6.0).

Data residency

Japan regions only (Tokyo + Osaka) in production, including backups.

Encryption

TLS 1.2+. Data at rest encrypted with per-clinic keys (AES-256-GCM).

Auth & roles

Mandatory TOTP MFA; owner/admin/front-desk/view-only roles.

Identity check

SMS code + DOB, expiring links, attempt lockout.

Integrity

Originals are write-once during retention; SHA-256 tamper detection.

Audit trail

Every view/send/download/change logged; the log itself is hash-chained.

Availability

Multi-AZ, daily backups, runbooks, yearly restore drills (production design).

External testing

Third-party penetration test before production launch.

About this demo deployment

This demo runs on a Hugging Face Space. Infrastructure requirements (Japan region, multi-AZ, S3 Object Lock) are met in the production AWS design; encryption, tenant isolation, RBAC, audit logs and tamper detection are implemented in the app.