Question 1

Who can see my records by default?

Accepted Answer

Only you. Records belong to your patient identity; no provider has read access until you grant it. The grant is bound to a scope (record types or specific record IDs), a duration (default thirty days), and a purpose stated by the provider when they request it. When the grant expires, the provider's access ends; the expirer worker runs every five minutes to make sure nothing leaks past expiry.

Question 2

What happens to a session if I revoke a grant mid-session?

Accepted Answer

The session ends. The cascade releases the FastCredits hold the provider placed on session start so the provider is not charged for the interrupted session. The audit chain records the revoke, the session-end event, and the released hold. The provider can request a new grant; you can deny it. There is no quiet way for a session to keep reading after the grant is gone — that is the whole point of the architecture.

Question 3

Can a doctor break the glass and read my records without my consent?

Accepted Answer

Yes, but it is the loudest path through the system. Break-the-glass exists for the case where you cannot consent — unconscious in an emergency department, for example. The provider has to submit a reason between twenty and five hundred characters explaining why, name the record types they need, and proceed under the DCM 110127 (Emergency Override Started) audit code with purposeOfEvent ETREAT. Every emergency access is auto-flagged for DPO review within forty-eight hours by a worker that runs every five minutes against the active emergency-access table. Cost is zero in v1: the session ships pre-captured so no charge can become a deterrent against legitimate emergency access. You see the emergency access in your audit feed with the reason and a flag that the DPO is reviewing it.

Question 4

How long is my data kept?

Accepted Answer

Active records are retained as long as you maintain your account. Archived records are retained for seven years from creation per the medical-records retention obligation, then erased under NIST 800-88 crypto-erase semantics — the data-encryption key is destroyed, the ciphertext is unrecoverable. The audit chain is retained for seven years from each event independently. DSAR exports are retained for thirty days from download, then crypto-erased.

Question 5

How do I get a copy of my full record?

Accepted Answer

Request a DSAR export from your account settings. OneHealth assembles a FHIR R4 Bundle (type=collection) with your records as Observation resources, your documents as DocumentReference resources, your grants as Consent resources, your rectifications as Provenance resources, and your AuditEvent log as a sidecar NDJSON file. The whole thing is wrapped in a ZIP, the manifest is signed with Ed25519, and the public key is embedded so any consumer can verify the signature offline. The export is available to download for thirty days; after that, the DEK is destroyed and the blob is deleted.

Question 6

What does "hash-chained audit" actually mean?

Accepted Answer

Every audit row carries two hash columns — the hash of the previous row, and its own hash computed over the canonical JSON of its content. Tamper with any historical row and the chain breaks at that row; the integrity check fails and the row is exposed as edited. We use the same canonical-hash function for both the writer (OneHealth) and the verifier (the audit explorer plus the daily WORM export tool) so the check survives schema evolution. SHA-256 over canonical JSON is the underlying primitive.

Question 7

Can I correct or delete a record?

Accepted Answer

You can request a correction or an erasure under NDPA 2023 §35. The clinician who created the record reviews the request; if they agree, they emit a Provenance resource with role=revision pointing at the new record and an audit row records the rectification. Erasure follows NIST 800-88 crypto-erase: the per-record data-encryption key is destroyed, the ciphertext becomes unrecoverable. We do not delete the audit row that records the erasure — the seven-year retention applies to the act of erasing, not to the erased data itself.

Question 8

What if my phone is stolen?

Accepted Answer

Use any other signed-in device to call suspend-all on your grants — it is one transaction that flips every active grant to suspended at once. Every provider with an active session is severed within seconds. Then revoke the lost device's session from the active-sessions page in FastLogin. The audit chain records every step. When you replace the phone, you can re-enrol MFA and selectively reactivate the grants that were innocently in flight rather than starting from scratch.

Question 9

Can a family member see my record on my behalf?

Accepted Answer

Only with a grant. The patient-controlled model means the patient is the only default reader. If you want a family member to access your record — for example a guardian for a dependent, or a next-of-kin while you recover from surgery — you create a grant against their FastLogin identity for the scope and duration that makes sense. There is no separate "family" account that breaks the audit-chain mapping between credential and human.

Question 10

How is OneHealth different from a hospital EMR?

Accepted Answer

An EMR is the hospital's record of you. OneHealth is your record of your care across every hospital. The EMR is governed by hospital policy; OneHealth is governed by your consent. The EMR is bound to one institution's audit; OneHealth's audit follows you across every Fastclinic-connected provider. When you switch hospitals, the EMR data does not move; OneHealth does, because it was always yours. We expect OneHealth and hospital EMRs to coexist for years; the bridge is the partner-integration path that lands EMR-side records into OneHealth as the patient consents to it. The architectural difference shows up in incidents: when an EMR has a privacy breach, the hospital sends letters and you find out months later. When a OneHealth grant is misused, you see the read in your audit feed within minutes and you revoke the grant the same day. The blast radius of a single misused credential is one grant, not the whole hospital's patient population.

Question 11

Where does my data physically live?

Accepted Answer

On African data residency: a Nigerian-region AWS account that the Fastclinic Limited data controller (RC 1919428) operates. Records, documents, audit log, key wraps, and DSAR exports do not leave that region in normal operation. The Hydra issuer that signs your access tokens lives at fastlogin.fastclinic.xyz. The data-processing record names every processor; for OneHealth in normal operation, the list is short — Postgres, S3, KMS, all within the same region. The audit chain itself is double-anchored: the live chain in Postgres for low-latency reads, and a daily export to write-once-read-many S3 in the same region for tamper-evident long-term retention. The seven-year retention satisfies NDPA 2023 §40 records-of-processing obligations and the HIPAA Security Rule §164.308(a)(1)(ii)(D) audit-log retention requirement at the same time.

Question 12

Why are records encrypted with a per-record key, not one big key?

Accepted Answer

Because a single key compromise would expose every record at once. With per-record keys wrapped by a KMS master key, a single record's compromise means the loss of one key unwrap, not the data store. Key rotation rotates the master key on a configurable cadence (default ninety days) and re-wraps the per-record keys lazily on next read. The architectural decision is more work but it is what enterprise PHI deserves. The same primitive supports record-by-record erasure under NDPA 2023 §35 and HIPAA crypto-erase: destroying a single record's data-encryption key renders that record unrecoverable without touching any other record. We chose per-record keys before any of the regulatory motivation hardened, because it is the right primitive for any data layer that has to reason about deletion at the row level.

Title	Type	Date	Status
Annual physical · Dr. Adesina	Consultation note	2026-04-22	Active
Full blood count	Lab result	2026-04-21	Active
Amoxicillin 500mg · 7d	Prescription	2026-04-21	Active
Chest X-ray · CR	Imaging report	2026-03-14	Active
Hep-B booster	Immunization	2026-02-09	Active
BP 128/82 · Pulse 74	Vital signs	2026-04-22	Active
Ear-infection follow-up	Consultation summary	2025-11-30	Archived

When	Action	Actor	Origin
10:14	record.created	doorcta · system	service · ng-west-1
10:42	grant.created	patient · self	102.89.42.7 · Lagos
10:43	session.started	provider · g4f1	41.220.11.88 · Lagos
10:44	record.read	provider · g4f1	41.220.11.88 · Lagos
18:01	session.expired	system · expirer	—
yesterday	emergency.accessed	provider · BTG	10.0.4.21 · Abuja

Your records. Granted on your terms.

1 · See your records

2 · Open a record

3 · Receive a request

4 · See active grants

5 · Watch a session in progress

6 · Read the audit feed

7 · Export everything

Encrypted at rest, by default

Time-limited consent over every access

Audit feed you can read

FHIR R4 export, signed

Capabilities

Integrations

Compliance & safety

Plain answers

Take ownership of your health record.

Your records. Granted on your terms.

1 · See your records

2 · Open a record

3 · Receive a request

4 · See active grants

5 · Watch a session in progress

6 · Read the audit feed

7 · Export everything

Encrypted at rest, by default

Time-limited consent over every access

Audit feed you can read

FHIR R4 export, signed

Capabilities

Integrations

Compliance & safety

Plain answers

01Who can see my records by default?

02What happens to a session if I revoke a grant mid-session?

03Can a doctor break the glass and read my records without my consent?

04How long is my data kept?

05How do I get a copy of my full record?

06What does "hash-chained audit" actually mean?

07Can I correct or delete a record?

08What if my phone is stolen?

09Can a family member see my record on my behalf?

10How is OneHealth different from a hospital EMR?

11Where does my data physically live?

12Why are records encrypted with a per-record key, not one big key?

Take ownership of your health record.