What this is: These are the words the proof pages use.
What you can do: Read the short meaning here. Dotted words on other pages open the same meaning. Fictional data only.
TEE means trusted execution environment. The summary runs on NEAR AI Cloud inside a verified TEE, and our server passes the selected text to it.
In this demo the server sees the plaintext chart for the TEE call. The lock covers the model run. It does not mean this demo's server never saw the chart.
An attestation is how you check which kind of server signed a result. Verification links out so you can read that statement.
This demo does not pin a measurement list. The signature kind you should see on a summary is provider_tee.
provider_tee is the mark on a sealed summary. Approve stays off until that mark is present.
The receipt carries hashes and this signature kind. It does not put the chart text on chain.
A receipt is the proof that comes back with a TEE summary or a stripped copy. You can read the model, the signature kind, and the hashes on Verification.
The same receipt hash can be stored on the contract. The chart text stays off chain.
The hospital asks the contract for a ticket, then this demo checks that ticket before it returns the chart.
A ticket expires quickly, and a used nonce cannot be replayed. Revoke makes the next open fail even if a ticket was requested.
Each open includes a nonce. The server remembers it for about two minutes and refuses a copy of the same request.
The nonce is not health data. It only stops a repeated open.
Revoke is an on-chain call. The next open is refused by the contract check, and that refusal is shown in the app. It is not written as a new transaction.
Revoke cannot erase a copy someone already downloaded or saved.
The contract stores ids and hashes, plus timestamps. A hash on chain is a fingerprint of a section, a purpose, or a receipt.
You can compare the hash you see in the app with the hash in the transaction. The chart text is not in that transaction.
Testnet is where this contract lives. Balances and transactions here are for practice.
This build is testnet only. It is not a live clinic system.
1 yoctoNEAR is the deposit on patient consent calls such as approve, decline, and revoke.
A function-call key cannot attach that deposit. The point is that a staff key cannot consent for the patient. The demo server account uses a fictional testnet key held by the demo server on testnet. A connected wallet can call self_register_patient on the live contract.
Clinic and hospital staff use a function-call key. It can call only the methods it was given, such as creating a referral or requesting an open.
It cannot approve a share for the patient, because that call needs a 1 yoctoNEAR deposit. PulseFit in this demo still uses a broader testnet key, and the route only lets it request an open.
Removing identifiers is best effort, with a preview. The pass strips common items such as name, date of birth, record number, address, phone, and calendar dates. Absolute dates become Day 0 or Day +14.
Read the preview before a stripped copy is sent. The pass may miss something. It is not a promise that the copy cannot be re-identified.
Designed around HIPAA principles. These definitions are not medical advice.