01 / SOLHEA
Organizational data for defined purposes
Technical identifiers, necessary contacts, Facility, event, activities, deadlines and audit form the operational minimum. Diagnoses, medical histories, reports, tests and diagnostic images remain outside scope. There is no clinical document repository.
02 / SOLHEA
Verified access and isolation
Staff uses OIDC/OAuth2 and RBAC. The server verifies Organization/Facility scopes. Patient uses secure links and OTPs, short-lived tokens and Journey-scoped access. Security tests cover tenant isolation, cross-facility access and privilege escalation.
03 / SOLHEA
Checks throughout development
CI includes backend/frontend tests, E2E, accessibility, SAST, dependency analysis and scans. Versioned migrations, secret management, minimized communications and logs without tokens or sensitive content support controlled releases. TLS and infrastructure protections must be configured for the environment.
04 / SOLHEA
Before a real pilot
Privacy assessments/DPIAs where applicable, DPAs, retention and notices require agreements and approval. Monitoring, encrypted backups, tested restores, incident response, penetration testing and RPO/RTO are operational gates to complete, not checks already concluded.