Demo · synthetic data · substrate-shape illustration
This is what a substrate-built healthtech product looks like when running. UI is realistic; data is synthetic; click-throughs don't navigate. To see how this product was built, return to /build.
Active patients
8,142
across 4 clinics · all PHI encrypted-at-rest
Appointments today
247
184 complete · 51 scheduled · 12 no-show
PHI accesses · 24h
1,892
100% logged · 0 unauthorised attempts
Patient export requests
3
GDPR Art. 20 · FHIR R4 · all fulfilled <72h
Recent PHI accesses · last 8
| Time | Clinic | User | Patient | Action | Status |
|---|---|---|---|---|---|
| 12:47:11 | north-clinic | dr.amelia@nc | pt_4f29a1... | view record | approved |
| 12:46:48 | south-clinic | nurse.kai@sc | pt_8b03d5... | schedule appt | approved |
| 12:46:22 | north-clinic | dr.amelia@nc | pt_2c7e90... | update note | approved |
| 12:45:53 | east-clinic | admin.luc@ec | pt_a01d44... | export record | approved |
| 12:45:11 | south-clinic | nurse.kai@sc | pt_b29f17... | view record | approved |
| 12:44:32 | west-clinic | intern.mo@wc | pt_9d3a48... | view record | rejected |
| 12:43:47 | north-clinic | dr.amelia@nc | pt_5c2e88... | create record | approved |
| 12:43:09 | east-clinic | admin.luc@ec | pt_8e7c03... | view audit log | approved |
Audit trail · last 6 events
tamper-evident · GDPR Art. 30 compliant by construction- 12:47:11dr.amelia@ncviewed patient record pt_4f29a1 · category=consultation_notes · role=doctor
- 12:47:11role-gateauthz check passed role=doctor ∈ ["nurse","doctor","admin"]
- 12:46:48tenant-gateisolation check passed clinic_id=south-clinic matches session.clinic
- 12:45:53admin.luc@ecexported patient record (GDPR Art. 20) pt_a01d44 · format=FHIR R4 · DPA-attested
- 12:44:32role-gateREJECTED — incorrect role role=intern not authorized for category=consultation_notes
- 12:43:09admin.luc@ecviewed access log (all PHI accesses for clinic) clinic_id=east-clinic · range=last 7d · GDPR Art. 30
● 8 corpus-derived tests passing
§47.6 / §65.1 / §66 · provenance per testBelow: a slice of the test stubs the substrate injected into this product based on its §66 fingerprint. Each traces back to a corpus signature with full audit chain visible at /evidence.
- ✓
expect-chain_no_phi_in_response.test.ts
↳ expect-chain|response.body.not.includes("phi") · CWE-200 · CVE-2024-30180 · info-exposure · §47.6 strength-2
- ✓
user_role_authorized.test.ts
↳ expect-chain|user.role.is_authorized_for(record) · CWE-862 · CVE-2024-12100 · §47.6 strength-2 · Wire 4 fired
- ✓
role_membership_check.test.ts
↳ !membership|user.role|["nurse","doctor","admin"] · CWE-863 · universal · 28 repos · authz patterns
- ✓
regex-match_xss_clinical_html.test.ts
↳ regex-match|html_output_clinical|escaped · CWE-79 · §47.6 strength-3 jackpot · all three streams
- ✓
csrf_token_verified.test.ts
↳ expect-chain|csrf_token.verified · CWE-352 · universal · 23 repos · auth-libs
- ✓
membership_path_traversal_dicom.test.ts
↳ !membership|file_path.contains("..") · CWE-22 · CVE-2023-39418 · §65.1 rising-CWE · Wire 2 fired
- ✓
patient_dob_encrypted.test.ts
↳ expect-chain|patient.dob_encrypted.is_encrypted() · data-protection · GDPR Art. 32 · §47.6 strength-2 · fix-commit corpus
- ✓
unauthorized_role_throws.test.ts
↳ throws|<<UnauthorizedRoleError>> · multi-tenant · universal · 46 repos · auth-libs