It reads the most sensitive data a person has, then acts for them
Both halves of that sentence carry an obligation. These are the six principles the architecture is held to, and the frameworks it is built to evidence.
Keep the least you can
Rules run on features, not waveforms. Raw signal stays on the device unless a rule or a clinician explicitly requests it, and it expires on a schedule you set.
Consent is a live object
What each rule may read, who may see it and for how long is recorded per wearer and can be withdrawn. Withdrawal disables the dependent rules immediately.
Encrypted end to end
Device to gateway to orchestrator over mutually authenticated TLS, with per-workload identity issued by SPIFFE/SPIRE. Keys live in the secure element.
Prove who answered
Approvals are bound to a FIDO2 authenticator, so a released action names a person and a device, not a shared login on a ward tablet.
An append-only ledger
Signal window, rule version, score, responder, answer, latency and outcome: written once, hash-chained, exportable for an investigation years later.
Ready for the key change
Long-lived records and firmware signing move to post-quantum algorithms on a published schedule, with hybrid certificates during the transition.
Built so a claim can be evidenced, not asserted
| Framework | Applies to | How BioFlow addresses it |
|---|---|---|
| HIPAA | US healthcare deployments | Role-scoped access, encryption at rest and in transit, full disclosure logging |
| GDPR / DPDP | EU and India | Purpose limitation per rule, withdrawal of consent, data residency by tenant |
| FHIR R4 | Clinical interoperability | Observations and flags written to the patient record in a native format |
| IEC 62304 | Medical device software | Documented lifecycle for the classifier and rule engine components |
| ISO 27001 | Information security management | Control set mapped to platform operations and vendor access |
| OPC-UA | Industrial integration | Actions dispatched to plant systems without a bespoke bridge |
Certification status varies by deployment and jurisdiction. Ask for the current attestation pack for your region during a pilot scoping call.
Start with one ward, one shift, or one squad
A pilot runs four to sixteen weeks depending on deployment model. You bring the population and the responders. We bring devices, gateways and the first set of rules, and we measure override rate and time-to-answer from day one.