Privacy Architecture

1. Why this matters

A public blockchain like Stellar is permanent, immutable, and accessible worldwide. Anything committed to it remains there indefinitely. Medical diagnoses, patient names, and health records do not belong on a public ledger. Attempts to store encrypted medical records on-chain risk eventual exposure through cryptographic advances, metadata correlation, or key leaks.

SCI Healthcare takes a structural approach: rather than encrypting sensitive health records on chain, we ensure that sensitive data never enters the system in the first place.

2. What is written on chain (The Stellar ledger)

Each care voucher is managed by open-source smart contracts on the Stellar network. The on-chain voucher record contains only the minimum parameters required for financial escrow and delivery confirmation:

3. What is never on chain

• Patient names, dates of birth, national ID numbers, and phone numbers.
• Residential addresses or clinic room numbers.
• Diagnoses, test results, prescription details, or clinical notes.
• Free-text input fields of any kind.

4. What stays on your device

To link vouchers to a patient without exposing who they are, the application derives a beneficiary reference entirely within your browser using standard Web Crypto primitives:

• Browser execution: Calculated locally via crypto.subtle.sign. Neither the plaintext patient identifier (such as a clinic card number) nor the secret key is ever sent across the network.
• HMAC vs. plain hashing: A bare hash (like SHA-256 on a phone number) can be reverse-engineered by brute-force dictionaries. An HMAC keyed with a secret key cannot be searched or reversed by anyone without that secret key.
• Optional local storage: If you choose to save credentials in the UI, they reside strictly in your browser's localStorage. Private browsing or clearing browser data removes them immediately.
• Non-custodial key handling: The app never requests or handles your wallet's private key or seed phrase. All transaction signatures occur inside your Stellar wallet extension (such as Freighter).
• Installable app and offline shell: The app can be installed on a phone and keeps the interface it needs to open without a connection — the page frame, its icons and its build output — in the browser's cache. Never cached: any answer from the API or RPC, any voucher, and any patient reference, so the offline copy carries no health information. Your low-data preference and tour progress are small flags in localStorage; clearing site data removes both those and the cached shell.

5. What the API and indexer store

The backend API functions solely as a read-model cache and indexer for the blockchain events emitted by the contracts.

The database contains nothing that is not already public on the Stellar ledger. If the backend database were ever compromised, an attacker would obtain only a duplicate of the public ledger—never private medical records or personal identities.

6. Analytics and error reporting safeguards

Our operational monitoring is engineered to prevent accidental leaks:

• Cookieless usage analytics (Plausible): All URL paths are normalized (e.g., recorded as /clinics/[address] and /vouchers/[id]) so specific addresses or IDs never enter analytics. Event tracking transmits names only, without amounts or references.
• Scrubbed error reports (Sentry): An automatic beforeSend scrubber redacts all 64-character hex strings, Stellar addresses, and sensitive URL query parameters. Session replay and user tracking remain completely disabled.

7. Honest limitations: Pseudonymity vs. Anonymity

We believe in honest guarantees rather than false reassurance:

• Known keyholder verification: Anyone who already knows both the patient identifier and the secret key can compute the digest and verify which vouchers belong to that patient.
• Funder address correlation: If a funder uses the same Stellar wallet for all donations, public block explorers can link those funding activities together.
• Physical observation: An observer watching a patient enter a specific clinic at a specific time can correlate that physical visit with a timestamped on-chain claim.

SCI Healthcare offers rigorous cryptographic pseudonymity and zero-PHI escrow. For further technical details, read the Protocol Privacy Specification.