Technical FAQ

Yes. IntaOps is designed with Privacy by Design as its core principle. We comply with the NDPA (2023) and the NDPR (2019) by ensuring that the patient (the Data Subject) remains the ultimate authority over their personal health information. Our platform facilitates the lawful basis of "Consent" and "Contractual Necessity" for data processing.

IntaOps does not maintain a centralized "honeypot" database of medical records. Instead, we use a Decentralized Storage Model.

• At Rest: Data remains in a secure, encrypted decentralized node.
• At Work: We only store the "Pointer" and the "Cryptographic Hash" of the data on the ledger. This means that even if IntaOps were compromised, no medical data could be read because we don't hold the keys.

We move beyond "implied consent" to Active, Granular Consent.

• Every time an entity or doctor requests access, the patient receives a push notification.
• Access is granted via a Biometric Handshake.
• This creates a timestamped, immutable record of consent that is fully audit-ready for NDPR compliance.

We implement a multi-layered security stack:

• End-to-End Encryption (E2EE): Data is encrypted at the source and only decrypted on the authorized recipient's device.
• Zero-Knowledge Architecture: Our servers facilitate the exchange without ever "seeing" the plain text data.
• Identity Anchoring: We use W3C-compliant Decentralized Identifiers (DIDs). Unlike traditional usernames/passwords, DIDs are resistant to phishing.

IntaOps provides a Verifiable Audit Trail. Every interaction from patient check-in to lab result issuance is recorded as a "Verifiable Credential." When an HMO audits a claim, they aren't looking at a PDF that could be photoshopped; they are verifying a digital signature that is mathematically linked to a specific biometric event.

Yes. While the ledger record of a transaction is immutable (for audit purposes), the access to the underlying personal data can be revoked by the user at any time. Once a user revokes a "Secret Key," the data remains encrypted and unreadable to all previous parties, effectively fulfilling the right to erasure.

Because your health records and verifiable credentials (international passport, driver's license, etc.) are encrypted so that only you hold the key, there is a deliberate trade-off: we cannot reset or recover that key for you. This is what makes it truly zero-knowledge. If IntaOps could recover it, so could an attacker who breached IntaOps.

• At setup you receive a one-time recovery phrase. Write it down and keep it offline and private. It is the only way to restore access on a new device.
• If you lose both your device and your recovery phrase, the encrypted health records and verifiable credentials cannot be recovered by anyone, including us.
• Never share your recovery phrase. IntaOps staff will never ask you for it.

We separate data by sensitivity so that identity and payment products keep working while your most sensitive records stay end-to-end encrypted:

• Health records and verifiable credentials (international passport, driver's license, etc.) are end-to-end encrypted stored as ciphertext our servers can never read, and unlocked only by you or the parties you explicitly share with.
• Your name, and contact remain accessible to the platform for KYC, verification and payment features to work as expected.
• Sharing is consent-driven: granting access lets a recipient decrypt what you shared; revoking stops future access, though it cannot un-see data already opened.

As part of our partnership, we provide our partners with a Technical Compliance Package. This includes:

• Documentation of our security protocols
• Data flow maps
• Risk mitigation strategies to support your organization's annual NDPR audit filings