Onset SHIELD Controls

Onset Clinic uses a SHIELD-style privacy posture for practitioner data sharing: patient control, granular consent, revocation, audit visibility, portability, and least-privilege access.

Patient connection codes (three code types)

Onset uses three different codes. They are not interchangeable.

Code	Storage	Issued when	Used in the app
Connection code	practitioner_patients.connection_code	Clinic adds a patient (one code per invite row)	More → My Practitioner — links this patient to this practitioner
Clinic code	clinics.clinic_code	Clinic signup	More → Share with Provider — patient-initiated data sharing with the clinic (requires Sign in with Apple)
Affiliate shortcode	clinics.affiliate_shortcode	Dashboard setting	App Store / protocol attribution only — not for practitioner linking

Connection codes are per patient, not per clinic. A clinic should only share a connection code after adding that patient in the portal. New codes are 16 hex characters (64-bit entropy); older 8-character codes remain valid.

Shipped Controls

• Patient control: practitioner connections are claimed from the Onset app with authenticated RPCs. Clinic users cannot link an app account on behalf of a patient.
• Connection code abuse protection: find_practitioner_connection and claim_practitioner_connection enforce per-user attempt limits (20 attempts per 15-minute window) via connection_code_attempts.
• Granular consent: adherence, lab, and check-in sharing are separate patient-controlled flags. Changes are recorded in practitioner_consent_events.
• Immediate revocation: disconnect deletes clinic-facing assignments and shared clinic copies while retaining minimal audit/consent records.
• Audit visibility: provider reads and clinic mutations are recorded in provider_access_events and shown in the Onset app practitioner settings screen.
• Portability: patients can prepare a JSON export of practitioner connections, assignments, consent events, provider access events, shared adherence, and shared labs.
• Least privilege: clinic APIs centralize account-scope checks before using service role access, and database functions revoke broad public/anon execution.
• Data minimization: practitioner notification emails avoid patient names, lab details, adherence values, and protocol names. Clinical details stay behind portal authentication.

AI Import Disclosure

Protocol imports send the uploaded image or PDF to the configured AI model for extraction. The import function processes uploads in memory, does not write the uploaded document to storage, and returns structured protocol fields for practitioner review before saving.

Clinic Deletion Semantics

Deleting a clinic patient relationship removes the clinic relationship, protocol assignments, and clinic-shared copies of adherence and lab data. It does not delete the patient's own Onset account or local Onset app data.

Roadmap Items

• Move high-risk patient connection RPCs into Edge Functions if abuse monitoring shows invite-code probing beyond database rate limits.
• Expand automated tests once the repository has a stable test runner for authenticated Supabase flows.