KrinosAI — PHI Data Inventory and Data Protection Impact Assessment (DPIA)
Template ID: TPL-02-06 | Stage: 02-Requirements | Version: 0.3
Record: KAI-VORAL-DPIA-001 — retrospective draft for Visionary Oral. Not approved.
Purpose: Inventory every personal and health data item the product processes and assess privacy risk before design is fixed.
Required inputs: PRD; SRS draft; data-flow sketch; vendor list; initiation risk screen.
Document control
| Field |
Required entry |
| Document ID |
KAI-VORAL-DPIA-001 |
| Template used |
TPL-02-06 PHI Data Inventory and Data Protection Impact Assessment (DPIA) v0.3 |
| Product / project / software version or commit SHA |
VORAL (Visionary Oral) / PRJ-001 / a6b4429e3165 (branch app_dev of AI-Dental-Project/Visionary_Oral) |
| Record status and version |
Draft v0.1 |
| Author / technical reviewer / quality reviewer |
Claude Code (drafted with Claude Code for KrinosAI) / Tech Lead (name to be assigned) / Security & Privacy Officer (name to be assigned) |
| Created / updated / approved dates |
2026-10-27 / 2026-10-27 / Pending |
| Applicable SOP and revision |
SOP-LC-02 v0.3 |
| Related issue, commit, requirement and evidence links |
KAI-VORAL-BRF-001, KAI-VORAL-IRS-001, KAI-VORAL-CHR-001, KAI-VORAL-DEC-001; KAI-VORAL-SRS-001; KAI-VORAL-IRS-001 §2 |
| Approver and decision record |
Pending |
Applicability and evidence baseline
Product / system boundary: Web app and API (dentalapp/), doctor/admin mobile app (mobile/), PDF Lambda (dentalapp/pdf-lambda/) at a6b4429e3165, and the external services they call (see KAI-VORAL-IRS-001).
Related approved requirements, risks and change records: None approved. Related drafts are listed in document control.
Retrospective record? Yes — follows the Retrospective Documentation Protocol (KrinosAI lifecycle pack, 05-References/). Items are labelled Observed (code or Git at a6b4429), Measured (dated run), Stated (named person, dated) or Not recorded. The DPIA inventory is built from the data the code processes. Legal basis, retention and approvals are decisions for the Security & Privacy Officer and are left open; claimed bases below are questions, not conclusions.
Acceptable evidence: an implementation reference (file:line at a commit SHA), a dated test record, a signed decision, a vendor agreement, or another independently verifiable artifact. Never invent approvals, clinical results, measurements or performance data.
1. Data category and sensitivity
| Data ID |
Element |
Category |
Sensitivity |
| DAT-01 |
Patient name (first, last) |
Personal — identifier |
High |
| DAT-02 |
Patient phone, email |
Personal — contact |
High |
| DAT-03 |
Date of birth / age, gender |
Personal — demographic |
High |
| DAT-04 |
Patient free-text concern ("message") |
Health data |
Very high |
| DAT-05 |
Intraoral photographs (3 views) |
Health data; may identify |
Very high |
| DAT-06 |
AI findings, risk levels, score, AI text |
Health data |
Very high |
| DAT-07 |
Voice recordings (speech-to-text) |
Personal; may contain health data |
High |
| DAT-08 |
Doctor identity and clinic details |
Personal — professional |
Medium |
| DAT-09 |
Payment records (Cashfree) |
Financial |
High |
| DAT-10 |
Support tickets and messages (may include images) |
Personal; may contain health data |
High |
| DAT-11 |
Report PDFs |
Health data |
Very high |
| DAT-12 |
Phone caches: offline photos, reports, patient list |
Health data on device |
Very high |
2. Purpose and legal basis assessment
| Data ID |
Purpose |
Legal basis (claimed) |
Confirmed by |
| DAT-01 |
Oral-health screening report for the patient |
Proposed (Claude Code, for confirmation): explicit, informed consent of the patient (India DPDP Act 2023, s.6) recorded before photo capture; confirm per target market |
Not confirmed |
| DAT-02 |
Oral-health screening report for the patient |
Proposed (Claude Code, for confirmation): explicit, informed consent of the patient (India DPDP Act 2023, s.6) recorded before photo capture; confirm per target market |
Not confirmed |
| DAT-03 |
Oral-health screening report for the patient |
Proposed (Claude Code, for confirmation): explicit, informed consent of the patient (India DPDP Act 2023, s.6) recorded before photo capture; confirm per target market |
Not confirmed |
| DAT-04 |
Oral-health screening report for the patient |
Proposed (Claude Code, for confirmation): explicit, informed consent of the patient (India DPDP Act 2023, s.6) recorded before photo capture; confirm per target market |
Not confirmed |
| DAT-05 |
Oral-health screening report for the patient |
Proposed (Claude Code, for confirmation): explicit, informed consent of the patient (India DPDP Act 2023, s.6) recorded before photo capture; confirm per target market |
Not confirmed |
| DAT-06 |
Oral-health screening report for the patient |
Proposed (Claude Code, for confirmation): explicit, informed consent of the patient (India DPDP Act 2023, s.6) recorded before photo capture; confirm per target market |
Not confirmed |
| DAT-07 |
Oral-health screening report for the patient |
Proposed (Claude Code, for confirmation): explicit, informed consent of the patient (India DPDP Act 2023, s.6) recorded before photo capture; confirm per target market |
Not confirmed |
| DAT-08 |
Account and clinic administration |
Performance of the contract with the doctor/clinic (proposed) |
Not confirmed |
| DAT-09 |
Billing |
Performance of contract and legal obligation (tax records) (proposed) |
Not confirmed |
| DAT-10 |
Support |
Legitimate use to provide the requested support (proposed) |
Not confirmed |
| DAT-11 |
Oral-health screening report for the patient |
Proposed (Claude Code, for confirmation): explicit, informed consent of the patient (India DPDP Act 2023, s.6) recorded before photo capture; confirm per target market |
Not confirmed |
| DAT-12 |
Oral-health screening report for the patient |
Proposed (Claude Code, for confirmation): explicit, informed consent of the patient (India DPDP Act 2023, s.6) recorded before photo capture; confirm per target market |
Not confirmed |
3. Source destination and processor
| Data ID |
Source |
Destination |
Processor |
Contract |
| DAT-01–04 |
Doctor entry (web/mobile) or patient QR self-registration |
MongoDB patients |
MongoDB (host Not recorded) |
Not recorded — OPEN-012 |
| DAT-05 |
Phone or browser camera |
Cloudflare R2; ML service; OpenRouter; Groq |
Cloudflare; Hugging Face; OpenRouter/Google; Groq |
Not recorded — OPEN-012 |
| DAT-06 |
On-device models / ML service / OpenRouter |
MongoDB scans |
MongoDB |
Not recorded — OPEN-012 |
| DAT-07 |
Browser microphone |
OpenRouter transcription |
OpenRouter |
Not recorded — OPEN-012 |
| DAT-08 |
Doctor onboarding; Clerk |
MongoDB profiles; Clerk |
Clerk; MongoDB |
Not recorded — OPEN-012 |
| DAT-09 |
Cashfree checkout |
MongoDB payments, subscriptions |
Cashfree |
Not recorded — OPEN-012 |
| DAT-10 |
Support form |
MongoDB support_tickets, support_messages |
MongoDB |
Not recorded — OPEN-012 |
| DAT-11 |
PDF Lambda |
AWS S3 (default region us-east-1) |
AWS |
Not recorded — OPEN-012 |
| DAT-12 |
Mobile app |
Phone SQLite and app files |
Doctor's device |
Not applicable (device) |
4. Patient identifiers and data minimization
| Data ID |
Needed? |
Minimization method |
Where enforced |
| DAT-01 |
Yes — identify the patient |
Not recorded |
Not enforced |
| DAT-02 |
Partly — contact for reports |
Not recorded |
Not enforced |
| DAT-03 |
Age only may suffice |
Age is calculated from DOB (dentalapp/src/app/api/patients/route.js:7-8) |
Not enforced |
| DAT-04 |
Optional |
Field optional |
UI |
| DAT-05 |
Yes |
Cropped to the guide (mobile/src/features/scan/ScanCamera.tsx) |
Capture |
| DAT-06 |
Yes |
Only report classes kept (dentalapp/src/app/api/scans/analysis/route.js) |
API |
| DAT-07 |
Not recorded |
Not recorded |
Not enforced |
| DAT-08 |
Yes |
— |
— |
| DAT-09 |
Yes |
Card data handled by Cashfree |
Cashfree |
| DAT-10 |
Yes |
Not recorded |
Not enforced |
| DAT-11 |
Yes |
— |
— |
| DAT-12 |
Yes, for offline work |
Not recorded |
Not enforced — OPEN-029 |
5. Data flows and geographical locations
| Flow |
From → to |
Region |
Cross-border? |
Flow DF-01 (see KAI-VORAL-DFD-001) |
Phone/browser → web API (Vercel or Render) |
Not recorded — OPEN-022 |
Unknown |
Flow DF-02 (see KAI-VORAL-DFD-001) |
Web API → MongoDB |
Not recorded |
Unknown — OPEN-016 |
Flow DF-03 (see KAI-VORAL-DFD-001) |
Web API → Cloudflare R2 |
Not recorded |
Unknown — OPEN-016 |
Flow DF-04 (see KAI-VORAL-DFD-001) |
Web API → ML service (Hugging Face) |
Not recorded |
Unknown — OPEN-016 |
Flow DF-05 (see KAI-VORAL-DFD-001) |
Web API → OpenRouter / Google; Groq |
Not recorded (US vendors) |
Likely — OPEN-016 |
Flow DF-06 (see KAI-VORAL-DFD-001) |
PDF Lambda → AWS S3 |
Default us-east-1 (dentalapp/pdf-lambda/index.js:10) |
Likely, if users are outside the USA — OPEN-016 |
Flow DF-07 (see KAI-VORAL-DFD-001) |
Web API → Resend (email) |
Not recorded |
Unknown — OPEN-016 |
Flow DF-08 (see KAI-VORAL-DFD-001) |
Mobile app ↔ phone storage |
Device |
No |
6. Retention deletion and backups
| Data ID |
Retention |
Deletion method |
Backups |
| DAT-01 |
While the patient remains with the clinic + 3 years, or until consent is withdrawn (proposed) |
Not recorded |
MongoDB backups Not recorded; 9 backup files committed to Git (OPEN-008) |
| DAT-02 |
Same as DAT-01 (proposed) |
Not recorded |
MongoDB backups Not recorded; 9 backup files committed to Git (OPEN-008) |
| DAT-03 |
Same as DAT-01 (proposed) |
Not recorded |
MongoDB backups Not recorded; 9 backup files committed to Git (OPEN-008) |
| DAT-04 |
Same as DAT-01 (proposed) |
Not recorded |
Not recorded |
| DAT-05 |
Same as DAT-01; annotated copies deleted with the original (proposed) |
Not recorded |
MongoDB backups Not recorded; 9 backup files committed to Git (OPEN-008) |
| DAT-06 |
Same as DAT-05 (proposed) |
Not recorded |
MongoDB backups Not recorded; 9 backup files committed to Git (OPEN-008) |
| DAT-07 |
Delete immediately after transcription; not stored (proposed) |
Not recorded |
Not recorded |
| DAT-08 |
Account lifetime + 1 year (proposed) |
Not recorded |
Not recorded |
| DAT-09 |
8 years (Indian accounting record rules — confirm with finance) (proposed) |
Not recorded |
Not recorded |
| DAT-10 |
2 years after ticket closure (proposed) |
Not recorded |
Not recorded |
| DAT-11 |
90 days in S3, then regenerate on demand (proposed) |
Not recorded |
Not recorded |
| DAT-12 |
30 days on the phone, and wiped on suspension or sign-out (proposed) |
App caches cleared on uninstall; no expiry recorded |
Not recorded |
7. Threats to data subjects and mitigation
| Risk ID |
Threat |
L / I |
Control |
REQ |
| PRV-01 |
Personal data exposed through committed backups and credentials |
H / H |
Purge and rotate (OPEN-007, OPEN-008) |
REQ-035 |
| PRV-02 |
Anonymous access to patient/doctor emails and support messages |
H / H |
Authenticate routes (OPEN-026) |
REQ-034 |
| PRV-03 |
Health data processed by AI vendors without DPAs, abroad |
M / H |
DPAs, region choice (OPEN-012, OPEN-016) |
REQ-034 |
| PRV-04 |
Lost or stolen phone exposes offline photos and reports |
M / H |
Device protection and cache expiry (OPEN-029) |
REQ-026 |
| PRV-05 |
No consent or privacy notice recorded |
H / M |
Consent and notice (OPEN-031) |
REQ-029 |
| PRV-06 |
Data kept forever |
H / M |
Retention schedule (OPEN-029) |
REQ-035 |
8. Roles approvals and reassessment triggers
| Item |
Entry |
| DPIA owner |
Security & Privacy Officer — Sponsor (name to be assigned) |
| Approval |
Pending — OPEN-009 |
| Reassessment triggers |
New data element, new vendor or region, new AI model or provider, change of intended use, any personal-data incident |
Open issues and decisions
| ID |
Specific gap or decision |
Responsible owner |
Due date |
Blocks gate? |
Evidence required |
Status |
| OPEN-001 |
Tracker project ID, named requester and sponsor, and named reviewers are not recorded |
Product Owner |
2026-11-10 (proposed) |
Yes |
Tracker entry; names with roles |
Open |
| OPEN-007 |
Credential files committed to Git: dentalapp/google-credentials.json, dentalapp/mongoDb_usernamePassword (contents not opened) |
Security & Privacy Officer |
2026-10-31 (proposed) |
Yes |
Credentials rotated; files removed and purged from history; confirmation |
Open |
| OPEN-008 |
Database backups with personal data committed to Git: 9 files under dentalapp/backups/ (commit 92a4b77; contents not opened) |
Security & Privacy Officer |
2026-10-31 (proposed) |
Yes |
Files purged from history; breach/incident assessment recorded |
Open |
| OPEN-009 |
No DPIA |
Security & Privacy Officer |
2026-11-30 (proposed) |
Yes |
DPIA |
Open |
| OPEN-012 |
No vendor DPAs |
Security & Privacy Officer |
2026-11-30 (proposed) |
Yes |
DPAs |
Open |
| OPEN-016 |
Data regions and transfers |
Security & Privacy Officer |
2026-11-30 (proposed) |
Yes |
Transfer assessment |
Open |
| OPEN-022 |
Production hosting (Vercel vs Render), deployed version and dated integration checks for Clerk, MongoDB, R2, AWS, OpenRouter, Groq, Cashfree and Resend not recorded |
Tech Lead |
2026-11-30 (proposed) |
No |
Environment record (stage 05) with dated checks |
Open |
| OPEN-026 |
Critical: 20 API routes have no authentication check, incl. /api/admin/patient-sample (patient emails) and /api/admin/api-usage (doctor names and emails), support tickets/messages, and paid AI routes (/api/detect-gemini, /api/speech-to-text, /api/validate-scan) — see docs/lifecycle/_evidence/api-inventory-a6b4429.md |
Backend Lead |
2026-10-31 (proposed) |
Yes |
Auth added to each route; re-run of the inventory shows none unprotected |
Open |
| OPEN-029 |
No retention or deletion periods for patient data, photos, reports, backups or phone caches |
Security & Privacy Officer |
2026-11-30 (proposed) |
Yes |
Retention schedule in the DPIA |
Open |
| OPEN-031 |
No recorded patient consent or privacy notice for photo capture, AI processing and QR self-registration |
Security & Privacy Officer |
2026-11-30 (proposed) |
Yes |
Consent text, where it is shown, and stored consent records |
Open |
Review and approval
| Review role |
Named individual |
Decision |
Date |
Signed / controlled record |
| Author |
Claude Code (drafted with Claude Code) |
Draft |
2026-10-27 |
This file at the commit that adds it |
| Technical reviewer |
Tech Lead (name to be assigned) |
Pending |
Pending |
Pending |
| Quality / regulatory reviewer (if applicable) |
Qualified regulatory reviewer (name to be assigned) |
Pending |
Pending |
Pending |
| Authorized approver |
Security & Privacy Officer (name to be assigned) |
Pending |
Pending |
Pending |