A Green Pipeline Is Not Permission: Governing Real Care Data Before You Touch It

Describes the governance design for real-data use. No participant, pilot, or dataset details are included; the pipeline referenced here runs on synthetic data only.

ParkinSync — VEAI LAB.’s private research prototype that turns a family’s home-care logs into structured records — has a green synthetic pipeline. The schema validates, the round trip passes, the thirty-day fixture holds. It is tempting to read that green check as “ready to run on real data.” It isn’t. Parkinson’s-related care records are, under Japan’s APPI, 要配慮個人情報 — special-category personal data. A passing test on invented data is an engineering result. Running real records is a governance decision, and the two must not be confused.

So the design puts an explicit gate between them. The synthetic work can be finished by anyone; real data is not touched until a written checklist is fully satisfied. Here is what’s on it.

Purpose, then minimization

First, the purpose is pinned in writing: run one bounded multi-source readiness report. Not marketing, not secondary analysis, not a data lake for “later.” Everything downstream inherits that limit.

Then the export is trimmed to it. The pipeline needs care-event values — dates, bowel and medication fields — not names, addresses, or birthdates. So directly identifying fields are simply not exported. The person is carried as a pseudonymous subjectRef, and the map from pseudonym back to a real person is stored separately from the exported artifacts and only while consent is live. You cannot leak a field you never moved.

Consent that includes its own undo

For special-category data the default is explicit opt-in, and the consent records the things people actually need to decide:

• exactly which fields, and the single purpose;
• where it is stored — including that AWS regions such as us-east-1 are abroad, handled as a processor under APPI’s outsourcing rules;
• the retention period;
• how to withdraw, and that withdrawal means deletion.

Consent without a working withdrawal path is theatre. If someone can opt in but not get their data removed, the system didn’t actually ask permission — it asked for surrender.

Least privilege and separation of duties

Reading data to export it and deleting data are different powers, so they are different IAM roles. Export is read-only against the source; deletion is a separate role behind MFA; every action lands in CloudTrail. Today the operator is one person, but the roles are split anyway — because “I’ll be careful” is not an access-control model, and because the table has to be ready for a second participant without a redesign.

Deletion is fail-closed, and rehearsed on synthetic data first

Deletion defaults to off. A feature flag (ACCOUNT_DELETION_ENABLED=false in production) means the destructive path can’t fire by accident; enabling it is a deliberate, logged act. And deletion isn’t trusted because the code returned success — it’s verified: after a delete, the record is re-exported and its absence is asserted. Backups and point-in-time recovery are part of the design, not an afterthought, so a “deleted” record can’t quietly survive in a snapshot.

Crucially, the whole destructive path is exercised on a synthetic tenant before it ever runs on a real one. You do not learn how your deletion behaves by running it on someone’s health data for the first time.

Why the gate is the feature

It would be faster to point the working pipeline at real records and call the green check permission. But the value of a care tool is not that it can move health data — anything can move health data. The value is that it moves it only under conditions the person agreed to, keeps only what the purpose needs, and can prove it deleted what it promised to delete.

That is why the synthetic experiment stays open in the tracker until the checklist clears. A green build that names what it hasn’t earned is worth more than a demo that quietly does something no one consented to.

ParkinSync is one of the care tools at veai.jp/apps.