Hard boundaries
- Draft programmes only
- No claims processing or external money movement
- No clinical data in eligibility
- No employee identity disclosure to platform operators
- Append-only ledger entries with idempotency
CONTROLLED PROGRAMME GOVERNANCE
Benefits without employer health visibility.
Monitor aggregate lifecycle signals and rehearse separation controls without opening tenant or patient-level records.