The Problem: a Lifetime Record That Exists Nowhere

Modern medicine produces an extraordinary volume of data about each of us — encounters, observations, medications, allergies, imaging, lab results — and then scatters it. The record of a single human life is fragmented across every clinic, hospital, pharmacy, and national system that ever touched it. Each fragment is owned by the institution that created it, governed by the law of the country it sits in, and structurally unable to follow the person it describes.

1.1 The human cost

The consequences are not abstract. They are measured in repeated tests, missed allergies, dangerous drug interactions, delayed emergency care, and second opinions rendered without the first opinion's evidence. The founder of LifeRecord Alpha lived this failure directly — arriving for care with a complex history (compartment syndrome, multiple deep-vein thromboses) scattered across systems that could not speak to one another. Fragmented records are not an inconvenience. They are a danger.

1.2 The invisible cost: the signal no one is positioned to see

The failure in §1.1 is acute — a history unavailable at the moment it is needed. There is a second failure, quieter and arguably more common, that fragmentation causes just as directly: the change that is only visible across a lifetime, and so is visible to no one.

Consider a single laboratory value. At any one visit, a result is judged against a population reference range — the band that most people of a given age and sex fall within. That comparison answers one question: are you outside the range? Now consider a patient whose serum creatinine reads:

Every one of those results is normal. Each visit ends without a flag, and correctly so — no individual value warrants one. But the series is a fifty-percent rise over four years, and a trajectory is a different object from a measurement. The population range cannot see it, because the population range was never asked about this patient's history. It was asked only about this patient's afternoon.

Now add the condition this paper is about: those four draws happened at four different institutions — a workplace screening, an urgent-care visit, a specialist referral, and a clinic in another country. No institution holds the series. Each holds one point and considers its work complete. The only party present at all four draws is the patient, and the patient is the one party with no copy.

This is the argument for a lifetime record rather than a merely portable one. Portability solves the emergency; only completeness-over-time makes the trajectory legible at all. A record that spans a life permits a strictly better question than any single encounter can ask:

Not "is this value abnormal for a population?" but "is this value abnormal for you, and in which direction has it been moving?"

Answering it well requires a distinction the record must support: many analytes drift with age, and expected drift is not a finding. The signal is a departure from the patient's own prior trajectory — movement beyond what ageing explains, movement where there should be none, or acceleration. The correct order of comparison is the patient's own history first, an age-adjusted expectation second, and the population range last. Only the first of those three requires data that no institution currently holds.

Framing note. The values above are illustrative of the mechanism, not a claimed clinical finding, and nothing in this model substitutes for a clinician. The purpose of surfacing a trend is to produce a question for the patient's physician — never a conclusion. That boundary is an architectural commitment, addressed in §5.4 and §7.

1.3 The quantified waste (company estimates)

The recovered business analysis attaches the following figures to the cost of fragmentation. They are presented here as company estimates pending independent re-validation against current sources, not as audited fact:

• An estimated $200B+ per year wasted globally on duplicate medical testing.
• An estimated 500,000+ medical errors per year attributable to incomplete patient histories.
• A medical-tourism sector — patients who physically cross borders while their records do not — that independent 2026 market research sizes in the tens of billions of dollars annually and growing, and which structurally cannot function without a portable record.

These figures motivate the problem; they are not relied upon as precise. Independent analyst sourcing and a stated base year are required before any single number is cited as established.

1.4 The data-sovereignty bind

There is a deeper structural problem beneath the waste. A complete cross-border history is not merely inconvenient to assemble — under current law it is, in the institutional path, frequently unlawful to assemble. A hospital in one country cannot simply transmit its records to a hospital in another; data-sovereignty and data-protection law restrict institution-to-institution transfer across borders. So the patient who needs their history abroad is caught: the data exists, the need is acute, and the lawful channel to move it institution-to-institution does not exist.

This bind is the hinge of the entire LifeRecord Alpha thesis — and, as the next section shows, the law has begun to resolve it in exactly the direction the product is built for.

The Regulatory Moment: Patient-Mediated Access Is Now Mandated

For most of the digital-health era, patient control of records was an aspiration that ran against the grain of how systems were built. By 2026 that has reversed. In the two largest regulatory blocs, patient-mediated access has become the legally mandated direction of travel — a tailwind, not a headwind.

2.1 United States — the 21st Century Cures Act and the information-blocking rule

The 21st Century Cures Act (§4004) added a new section to the Public Health Service Act defining and prohibiting "information blocking," now codified at 42 U.S.C. § 300jj-52 and implemented by the ONC information-blocking regulations at 45 CFR Part 171. The statutory definition is explicit that obstructing the patient's access to electronic health information is itself the prohibited act:

"[T]he term 'information blocking' means a practice that … is likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information." — 42 U.S.C. § 300jj-52(a)(1)(A) (added by 21st Century Cures Act § 4004)

The same provision sets the actor-specific knowledge standard. For a health-IT developer, exchange, or network, the practice is information blocking where the actor:

"knows, or should know, that such practice is likely to interfere with, prevent, or materially discourage the access, exchange, or use of electronic health information." — 42 U.S.C. § 300jj-52(a)(1)(B)(i)

By 2026 these provisions are in active enforcement, with civil monetary penalties for developers, exchanges, and networks, and Medicare payment disincentives for providers. The regulations structurally empower patient-mediated exchange: certified electronic health records must expose standardized FHIR-based APIs that let a patient route their own electronic health information to a third-party application of their choosing. A provider cannot lawfully block a patient from doing so absent a specific regulatory exception.

2.2 European Union — the European Health Data Space (EHDS)

The European Union has gone further still, enacting a comprehensive framework that makes patient access and cross-border portability a positive legal right. The European Health Data Space Regulation — Regulation (EU) 2025/327 of the European Parliament and of the Council of 11 February 2025 — entered into force on 26 March 2025 (published in the Official Journal on 5 March 2025). It establishes, in Article 3, a direct right of the individual to their own data:

"Natural persons shall have the right to access at least personal electronic health data relating to them that belong to the priority categories referred to in Article 14 and are processed for the provision of healthcare through the electronic health data access services referred to in Article 4. Access shall be provided immediately after the personal electronic health data have been registered in an EHR system, while respecting the need for technological practicability, and shall be provided free of charge and in an easily readable, consolidated and accessible format." — Regulation (EU) 2025/327, Article 3(1)

The Regulation entered into force on 26 March 2025, but its substantive rights phase in on staged dates: the individual access right and other patient-facing provisions become applicable on the Regulation's staggered application timetable, and the Regulation pairs the access right with a mandate for cross-border interoperability — Member States must align national systems to common EU specifications and integrate into the MyHealth@EU infrastructure, with core cross-border exchange (patient summaries, ePrescriptions) mandated to be operational by 2029.

2.3 The 2029 clock

Read together, the two regimes describe the same arc: the patient is becoming the legally recognized conduit for their own health data, and cross-border portability is becoming a deadline rather than a dream. The market is now racing a clock that runs to 2029. The infrastructure to meet it must be built now.

A note on the legal model. LifeRecord Alpha's design rests on the distinction that a patient exercising their own data-portability right to present their records to a foreign clinician is lawful where an institution-to-institution cross-border transfer is not. This patient-as-conduit model is built on established patient data-portability rights — GDPR Article 20, HIPAA patient-rights provisions, and the Cures Act access right above — but its application to a live cross-border deployment is pending validation by qualified counsel in each target jurisdiction and is not stated here as settled law.

The Vision: the Record Stays Where It Was Created; the Right to Read It Travels With the Patient

LifeRecord Alpha begins from a single sentence:

Your medical history belongs to you — and follows you across every border, every provider, every system — without anyone but you holding the key.

The mechanism that makes this real has one governing principle: the authoritative record stays where it was created, inside its country of origin and under that country's law; what travels with the patient is a verifiable copy and the right to read it. No institutional data crosses a border. The patient carries proof, not a parallel database.

To a patient, ownership should feel as concrete as owning any other thing they hold. The simplest way to convey that to a layperson is by analogy: you own your record outright — think of it like an NFT, but with no token, no market, and no speculation. That analogy is a one-time bridge for intuition only. The rest of this paper carries the serious terms — verifiable credential, cryptographic proof, anchor — because that is what the system actually is. There is no coin to buy, no asset to trade, and nothing about LifeRecord Alpha that depends on a cryptocurrency market.

What the patient experiences is ownership made legible: a single visual timeline of their complete history; one-tap, time-limited, per-provider grants of access; instant revocation; and the certainty that no one has access unless they affirmatively gave it. The cryptography that enforces all of this stays out of view. The patient sees "your medical history" and "grant access" — never keys, ledgers, or tokens.

The Model: One Platform, Two Postures

LifeRecord Alpha is a single product sold into two fundamentally different kinds of market. These are co-equal lanes — not a sequence, not "pick one" — and they share one codebase and one patient feature set. They differ only in posture (adjacent vs. foundational) and deal shape.

4.1 Posture A — the patient-adjacent helper (for established health systems)

Where a nation already has functioning electronic health records — Epic, Cerner, Athenahealth, a national EHR — LifeRecord Alpha sits alongside the incumbent system via FHIR. It never replaces the institution's system of record. The institution keeps producing and holding its data exactly as before; the patient gains a portable, self-custodied, verifiable copy that travels with them. New encounters flow into the patient's ownership automatically, with no change to how clinicians work.

In this posture LifeRecord Alpha is connective tissue: it monetizes the institution's interoperability and intake friction, not the patient. This matches the only model that has demonstrably worked in this market — the standalone direct-to-consumer personal health record is a known dead end; the durable businesses sell to providers and empower patients for free.

4.2 Posture B — the national health system (for nations that lack one)

Where a nation has no functioning national health-data backbone, there is nothing to sit alongside — so LifeRecord Alpha is the national system of record. The platform becomes the country's EHR, and its citizens additionally receive the full patient feature set: ownership, portability, self-custody, cross-border verification.

Crucially, this posture is delivered as sovereignty, not lock-in (see §9.2): the platform is self-hostable and forkable by the nation's own engineers, and it carries a built-in population-health intelligence layer that turns the national deployment into a public-health instrument as well as a record-keeping system.

4.3 Why both, permanently

A national deployment and a provider integration can close in the same quarter. The two postures de-risk each other and address the entire spectrum of the world's health systems — from the most mature to the not-yet-built — with one engineering effort. For a nation, the choice of posture is simply a function of what already exists on the ground.

Architecture: the Verifiable Mirror

The architecture is deliberately built from boring, standards-grade cryptography — no custom blockchain, no novel cryptographic primitive, no on-chain personal data. Its credibility rests on a single design decision: anchors-only. Personal health information never goes on a ledger. Only a blind, salted hash — proof that a record existed and was signed at a moment in time, revealing nothing about it — is ever anchored.

5.1 The three parties

A record under LifeRecord Alpha is three linked artifacts held by three different parties:

1. The authoritative record — off-chain, encrypted, and mutable, held by the legally liable medical authority. In Posture A that authority is the institution; in Posture B it is the state-as-issuer. This is the legal source of truth, the data-protection "controller's" store, and the thing that is deleted on an erasure request. It is encrypted with AES-256-GCM under a per-patient key.
2. The patient-carried verifiable copy — the "Verifiable Mirror" — a selective-disclosure credential (an SD-JWT) held in the patient's phone secure enclave, plus a static, signed Emergency QR carrying compressed vital fields for fully offline use. A clinician can cryptographically verify this copy — confirm it was issued by the stated authority and not tampered with — without contacting anyone. It is verifiable but non-authoritative: the legal source remains the authority's store.
3. The Proof Service anchor — the Proof Service, an automated timestamp service (the cryptographic "notary"): a single, issuer-independent timestamp service holding one blind, salted Merkle-root hash per batch of records, via a public timestamping service (OpenTimestamps) and/or a low-cost ledger. It proves existence-at-a-point-in-time for roughly one cent per batch. It contains no personal data, no metadata, and no re-identifiable hash whatsoever — a hard, binding design rule, because under European guidance even a hash of identifying data is still personal data.

LifeRecord Alpha itself is, in every posture, a data processor only. It moves signed, encrypted artifacts. It never holds the records in clear text, never holds the keys that decrypt them, and is never an independent controller of the data. A subpoena served on LifeRecord cannot, mathematically, produce health data — because LifeRecord does not have it. The patient's own device copy — the Verifiable Mirror held in their phone enclave — is the patient processing their own data for personal use, which is expected to fall under the GDPR household exemption (pending counsel).

5.2 The cross-border, offline-emergency flow

The signature capability is what happens when a patient arrives — conscious or not — at a clinic in a country that has never seen them before:

• The patient already carries the Verifiable Mirror. The foreign clinician verifies the signature, the integrity, and the freshness of the record offline, against a cached copy of the issuer's public key, with no round-trip to the home country. Care does not wait on connectivity, on the home hospital being reachable, or on LifeRecord being online.
• Where the clinician needs the authoritative (not merely mirrored) record, they request a fresh issuance from the home authority when connectivity is available — and even then, the underlying data stays resident in the origin jurisdiction. LifeRecord brokers the signed artifact as a processor; it never holds the clear-text payload.

Durability is designed for a human lifetime. Using a portable, key-history-preserving issuer identity (did:tdw) plus the public timestamp, a record signed in 2025 can still be verified in 2050 — even if the issuing hospital, the government, and LifeRecord itself have all since disappeared.

5.3 Erasure without a backdoor; lawful access without a backdoor

Two requirements that usually fight each other are reconciled by the anchors-only model:

• Right to erasure (e.g. GDPR Article 17). Because the authoritative record lives in a mutable off-chain store, erasure is a true deletion: delete the off-chain record and destroy the per-patient encryption key. Any cached ciphertext becomes permanently undecryptable, and the salted Merkle anchor — which never revealed anything — is left with no decryptable counterpart. This mechanism is designed to satisfy GDPR Art. 17 (pending DPO/EDPB confirmation): EDPB Guidelines 02/2025 treat hashes of identifying data as personal data, and whether the residual anchor is rendered non-personal by key destruction remains an open question to be confirmed per jurisdiction. There is no immutable on-chain copy of personal data to contend with.
• Lawful state access — without a platform backdoor. In the national posture, the state is the issuer and already holds the authoritative master record. Lawful access is therefore the state querying its own store, under its own legal framework — not a secret key surrendered by LifeRecord. Every such access produces an append-only, tamper-evident audit entry recording who requested it, the legal basis, the scope, and the time-box — visible to both the state and the patient, so neither side can hide it. LifeRecord remains a processor holding no master key and no PHI: there is nothing to compel from it, and no custodian trap to fall into.

5.4 Honesty about what is built and what is consumed

The first release is deliberately minimal and built by consuming mature components rather than inventing new ones: an enclave-backed key vault, SD-JWT issuance, a single Proof Service anchor (timestamp service), and a static browser-based verifier with the offline Emergency QR. Full FHIR mapping, zero-knowledge selective disclosure, and a full transparency log are explicitly deferred to a later version. The discipline is the point: the smaller the build surface, the more credible the security posture.

Security and Sovereignty: a Post-Quantum Migration Path by Design

For a record meant to last fifty years, the most important security question is not today's threat — it is the threat across the data's entire lifetime. LifeRecord Alpha treats post-quantum readiness as a headline pillar designed in from the first record — with one honestly disclosed hardware gap (§6.3) on the patient device that is on a near-term migration path, not a future aspiration.

6.1 The harvest-now-decrypt-later threat is present, not future

Adversaries can capture encrypted data today and decrypt it later, once a cryptographically relevant quantum computer exists. For ordinary short-lived secrets this is a manageable risk. For lifetime health data it is not: a record that must remain confidential for 50+ years, combined with a multi-year migration timeline, against an estimated arrival of a capable quantum computer well inside that window, means data captured today is already harvestable for future decryption. This is why quantum-safety must be designed in from the first record, not retrofitted.

6.2 Hybrid post-quantum cryptography, on the NIST standards

LifeRecord Alpha uses post-quantum cryptography — not quantum key distribution, which is hardware-bound and discouraged for software systems — running on classical hardware available today, against the NIST post-quantum standards:

• Key exchange: hybrid X25519 + ML-KEM-768 (FIPS 203, finalized). Pairing a classical and a post-quantum algorithm means the channel is secure as long as either one holds.
• Signatures: hybrid Ed25519 + ML-DSA (FIPS 204, finalized), with FN-DSA/FALCON (FIPS 206, draft/forthcoming — not yet finalized) to be adopted where a compact signature is required once the standard is published (the offline Emergency QR has a strict size budget, so it uses the compact classical signature today with the full hybrid carried in the phone credential). Hash-based SLH-DSA (FIPS 205, finalized) is available as a conservative fallback.
• Bulk encryption: AES-256-GCM, which is already quantum-resistant and is retained.

Every signature carries a dual classical-plus-post-quantum header from day one. This crypto-agility means the system can be upgraded to require the post-quantum half once it matures, without re-issuing anything — and a record anchored before quantum computers exist cannot be retroactively forged after they do.

6.3 Non-custodial self-custody, with humane recovery

The patient holds their own keys; LifeRecord never does. Private keys live in the phone's secure enclave (Apple Secure Enclave / Android StrongBox), unlocked locally by biometrics — biometric templates and private keys never leave the device. (An honestly documented 2026 hardware limitation: consumer secure elements do not yet support post-quantum signing in-element, so the patient-device post-quantum key runs in constant-time software sealed by the enclave; lifetime integrity rests on the Proof Service anchor (timestamp service), which can use PQC-capable HSMs available today (the managed service is not yet built), so this gap is not load-bearing. Migration of in-element post-quantum signing onto the secure element follows as the hardware ships (pending hardware support, ~2027–28).)

Self-custody must not mean "lose your phone, lose your life's medical history." LifeRecord deliberately rejects the brutal lose-the-seed-lose-everything model of cryptocurrency. Recovery is layered: a 24-word recovery phrase (which can restore the entire identity), Shamir / guardian (social) recovery through trusted contacts, biometric backup, and time-locked recovery. In the national posture a recovery share may be held in lawful state escrow under that nation's law. No single point of loss; LifeRecord never sees any of it. And because the authoritative record and the anchor still exist, a lost device is re-provisioned by re-issuing the Mirror — a far smaller blast radius than losing the record itself.

6.4 The Estonia lineage

This is not a speculative architecture. It follows the proven model of Estonia's national digital infrastructure: the Guardtime KSI blockchain that stores only hashes — never personal data — operating as a timestamp service, not a file cabinet, while personal data lives in mutable off-chain databases connected by the X-Road data exchange layer. LifeRecord Alpha generalizes that battle-tested design — anchors-only, off-chain mutable records, cryptographic timestamping for integrity — and adds lifetime quantum-safety on top.

Compliance Posture: Anchors-Only Is the Only Defensible Design

LifeRecord Alpha's compliance posture is a direct consequence of its architecture. Each deployment is configured to conform to its jurisdiction's law — "built to conform, not to dictate."

• HIPAA (US). The patient controls disclosure of their protected health information; every access is audit-logged and reportable; breaches are detectable and notifiable. The patient data-portability foundation aligns with the Cures Act access right (§2.1).
• GDPR / EHDS (EU). Data portability (Article 20) is the same right the patient-as-conduit model exercises. Privacy-by-design (Article 25) is structural — no personal data on any ledger. Right to erasure (Article 17) is designed to be satisfied by deletion of the mutable off-chain record plus destruction of the per-patient key (§5.3) (pending DPO/EDPB confirmation). The EHDS access and cross-border rights (§2.2) are exercised, not obstructed, by the platform.
• Why anchors-only is mandatory, not optional. Independent research and the governing European guidance (EDPB Guidelines 02/2025) are unambiguous: encrypted data is still personal data; on-chain hashes of personal data are still personal data; and "technical impossibility cannot justify non-compliance" with the right to erasure. The conclusion in the market is equally clear — putting health records (or tokenized representations of them) on a public chain is practically incompatible with EU law. The only defensible design keeps personal data off-chain in mutable stores and anchors only blind, salted hashes. LifeRecord Alpha is built to that standard from the ground up.

Erasure-via-key-destruction with a residual blind anchor, and the lawful-access model, are designed to satisfy GDPR and the Estonia/EDPB precedent; both remain subject to confirmation by a Data Protection Officer and counsel per jurisdiction.

Adoption: Three Tiers and the Population-Health Dividend

Entry is sequenced so each phase de-risks the next. The platform does not chase the hardest market first.

8.1 Phase 1 — digital-first small states

Compact, digitally progressive jurisdictions with reachable regulators and the will to move — a deliberate mix of established-system markets and nations still building national health infrastructure, so that both postures (§4) are proven at small scale. The win condition is narrow and concrete: one jurisdiction operating on the platform, with the patient-ownership model endorsed in writing by a real regulator.

8.2 Phase 2 — medical-tourism corridors

Patients traveling for treatment, and the destination hospitals that receive them — where the value is acute and self-evident. 2026 market research indicates the highest-readiness corridors, which LifeRecord Alpha leads with: Mexico (the Tijuana–San Diego corridor, which the research indicates draws on the order of ~500,000 international patients/year), Türkiye (where market research indicates ~42 JCI-accredited hospitals and reports a 2025 government mandate that health-tourism facilities integrate with a central digital portal — pending independent confirmation), and India (a vast diaspora and established cross-border care flows). Thailand and Costa Rica follow as secondary corridors. These corridors prove the cross-border, patient-carried record under real clinical stakes — often with a government-validated integration point already in place.

8.3 Phase 3 — diaspora populations

Expatriates, international students, migrant families, and anyone whose life and care are permanently split across countries. This is the largest and most defensible long-term market — people for whom a portable lifetime record is a structural necessity — reached only after Phases 1 and 2 have established the legal precedent and the cross-border plumbing.

8.4 The population-health intelligence layer (for nations)

For a nation in Posture B, the aggregate of consented records becomes a public-health instrument — delivered entirely through differential-privacy aggregates, so no record-level data ever leaves the patient's control. Six programs ship to a national operator: a vaccination-coverage tracker, an outbreak signal grid, seasonal-preparedness forecasting, program-effectiveness measurement, antimicrobial-stewardship monitoring, and maternal-and-child-health tracking. A ministry buying a national EHR also buys a population-health surveillance capability in the same purchase — and one it can keep even if it later forks the platform.

Why Now, and the Ask

9.1 For nations — national digital sovereignty, made operational

LifeRecord Alpha lets a nation give its citizens ownership of their health records, meet the cross-border-interoperability direction that the largest regulatory blocs have already mandated, and stand up a population-health intelligence capability — without surrendering sovereignty over either the data or the software. The authoritative data stays in-country, under national law. The platform is self-hostable and forkable by the nation's own engineers. Quantum-safety is built in, protecting citizens' lifetime records against the harvest-now-decrypt-later threat that already endangers any 50-year data — a "sovereign resilience" posture aligned with emerging national post-quantum mandates. For a nation without a health-data backbone, this is the fastest defensible path to one. For a nation that has one, it is the patient-sovereignty and cross-border layer on top.

9.2 The sovereign-on-data, open-on-the-platform commitment

LifeRecord Alpha is sovereign on data, open on the platform. The platform code is available under a source-available license; a nation can self-host it, and can fork it and run it with its own engineering team. The only restriction is a prohibition on reselling the modified platform. Implementation, maintenance, and support are optional paid services — never a lock-in a nation must pay to keep the lights on. Sovereignty extends to the software, not just the data. The defensibility of the business moves from "you cannot leave our license" to "the rollout is hard, the support is valuable, and the population-health programs are worth paying for."

9.3 For investors — the investment thesis

The thesis rests on five converging tailwinds: a regulatory mandate (Cures Act enforcement + EHDS, with patient-mediated access now the law's direction of travel and a 2029 cross-border clock); technology maturity making anchors-only, quantum-safe verifiable credentials buildable from off-the-shelf parts; the structural waste of fragmented records (company estimate, §1.3); a global digitization tail; and a dual-track model that addresses both mature and greenfield health systems with one codebase.

The following figures are aspirational targets, not forecasts or guarantees, and the underlying market sizing is a company estimate pending independent re-derivation:

The interim 2027 milestone — a first national deployment plus pilots — is the near-term number to plan against. The 2031 figures are the north-star scale, explicitly aspirational. Market-size figures ($350B+ TAM / $85B SAM and related) are reconstructed company estimates requiring sourced analyst validation and a stated base year before external citation; revenue, unit-economics, and return figures are likewise being rebuilt bottom-up and are not presented as established.

The revenue model serves both postures: institutional licensing and EMR-integration fees in Posture A; national-system deployment-and-services engagements plus the population-health programs in Posture B; per-event transaction revenue and patient hardware-key revenue across both. Any patient-mediated data-monetization stream (e.g. consented research-data access with revenue shared back to patients) is treated as contingent on legal validation per jurisdiction, never as a proven line.

Roadmap: Consume, Don't Build

The first six months are a deliberately minimal, consume-over-build MVP that establishes ground truth honestly:

• Months 1–2 — Vault: a mobile app storing keys in the phone's secure enclave.
• Months 3–4 — Issuance: an authority signs a record into a verifiable SD-JWT wrapper (full FHIR mapping deferred; a compressed vital payload for now).
• Month 5 — Anchor: a single Proof Service (timestamp service) Merkle root per batch — lifetime durability for roughly one cent.
• Month 6 — Verifier: a static, browser-based doctor's verifier plus the static signed Emergency QR.

Hybrid Ed25519 + ML-DSA signing is present from the first commit. Beyond the MVP, V1 adds full FHIR mapping, zero-knowledge selective disclosure, online revocation status lists, the per-jurisdiction compliance-profile surface, and the population-health intelligence layer for national deployments. Each subsequent phase is gated on the prior phase being proven in production — and on counsel validation of the patient-as-conduit model in the deployment's jurisdiction.

Conclusion

The patient is the only constant across a lifetime of care, and until now the only party without a copy of their own record. LifeRecord Alpha closes that gap with a design that is, at last, both honest and defensible: the authoritative record stays where the law requires it, the right to read it travels with the patient as a cryptographically verifiable mirror, nothing personal ever touches a ledger, and the whole system is engineered to survive both the disappearance of its institutions and the arrival of quantum computing.

For a nation, it is sovereignty made operational — over data and over software. For an investor, it is the foundational infrastructure for the patient-mediated era that the world's largest regulators have already mandated, with a 2029 clock already running. The records belong to the patient. It is time the architecture said so.