PVA Local Prototype Safety and Privacy Test Plan
local-prototype-safety-privacy-test-plan artifact · for Patient Visit Advocate · phase PVA-SLICE-01 · status approved
local-prototype-safety-privacy-test-plan artifact · for Patient Visit Advocate · phase PVA-SLICE-01 · status approved
No explicit evidence field yet. Require tests, screenshots, linked PRs, or reviewed outputs before marking complete.
- date: 2026-05-08
- phase: id: string, label: string
- title: PVA Local Prototype Safety and Privacy Test Plan
- status: draft
- version: 1.0
- authored by: luna
- open blockers: 5 items
- privacy tests: PRV-001: object, PRV-002: object, PRV-003: object, PRV-004: object, PRV-005: object, PRV-006: object, PRV-007: object, PRV-008: object, PRV-009: object, PRV-010: object, PRV-011: object, PRV-012: object
- release gates: gate_2_beta: object, gate_1_alpha: object, gate_3_launch: object
- scope summary: Executable test scenarios and release gate criteria for all free-loop screens, synthetic medical-adjacent inputs, privacy boundaries, and AI failure/fallback paths in the PVA local-only pocket prototype. Does NOT assert that tests have been executed or passed.
- execution notes: disclaimer: string, environment: object, coverage_gaps: object
- ai failure tests: AIR-001: object, AIR-002: object, AIR-003: object, AIR-004: object, AIR-005: object, AIR-006: object, AIR-007: object, AIR-008: object, AIR-009: object, AIR-010: object
Machine-readable source fields
2026-05-08
PVA-SLICE-01
PVA-SLICE-01
PVA Local Prototype Safety and Privacy Test Plan
draft
1.0
luna
| id | owner | impact | blocker |
|---|---|---|---|
| BLK-001 | Architecture / Justin | AIR-004 and PRV-002 cannot be fully specified for execution | AI API endpoint and auth model not specified in source artifacts |
| BLK-002 | Architecture | Test device selection and OS-specific privacy tests blocked | Minimum supported iOS/Android version not defined |
| BLK-003 | Developer | PRV-008 test definition may need revision post-implementation | Privacy-mode screen blanking implementation not confirmed in prototype spec |
| BLK-004 | Product | PRV-006 test cannot be executed until provider is known | Analytics provider not selected |
| BLK-005 | Architecture / Developer | PRV-003 and PRV-004 execution method depends on storage implementation choice | Local storage implementation (SQLite vs AsyncStorage vs SecureStore) not confirmed |
Network
No PHI (conditions, notes, medications) in any request except scoped AI call
Capture all network traffic during session
CRITICAL
Network
Only session context fields; no persistent device ID; no user token that links to identity
Capture AI API request payload
CRITICAL
Storage
Data exists only in documented local store paths; no shadow copies
Inspect device local storage after session
CRITICAL
Storage
All session data removed from local store; keys deleted not merely blanked
Inspect device storage after session clear
CRITICAL
Logs
No PHI in any log output, error messages, or analytics payloads
Capture crash logs and console output during full session
CRITICAL
Analytics
No medical content in event properties; limited to UX signals only
Inspect analytics events emitted during session
HIGH
Clipboard
No PHI auto-copied to system clipboard
Enter medical data that may autofill clipboard
HIGH
Screenshots
App screenshot blurred or replaced in recent apps view
Background app during active session
HIGH
Backup
Medical data paths excluded from backup manifest
Device cloud backup enabled during test
HIGH
Export
Share payload is rendered text/PDF summary only; no raw data structure
Platform share sheet exercise
MEDIUM
Permissions
App requests only minimum permissions; no contacts, location, or microphone without explicit documented feature
Permission audit on install and runtime
MEDIUM
Reinstall
Previous session data inaccessible; confirms no external persistence in free tier
Uninstall and reinstall app
HIGH
Beta — Limited External Testing
Validate privacy and AI fallback under real network conditions with external testers.
- PRV-006
- PRV-007
- PRV-008
- PRV-009
- PRV-011
- AIR-002
- AIR-003
- AIR-004
- AIR-006
- SCR-060
- SCR-061
- SCR-062
- SCR-072
- SCR-081
- SYN-011
- SYN-012
- SYN-013
- SYN-014
All Alpha gate hard_stops passed.
All Alpha + Beta hard_stops pass; no CRITICAL failures; no unresolved HIGH failures blocking user flow.
- SCR-011
- SCR-043
Alpha — Internal Testing
Verify core free-loop flows work end-to-end on a single device without data leakage.
- SCR-001
- SCR-002
- SCR-003
- SCR-004
- SCR-010
- SCR-020
- SCR-021
- SCR-024
- SCR-030
- SCR-031
- SCR-032
- SCR-033
- PRV-001
- PRV-002
- PRV-003
- PRV-004
- PRV-005
- AIR-001
- AIR-007
- AIR-008
- SYN-008
- SYN-009
- SYN-010
- SYN-014
- SCR-071
- SCR-073
- SCR-080
All hard_stops must pass with no CRITICAL severity failures before Alpha build is shared internally.
- SCR-041
- SCR-042
- PRV-006
- PRV-008
- PRV-009
- SYN-011
- SYN-012
- SYN-013
Launch — Public Release
All test scenarios must pass. Zero CRITICAL failures permitted.
- ALL
All Alpha + Beta gate hard_stops passed.
Every test in screen_state_tests, privacy_tests, ai_failure_tests, and synthetic_inputs passes with no CRITICAL severity failure and no unresolved HIGH severity failure. Zero unhandled exceptions in test runs.
- Test run report with pass/fail for every test ID
- Network capture artifacts for PRV-001 through PRV-005
- Local storage dump pre/post clear for PRV-003/PRV-004
- AI API audit log for SCR-033/PRV-002
Executable test scenarios and release gate criteria for all free-loop screens, synthetic medical-adjacent inputs, privacy boundaries, and AI failure/fallback paths in the PVA local-only pocket prototype. Does NOT assert that tests have been executed or passed.
These are defined test scenarios. Tests have NOT been executed. Pass/fail status is not asserted here.
AIR series must be run with real API credentials, not mocked responses
Physical iOS and Android devices required for PRV-008, PRV-009 — emulators not acceptable for these tests
Synthetic inputs only — no real patient data to be used
Charles Proxy or mitmproxy required for PRV-001 through PRV-005
- Screen reader / accessibility testing not covered in this plan
- Concurrent session handling not tested (single-session prototype scope)
- OS version matrix not yet defined — test device selection blocked pending BLK-002
- Localization not tested — English-only prototype scope
Fallback to manual question entry shown immediately; no crash; no blank screen
AI API unavailable
CRITICAL
No network connectivity
Spinner replaced with timeout message; manual fallback offered
AI API timeout
HIGH
API response delayed >10 seconds
User-friendly error message; manual fallback offered; no stack trace exposed to user
AI API 5xx error
HIGH
Server-side error
Error message does not expose API keys, auth tokens, or internal stack trace
AI API 4xx error
CRITICAL
Rate limit or auth error
No suggestions UI message shown; manual entry mode offered
AI returns empty response
HIGH
Empty suggestions array in response
Content filtered or flagged before display; not shown as-is
AI returns off-topic content
HIGH
Non-question content in response
Blocked or filtered — AI contract explicitly forbids diagnostic claims
AI returns diagnostic-sounding content
CRITICAL
Response includes condition diagnosis
No AI call made; disclaimer shown first; call blocked until acknowledged
AI disclaimer not yet acknowledged
CRITICAL
User attempts AI generation before accepting disclaimer
Each retry allowed; fresh call; no stale cached error shown as current result
Multiple AI retries after failure
HIGH
User retries AI generation after prior failure
Offline detection triggers manual mode for remaining flow; no broken UI state
Network lost mid-session after AI use
HIGH
Airplane mode toggled mid-session
| id | type |
|---|---|
| 9783e2c4-7623-4324-8aaa-86ee7dd77733 | architecture/MVP-01 |
| 78ca477c-cd9c-4ba8-84ed-db0944e88702 | trust-boundary-charter/PVA-SLICE-00 |
| 1d0623fa-7b89-46d2-ab35-4b5223f17507 | patient-data-ai-contract/PVA-SLICE-02 |
| ae4aafaa-7ac7-4054-9b0a-fa443a7c8d94 | local-pocket-prototype-spec/PVA-SLICE-01 |
| c7bdfa1d-890a-4c5e-b88a-e3cffca55505 | safety-privacy-qa-matrix/PVA-SLICE-01 |
| 83da736a-0f52-42f0-bad5-c0e4a61cef06 | feature-ux-spec/MVP-01 |
| d79c11f2-f033-4037-89d1-dee5697e30df | screen-map/design-001 |
| 0bd533b6-b5d5-4758-bcce-4ff97b72cb33 | screen-map/design-002 |
| id | input | fields | expected | severity |
|---|---|---|---|---|
| SYN-001 | Type 2 diabetes, uncontrolled | - condition - notes | Accepted; stored locally; no flagging or filtering | HIGH |
| SYN-002 | Metformin 500mg BID, Lisinopril 10mg QD | - medications | Accepted; no filtering; stored correctly with clinical abbreviations intact | HIGH |
| SYN-003 | Patient DOB: 01/01/1970 | - any text field | Accepted; stored locally; not transmitted | HIGH |
| SYN-004 | SSN: 123-45-6789 | - any text field | Accepted as text; not transmitted; no validation blocking entry | HIGH |
| SYN-005 | Blood pressure 145/90 mmHg | - notes | Accepted; stored; not interpreted as a medical alert | MEDIUM |
| SYN-006 | Dr. Johnson ordered CBC, BMP, HbA1c | - visit context - notes | Accepted; stored; clinical abbreviations preserved | MEDIUM |
| SYN-007 | Allergies: penicillin (anaphylaxis), sulfa drugs | - any text field | Accepted; allergy detail not stripped or sanitized | HIGH |
| SYN-008 | Chest pain 8/10, radiating to left arm | - any text field | Accepted as text; NOT interpreted as emergency; no 911 auto-dial or emergency modal triggered | CRITICAL |
| SYN-009 | <script>alert('xss')</script> | - all text fields | Rendered as plain text; no script execution; no visible escape artifacts | CRITICAL |
| SYN-010 | '; DROP TABLE visits; -- | - all text fields | Rendered as plain text; no SQL execution; local store integrity maintained | CRITICAL |
| SYN-011 | 💊 medication 心臓発作 | - notes | Stored and displayed correctly; no encoding crash or data loss | MEDIUM |
| SYN-012 | 10,000 character string | - notes | Graceful truncation or full storage; no crash; UI indicates truncation if applied | MEDIUM |
| SYN-013 | Identical data entered multiple times | - questions | Deduplication or acceptance without error; no crash | LOW |
| SYN-014 | Call 911 immediately | - notes | Displayed as entered; not blocked; no auto-action or emergency dial triggered | CRITICAL |
- Single-visit prep and documentation
- AI-assisted question generation (stateless, per-session)
- In-visit note capture
- Post-visit summary (current session only)
- Visit history or multi-session memory (paid)
- Caregiver/family sharing (paid)
- Cross-session continuity (paid)
- Cloud sync (paid)
none
App Launch
Onboarding shown; zero network calls to PHI endpoint before consent
Cold launch first run
CRITICAL
none
App Launch
Session state loaded from local storage only; no remote fetch
Cold launch returning session
CRITICAL
none
Onboarding
Disclaimer modal renders before any API request is made
AI disclaimer shown before first AI call
CRITICAL
user taps dismiss
Onboarding
Returns to new visit setup; no data written to remote storage
Dismiss onboarding
HIGH
background 60 seconds
App
Session state preserved locally; no auto-sync triggered
Backgrounded and resumed
HIGH
Cardiology follow-up, Dr. Smith, 2026-05-10
New Visit Setup
Visit object stored in device-local store only; no remote write
Create new visit
CRITICAL
2025-01-01
New Visit Setup
Validation warning shown; data accepted; no crash
Visit date in past
LOW
No value captured.
New Visit Setup
Field validation error displayed; no navigation forward
Empty visit name
MEDIUM
256 character string
New Visit Setup
Truncated or error; no crash
Max-length visit name
MEDIUM
Dr. O'Malley & Assoc.
New Visit Setup
Stored and displayed correctly; no injection or encoding error
Special chars in provider name
HIGH
Type 2 diabetes, hypertension
Visit Context
Stored locally; NOT transmitted until explicit AI call action by user
Enter medical condition
CRITICAL
Follow-up on A1C levels
Visit Context
Stored locally; no outbound transmission
Enter reason for visit
CRITICAL