PulseUse in healthcare, finance and professional services
How this relates to the “three-ministry, two-guideline” framework, FISC, and professional confidentiality obligations, and what we can support today.
Healthcare institutions, financial institutions, law and tax practices, and government bodies ask us how Pulse relates to their sector's regulation and guidelines. This article sets out, for each of four sectors, the scope within which Pulse can be used and what you need to check when considering it.
What Pulse records is an online meeting you join on a computer with the desktop app (macOS / Windows) installed. Face-to-face exchanges in a consulting room and telephone calls are out of scope. Read this on the basis of online meetings joined from a computer, such as internal hospital meetings and case conferences.
This article is general information compiled by UNCHAIN, Inc. and is not legal advice. Whether your organisation may use it is for your organisation's responsible officer to determine, in the light of the applicable rules, industry guidelines and regulators' guidance.
A common starting point: UNCHAIN, Inc. acts as a processor
The starting point common to all four sectors is the relationship between UNCHAIN, Inc. and your organisation.
Provision accompanying delegation of the handling of personal data within the scope necessary to achieve the purpose of use does not constitute “provision to a third party”. The delegating party, meanwhile, has a duty to exercise necessary and appropriate supervision over the processor. On business plans, your organisation is the delegating party and UNCHAIN, Inc. the processor.
Adopting Pulse is therefore, for your organisation, a question of selecting and managing an external processor. UNCHAIN, Inc. does not handle personal data beyond the scope of the work delegated to it. The information your organisation needs to select and assess a processor is available as documentation on request, through your account contact or tharada@the-unchain.com.
Use in healthcare institutions
Pulse can be used to produce the minutes of internal hospital meetings, case conferences and committees. Where clinical information such as medical records is involved, there are additional points to consider.
Clinical information is sensitive personal information
Personal information containing race, creed, social status, medical history, criminal record, the fact of having suffered harm from a crime, or the descriptions prescribed by Cabinet Order (disability, the results of health check-ups, guidance, diagnosis or dispensing by a doctor or similar, criminal proceedings, juvenile protection proceedings) is sensitive personal information. Acquiring it requires the individual's prior consent, except where a statutory exception applies.
A patient's medical history and clinical information fall within this. The consent must come from the patient themselves; the meeting's host or an administrator cannot consent on their behalf.
It also affects the threshold for reporting a breach. For personal data containing sensitive personal information, a leak is reportable to the Personal Information Protection Commission even if it affects a single individual (Article 7(i) of the Enforcement Regulations). Decide whether to record meetings involving clinical information on the basis of that reporting threshold.
The three-ministry, two-guideline framework
Where a healthcare institution uses an external information processing service, two guidelines have to be followed. Together they are known as the “three-ministry, two-guideline” framework.
| Applies to | Title | Issued by |
|---|---|---|
| What healthcare institutions must observe | Guidelines on the Safe Management of Medical Information Systems, version 6.0 | Ministry of Health, Labour and Welfare |
| What service providers must observe | Guidelines on Safe Management for Providers of Information Systems and Services Handling Medical Information, version 2.0 (revised March 2025) | Ministry of Economy, Trade and Industry; Ministry of Internal Affairs and Communications |
UNCHAIN, Inc. provides documentation setting out how it addresses the provider-side requirements, individually to healthcare institutions. Please contact your account representative when considering adoption.
There is no third-party certification scheme for conformity with the three-ministry, two-guideline framework. Stating that we “hold three-ministry, two-guideline certification” would be untrue and must not be used. What can be written here is limited to verifiable and qualified statements such as “we implement controls aligned with the provider-side requirements” or “we provide documentation setting out how we address them”. Write this to match UNCHAIN, Inc.'s actual position.
Where specific clinical information will be handled in Pulse, we recommend confirming with your institution's medical information systems security officer and carrying out a risk assessment.
About the Next-Generation Medical Infrastructure Act
The Next-Generation Medical Infrastructure Act (formally the Act on Anonymously Processed Medical Information and Pseudonymously Processed Medical Information to Contribute to Medical Research and Development, Act No. 28 of 2017) establishes a framework for the secondary use of medical information in research and development. Medical information is provided to nationally accredited operators and used in anonymised or pseudonymised form.
Pulse is not an accredited operator under that Act, and is not a service that collects or processes medical information under its framework. What Pulse does is help produce the minutes created in the course of a healthcare institution's own work. If you are considering secondary use of medical information for research, check the separate procedures under that Act's framework.
We are sometimes asked about compliance with HIPAA in the United States. That is US law and does not apply directly to healthcare institutions in Japan, where the position is governed by the Act on the Protection of Personal Information together with the three-ministry, two-guideline framework described above. Customers who are US healthcare institutions considering a Business Associate Agreement (BAA) should contact their account representative.
Use in financial institutions
Financial institutions use Pulse too. There are three things to check when considering it.
FISC security guidelines
The Center for Financial Industry Information Systems (FISC) publishes its “Security Guidelines on Computer Systems for Financial Institutions” (currently in its 14th edition). These are an industry self-regulatory standard rather than law, but they are referred to as a de facto standard in financial institutions' system procurement. UNCHAIN, Inc. provides financial institution customers with documentation setting out how it addresses the relevant items.
There is no third-party certification scheme for the FISC guidelines either. Avoid wording such as “FISC compliant” or “FISC certified”, and keep to “we provide documentation setting out how we address the relevant items”. Write the scope and edition of the documentation available to match what UNCHAIN, Inc. has actually produced.
Managing external processors
Where a financial institution outsources systems, it has to comply with the provisions on managing external processors in the supervisory guidelines for its sector (the Comprehensive Supervisory Guidelines for Major Banks, and equivalents). In addition, the Personal Information Protection Commission and Financial Services Agency's “Guidelines on the Protection of Personal Information in the Financial Sector” require security control measures and processor management going beyond the general law. UNCHAIN, Inc. provides the information needed for your risk assessment and processor review.
Position under the Act on the Protection of Personal Information
As set out above, UNCHAIN, Inc. acts as a party to whom your company has delegated the handling of personal data, and that relationship is not provision to a third party. The security control measures UNCHAIN, Inc. implements as a processor are described in Our security standards.
Use in law firms and tax accountancy practices
For the professions, the central question is whether using an external service is consistent with confidentiality obligations.
The confidentiality provisions
This provides that an attorney, or a person who was an attorney, has both the right and the duty to preserve secrets learned in the course of their duties.
This provides the penalty (imprisonment for up to six months or a fine of up to ¥100,000) where a doctor, pharmacist, pharmaceuticals distributor, midwife, attorney, defence counsel, notary, or a person formerly in such a position, discloses without justifiable grounds a person's secret learned in the course of their work. It is a status offence with a limited class of subjects, and neither a SaaS provider nor its employees fall within it. It does apply to the attorney or doctor using Pulse, so care is needed when it is used in the professions or in healthcare.
Article 38 provides for the tax accountant themselves, and Article 54 for their employees and other staff, that secrets learned in the course of their work must not be disclosed to others or used for their own purposes without justifiable grounds.
Is outsourcing “disclosure”?
What these provisions prohibit is “disclosing” a secret. Delegating processing to an external provider bound by confidentiality, within the scope necessary to carry out the work, is generally understood not to amount to disclosure. It is the same analysis as a practice using clerical staff, a translation company or a cloud storage provider.
That does presuppose, however, that the secret is properly protected at the processor. UNCHAIN, Inc. is bound by confidentiality under its terms of service and under individual non-disclosure agreements, and does not use customers' data for anything other than providing the service to them.
What we recommend in practice
- explain in your engagement letter with the client that external cloud services are used, and obtain their agreement in advance
- choose a business plan (Team or Enterprise). On those plans there is no use for model training. On the free and Personal plans, the user should switch it off in settings
- follow the information management rules and guidance of your bar association or tax accountants' association
- start by using it for internal meetings and training rather than for recording client meetings themselves
Note that UNCHAIN, Inc. does not practise law, and Pulse does not provide legal advice.
Use by government and local authorities
When government bodies procure cloud services, they are as a rule to procure from services on the ISMAP (Information system Security Management and Assessment Program) cloud service list. ISMAP is administered by the Digital Agency, the Ministry of Internal Affairs and Communications, the Ministry of Economy, Trade and Industry, and the National center of Incident readiness and Strategy for Cybersecurity (NISC).
Pulse is not currently on the ISMAP cloud service list. If you are considering use by a government body, check the procurement requirements first. In procurements where ISMAP registration is not mandatory, customers assess Pulse against their own criteria, with documentation on UNCHAIN, Inc.'s security controls provided.
Anyone can check whether a service is registered on the public list at the ISMAP portal (ismap.go.jp). Describing an unregistered service as “ISMAP compliant”, “ISMAP equivalent” or “meets the ISMAP criteria” risks constituting misleading representation and is a serious problem in procurement. If Pulse's registration status changes, rewrite this section accordingly: if registered, state the scope and expiry; if an application is pending, state explicitly that it is not an ISMAP-listed service until registration completes.
Recommended settings common to all four sectors
In any of these sectors, checking the following settings at rollout prevents records reaching further than intended.
| Setting | Recommended state | Reference |
|---|---|---|
| Starting a recording | start it deliberately for each meeting rather than leaving an event open. Leaving the note for an upcoming event open starts transcription at the start time | How transcription works |
| Use for model training | on business plans (Team and Enterprise) data is not used for training. On the free and Personal plans, the user should switch it off in settings | AI models and training data |
| Default sharing scope | “private” or “within the workspace”. Do not use public links outside the organisation | Sharing controls |
| Transcript retention period | the default is off (no automatic deletion). Set automatic deletion to the period the business actually requires | Automatic transcript deletion |
| External integrations | permit only those used for work and disable the rest | Integrations overview |
Where the conversation turns to something sensitive partway through a meeting, pause transcription. Anything already recorded can be deleted block by block from the transcript panel.
- meetings where sensitive personal information may arise are documented as meetings it is not used for
- a transcript retention period has been set (the default is off, so without this, transcripts remain)
- the default sharing scope has been checked and public links outside the organisation are not used
- the documentation needed for processor review has been requested from UNCHAIN, Inc.
Certifications and third-party assessments
People in each sector ask us which certifications we hold. This help centre collects the nature of each scheme and UNCHAIN, Inc.'s position in the table under “Certifications and third-party assessments” in Our security standards. Please refer to that table.
Note that none of the three-ministry, two-guideline framework, the FISC guidelines or the Next-Generation Medical Infrastructure Act has a third-party conformity certification scheme. We therefore cannot describe ourselves as “certified” or “compliant” in relation to them, and instead provide documentation setting out how we address the relevant items.
If something is not working
- If your IT department asks you to complete a security questionnaire: email tharada@the-unchain.com with the form and the deadline. We will tell you what we can answer and what documentation we can provide.
- If you need material to explain the service to a regulator: there is material we can provide in writing on UNCHAIN, Inc.'s security control measures as a processor, where data is stored, and any sub-processing. Please speak to your account representative.
- If sensitive personal information has ended up in a record: delete the transcript block concerned, or the whole note. How to delete is covered in Deleting notes.