System Requirements

UID: DOC-SYS

Type	Level	MID	UID	REFS	Title	Statement	Rationale	Comment
REQUIREMENT	1		SYS-001	Children: SRS-001 First-launch database initialisation ST-001 Local clinic visible in Patients menu	SYS-001 reviewed First-launch readiness for local enrolment	When the device is opened on a workstation that has no pre-existing BioFlow data directory, a default local clinic shall be present and immediately available for the clinician to attach newly-enrolled patient records, without requiring the clinician to first create or configure a clinic record manually.	Stakeholder commitment: clinicians installing the device on a fresh workstation expect to enrol their first patient within minutes of starting the application, without learning a separate clinic-management workflow as a prerequisite. Auto-provisioning a default local clinic removes that friction.
REQUIREMENT	2		SYS-002	Children: SRS-002 Local database confidentiality at rest	SYS-002 unreviewed Confidentiality of patient data at rest	The device shall keep clinic, patient, clinical-user, recording, and audit-log data stored on the local workstation confidential against any party gaining access to the workstation's filesystem without the operator's BioFlow credentials.	BioFlow workstations are deployed in clinical environments where multiple staff and IT roles share physical access, and the local data store carries identifiable patient records. HIPAA Security Rule §164.312(a)(2)(iv) (encryption of ePHI at rest) and GDPR Art. 32(1)(a) (encryption as appropriate technical safeguard) require that filesystem-level access does not yield readable PHI on its own.