## Chapter 1 — Computing and service architecture ### Learning outcomes You will (1) describe the services a small healthcare business runs; (2) identify where patient data are stored and processed; (3) draw a simple service map. ### 1.1 The course and the case Leila Haddad starts an eighteen-month technical course at the fictional Riverside Technical College. Her instructor, Mr. Daniel Okafor, pairs every topic with a placement at the fictional Marlow Dental Group, which runs eight clinics, treats about 45,000 patients and offers online booking with text-message reminders. Dental records include treatment notes, X-ray images and medical histories, which are data concerning health under Article 4(15) of the GDPR. Leila's role is technical: configuring, checking and documenting the systems that hold this information, always under supervision and using synthetic test data. ### 1.2 Services and components Marlow's main services are a cloud practice-management system holding patient records, an imaging server in each clinic for X-rays, a booking website, an SMS gateway for reminders, email, and a payroll service for staff. Leila learns to separate a service, which is what users experience, from the components that deliver it: servers, databases, network links and vendor platforms. The booking service, for example, depends on the website, the practice-management system's interface and the SMS gateway, so a privacy problem in any one of them affects patients who book online. ### 1.3 Where data live For each service, Leila asks three questions: what patient data does it store, where is it physically or logically hosted, and who can reach it. She finds X-ray images on local servers in every clinic, copies of referral letters in a shared mailbox and appointment lists exported to a spreadsheet by one receptionist. These locations matter because protection, retention and access requests must cover every copy, not just the main system. A record that exists in four places has four chances to be lost, kept too long or overlooked. ### 1.4 A first service map Leila draws a service map with boxes for services, cylinders for data stores and arrows for flows, labelling each arrow with the data it carries. Mr. Okafor asks her to mark vendors in a different colour, because Marlow does not control their systems directly. The map shows that the SMS gateway receives patient names, phone numbers and appointment times, which reveals that a person is a dental patient. The map becomes the reference for later chapters, and Leila dates it so that changes can be tracked. ### Worked example Leila lists Marlow's services, separates services from components, finds patient data in local imaging servers, a shared mailbox and an exported spreadsheet, and draws a dated service map with vendors marked. > **Synthetic case.** Riverside, Marlow and all people are synthetic; GDPR Article 4(15) is real. ### Errors and limits A first map misses informal copies; interview staff as well as reading system lists. ### Exercises - **EX001 — Health data.** Why are dental treatment notes data concerning health? *Rubric:* 3 = they reveal information about a person's health status;; 2 = mentions health;; 1 = vague;; 0 = none. - **EX002 — Service and component.** What is the difference between a service and a component? *Rubric:* 3 = a service is what users experience; components deliver it;; 2 = both;; 1 = one;; 0 = none. - **EX003 — Copies matter.** Why does every copy of a record matter? *Rubric:* 3 = protection, retention and access requests must cover all copies;; 2 = mentions copies;; 1 = vague;; 0 = none. - **EX004 — SMS content.** What does the SMS gateway learn about patients? *Rubric:* 3 = names, phone numbers, appointment times and that they are dental patients;; 2 = most;; 1 = one;; 0 = none. ### Continue studying — lesson 01 (chapter 01 of 18) [← Course home](../../README.md) · [Course chapter index](../SUBJECTS.md) · [Chapter 02 →](#ch-02) Continue to the next authored lesson. ## Worked answers **EX001.** They reveal information about a patient's health, which Article 4(15) covers. **EX002.** A service is what users experience; components such as servers and databases deliver it. **EX003.** Each copy must be protected, deleted on time and included in access requests. **EX004.** Names, phone numbers and appointment times, which reveal they are dental patients.