System, server device, and method and program for controlling server device

Abstract

Provided is a system that contributes to appropriately protecting the privacy of a user who uses an information distribution system. The system includes a first server, a second server, and a distribution control server. The first server stores data generated by providing a service to a user. The distribution control server controls data sharing in which the stored data are transmitted from the first server to the second server. The distribution control server stores a validation condition set by the user, the validation condition being a condition for realizing data sharing without the approval of the user. When the validation condition is in effect, the distribution control server sets a non-approved sharing period in which data stored in the first server can be shared with the second server without user approval.

Description

[Technical field]

[0001] The present invention relates to a system, a server device, a control method for a server device, and a storage medium. [Background technology]

[0002] There is an information distribution system that provides personal information held by hospitals and other institutions to information recipient devices such as businesses based on the individual's consent. Such systems include, for example, information trading devices managed by information banks and the like, information source devices managed by information source companies, and information recipient devices managed by information recipients. The information trading devices store personal information acquired from the information source devices. The information trading devices transmit personal information desired by the utilizing business, etc. from the stored personal information to the information recipient devices.

[0003] For example, Patent Document 1 describes that an information management system, an information management method, and an information management program for conducting transactions using personal information of users are provided. The information management server of Patent Document 1 includes a registrant information storage unit that stores personal information of registrants, a provision history storage unit that stores a provision history of the personal information, and a control unit connected to a purchaser terminal. The control unit acquires information acquisition conditions from the purchaser terminal, and extracts personal information from the registrant information storage unit based on the information acquisition conditions. The control unit provides the extracted personal information to the purchaser terminal, and records the provision history of the personal information in the provision history storage unit. The control unit collects the provision fee based on the provision history recorded in the provision history storage unit, and returns a consideration to the registrant who provided the personal information based on the provision fee.

[0004] In addition, technological developments are underway regarding the sharing of user information, particularly patient information.

[0005] For example, Patent Document 2 describes that the device aims to accurately grasp the condition of a patient or a person being watched over. In the device of Patent Document 2, the processing reception unit acquires disease information on a first user. The life information input item generation unit generates data including items related to the first life information associated with the disease information based on the disease information. The life information determination unit determines whether or not the condition of the first user should be notified to the second user according to the level of the second life information on the first user. The vital information reception unit acquires vital information on the first user when it is determined that the condition of the first user should be notified. The threshold determination processing unit determines whether or not the vital condition of the first user is within a predetermined range based on the vital information. The alert notification unit notifies the second user of the condition of the first user when the vital condition is not within the predetermined range.

[0006] Patent Document 3 discloses a technology that enables doctors with different specialties to share the medical information of each patient while protecting the privacy of the patient. In Patent Document 3, a group is generated by storing a patient ID, a disease ID, and a medical facility ID in association with each other. A patient designated in a patient group registration waits for an invitation request to be approved before joining the group. Medical professionals and patient-related parties join the group as supporters in response to individual invitation requests. According to the sharing rules agreed to by the patient, the patient's medical information is shared between the patient, medical professionals, and patient-related parties who belong to the group. [Prior art documents] [Patent documents]

[0007] [Patent Document 1] JP 2019-128648 A [Patent Document 2] JP 2016-157259 A [Patent Document 3] JP 2015-015010 A Summary of the Invention [Problem to be solved by the invention]

[0008] An information distribution system that allows other service providers to use data generated by one service provider increases convenience for users. For example, by allowing other hospitals to refer to a patient's medical condition (past and current illnesses), better medical services can be provided to the user. However, there are some users who do not want such information (sensitive personal data such as the name of a disease) to be known to other hospitals, etc., except in emergencies. This problem cannot be solved by applying the technologies of Patent Documents 1 to 3. None of the documents disclose that users can decide to utilize data of their own volition.

[0009] A primary object of the present invention is to provide a system, a server device, a control method for a server device, and a storage medium that contribute to appropriately protecting the privacy of users who use an information distribution system. [Means for solving the problem]

[0010] According to a first aspect of the present invention, there is provided a system including a first server that accumulates data generated by providing a service to a user, a second server, and a distribution control server that controls data sharing in which the accumulated data is transmitted from the first server to the second server, wherein the distribution control server stores an activation condition set by the user for realizing the data sharing without the user's consent, and when the activation condition is established, sets an unconsented sharing period that allows data accumulated in the first server to be shared with the second server without the user's consent.

[0011] According to a second aspect of the present invention, there is provided a server device comprising: a data distribution control unit that controls data sharing in which a first server, which accumulates data generated by providing a service to a user, transmits the accumulated data to a second server; a memory unit that stores an activation condition set by the user for realizing the data sharing without the user's consent; and a setting control unit that, when the activation condition is met, sets a non-consent sharing period that allows data accumulated in the first server to be shared with the second server without the user's consent.

[0012] According to a third aspect of the present invention, there is provided a method for controlling a server device, in which a first server that accumulates data generated by providing a service to a user controls data sharing by transmitting the accumulated data to a second server, stores an activation condition set by the user for realizing the data sharing without the user's consent, and, when the activation condition is met, sets a non-consent sharing period that allows data accumulated in the first server to be shared with the second server without the user's consent.

[0013] According to a fourth aspect of the present invention, there is provided a computer-readable storage medium that stores a program for causing a computer mounted on a server device to execute the following processes: a process of controlling data sharing in which a first server, which accumulates data generated by providing a service to a user, transmits the accumulated data to a second server; a process of storing an activation condition, which is a condition set by the user, for realizing the data sharing without the user's consent; and a process of setting a non-consent sharing period that allows data accumulated in the first server to be shared with the second server without the user's consent when the activation condition is met. Effect of the Invention

[0014] According to each aspect of the present invention, a system, a server device, a control method for a server device, and a storage medium are provided that contribute to appropriately protecting the privacy of users who use an information distribution system. Note that the effects of the present invention are not limited to those described above. The present invention may achieve other effects instead of or in addition to the effects described above. [Brief description of the drawings]

[0015] [Figure 1] FIG. 1 is a diagram for explaining an overview of an embodiment. [Diagram 2] FIG. 2 is a flowchart showing an example of the operation of the system according to an embodiment. [Diagram 3] FIG. 3 is a diagram illustrating an example of a schematic configuration of an information distribution system according to the first embodiment. [Figure 4] FIG. 4 is a diagram for explaining the operation of the information distribution system according to the first embodiment. [Diagram 5] FIG. 5 is a diagram for explaining the operation of the information distribution system according to the first embodiment. [Figure 6] FIG. 6 is a diagram for explaining the operation of the information distribution system according to the first embodiment. [Figure 7] FIG. 7 is a diagram for explaining the operation of the information distribution system according to the first embodiment. [Figure 8] FIG. 8 is a diagram showing an example of a display on the terminal according to the first embodiment. [Figure 9] FIG. 9 is a diagram showing an example of a display on the terminal according to the first embodiment. [Figure 10] FIG. 10 is a diagram for explaining the operation of the information distribution system according to the first embodiment. [Figure 11] FIG. 11 is a diagram for explaining the operation of the information distribution system according to the first embodiment. [Figure 12] FIG. 12 is a diagram for explaining the operation of the information distribution system according to the first embodiment. [Figure 13]FIG. 13 is a diagram for explaining the operation of the information distribution system according to the first embodiment. [Figure 14] FIG. 14 is a diagram for explaining the operation of the information distribution system according to the first embodiment. [Figure 15] FIG. 15 is a diagram for explaining the operation of the information distribution system according to the first embodiment. [Figure 16] FIG. 16 is a diagram illustrating an example of a processing configuration of the distribution control server according to the first embodiment. [Figure 17] FIG. 17 is a diagram illustrating an example of a user information database according to the first embodiment. [Figure 18] FIG. 18 is a diagram illustrating an example of a part of the user information database according to the first embodiment. [Figure 19] FIG. 19 is a diagram illustrating an example of a location information database according to the first embodiment. [Figure 20] FIG. 20 is a flowchart illustrating an example of the operation of the non-consent sharing setting control unit according to the first embodiment. [Figure 21] FIG. 21 is a flowchart illustrating an example of the operation of the data circulation control unit according to the first embodiment. [Figure 22] FIG. 22 is a diagram illustrating an example of a processing configuration of the service server according to the first embodiment. [Figure 23] FIG. 23 is a diagram illustrating an example of the accumulation database according to the first embodiment. [Figure 24] FIG. 24 is a diagram illustrating an example of a processing configuration of the service server according to the first embodiment. [Diagram 25] FIG. 25 is a diagram illustrating an example of a processing configuration of the service server according to the first embodiment. [Figure 26] FIG. 26 is a diagram illustrating an example of the accumulation database according to the first embodiment. [Figure 27] FIG. 27 is a diagram illustrating an example of a processing configuration of a terminal according to the first embodiment. [Figure 28] FIG. 28 is a diagram illustrating an example of a processing configuration of the wearable terminal according to the first embodiment. [Figure 29] FIG. 29 is a sequence diagram showing an example of the operation of the information distribution system according to the first embodiment. [Diagram 30] FIG. 30 is a diagram for explaining the operation of the information distribution system according to the second embodiment. [Diagram 31] FIG. 31 is a diagram illustrating an example of a processing configuration of the distribution control server according to the second embodiment. [Diagram 32] FIG. 32 is a diagram illustrating an example of a hardware configuration of the distribution control server according to the present disclosure. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0016] First, an outline of one embodiment will be described. The reference numerals in the drawings are added to each element for convenience as an example to aid in understanding, and the description of the outline is not intended to be limiting. Furthermore, unless otherwise specified, the blocks shown in each drawing represent functional units rather than hardware units. The connection lines between the blocks in each drawing include both bidirectional and unidirectional. The unidirectional arrows are used to diagrammatically indicate the flow of the main signal (data) and do not exclude bidirectionality. In this specification and the drawings, elements that can be similarly described may be given the same reference numerals to avoid redundant description.

[0017] The system according to an embodiment includes a first server 101, a second server 102, and a distribution control server 103 (see FIG. 1). The first server 101 accumulates data generated by providing a service to a user. The distribution control server 103 controls data sharing in which the accumulated data is transmitted from the first server to the second server. FIG. 2 is a flowchart showing an example of the operation of the system according to an embodiment. The distribution control server 103 stores an activation condition set by a user for realizing data sharing without the user's consent (step S1). When the activation condition is established, the distribution control server 103 sets an unconsented sharing period that allows the data accumulated in the first server to be shared with the second server without the user's consent (step S2).

[0018] The user registers an activation condition in the system to enable data sharing without the user's consent. When the activation condition set in advance by the user is established due to, for example, a sudden change in the user's physical condition, the distribution control server 103 sets a no-consent sharing period for the user (person whose physical condition has suddenly changed) during which data sharing is possible without the user's consent. When the distribution control server 10 receives a request for data sharing from the second server 102 during the no-consent sharing period in response to a sudden change in the user's physical condition, the distribution control server 10 realizes data sharing of the data requested by the second server 102. In this way, the user registers an activation condition in the system in advance and gives prior consent for a sudden change in physical condition. The distribution control server 103 determines whether the activation condition is satisfied based on the user's vital data, etc., and if satisfied, issues a sharing instruction to the first server 101, which is the data accumulator. As a result, the sharing period for data such as "disease name", which is sensitive personal data, during the period in which the user is unable to give consent of his / her own will, is minimized, and the privacy of the user who uses the information distribution system is appropriately protected.

[0019] Specific embodiments will be described in more detail below with reference to the drawings.

[0020] [First embodiment] The first embodiment will be described in more detail with reference to the drawings.

[0021] [System Configuration] Fig. 3 is a diagram showing an example of a schematic configuration of an information distribution system according to the first embodiment. As shown in Fig. 3, participating members (actors) of the information distribution system include information distribution businesses and service businesses.

[0022] The information distributor is an entity that controls data distribution between service providers. The information distributor includes at least one distribution control server 10.

[0023] The distribution control server 10 is a server device that controls (realizes) data distribution between service providers. The distribution control server 10 is a device that provides a data distribution service for data stored in the service providers.

[0024] A service provider is an entity that provides services to individuals. A service provider may be a private business or a public institution. Examples of service providers include medical institutions (hospitals, pharmacies, etc.) that provide medical services to users, retailers, and educational providers that teach languages, sports, arts, etc. to customers. Alternatively, travel agencies that sell travel-related services and products to users are also included in the category of service providers.

[0025] Each service provider has a service server 20 for providing services to customers. The service server 20 is managed and operated by the service provider. The service server 20 accumulates (stores) data (user data) generated by the service provider when the service provider provides the service to the user.

[0026] A user of the information distribution system uses a terminal 30 .

[0027] The devices shown in Fig. 3 are connected to each other via a network. For example, the distribution control server 10 and the service server 20 are connected by wired or wireless communication means and configured to be able to communicate with each other.

[0028] 3 is merely an example and is not intended to limit the configuration of the information distribution system disclosed in the present application. For example, an information distribution business operator may include two or more distribution control servers 10.

[0029] [System operation overview] Next, an outline of the operation of the information distribution system according to the first embodiment will be described. First, the basic operation of the information distribution system according to the first embodiment will be described. Then, a case where a user cannot consent to data distribution of his / her own volition will be described.

[0030] In the first embodiment, four service providers are used as an example for explanation. Specifically, the following four service providers are used for explanation: Hospital A, Hospital B, an emergency hospital in charge of emergency medical care, and a travel agency.

[0031] 3, Hospital A has a service server 20-1, Hospital B has a service server 20-2, the emergency hospital has a service server 20-3, and the travel agency has a service server 20-4. In the following description, unless there is a special reason to distinguish between the service servers 20-1 to 20-4, they will simply be referred to as "service server 20."

[0032] "Sharing" exists as a means of data distribution in information distribution systems.

[0033] "Sharing" is a means for a service provider to obtain data accumulated by other service providers. For example, when Hospital A obtains data generated by providing a service to a user, data distribution through "sharing" is used.

[0034] Since "sharing" is used to improve the convenience of the service user himself, in principle, no compensation is generated for data distribution. In other words, "sharing" is used to utilize data accumulated by other service providers so that users can receive better services from the service providers.

[0035] <User registration> As shown in Fig. 4, users of the information distribution system must register in advance (user registration, system registration). More specifically, users register when joining the system. The users operate their own terminals 30 to input their personal information (such as name, date of birth, contact information, etc.) into the distribution control server 10.

[0036] The distribution control server 10 generates a user ID (Identifier) ​​for identifying the user, and issues the generated user ID to the user. The distribution control server 10 stores the generated user ID in association with the acquired personal information (such as name). More specifically, the distribution control server 10 stores the user ID in association with the personal information using a "user information database". The details of the user information database will be described later.

[0037] The distribution control server 10 opens a personal portal for a user who has completed user registration. The user logs in to the personal portal, and can manage and change various information set in the information distribution system via the personal portal.

[0038] <Generate personal identification code> Once user registration is complete, the user will enter into an individual contract with the service provider from which they wish to receive services. Specifically, the user will provide the service provider with their name and other information and request to enter into a new contract (contract to receive services) with that service provider. For example, a user who wishes to visit a medical institution will submit their health insurance card, on which their name and other information are printed, to the medical institution.

[0039] The service provider generates a "personal identification code" for identifying a new customer (user). For example, a medical institution assigns a patient card number for managing the user (patient) and generates the patient card number as a personal identification code. The service server 20 stores the generated personal identification code (e.g., the patient card number) in its own database or the like.

[0040] Once the personal identification code is generated, the user can receive services from the service provider. For example, the user receives medical services (medical checkups, examinations, etc.) from a medical institution. Data (examination results and disease names) generated by the provision of services to the user are accumulated by the service provider and become subject to data distribution.

[0041] <Notification of personal identification code> The generated personal identification code is notified to the information distribution business. The distribution control server 10 acquires the personal identification code generated by each service business.

[0042] Specifically, the distribution control server 10 periodically or at a predetermined timing transmits a "user information provision request" including personal identification information of users who have completed user registration to each service server 20 (see FIG. 5). The personal identification information is information for identifying a user, and examples of the information include a name or a combination of a name and a date of birth.

[0043] If there is a personal identification code corresponding to the personal identification information, the service server 20 transmits to the distribution control server 10 information about the corresponding user (customer) (hereinafter referred to as user information).

[0044] The user information includes the generated personal identification code of the user and the business code of the service provider. The business code is identification information (ID) for identifying the service provider participating in the information distribution system.

[0045] For example, different codes are assigned to Hospital A and Hospital B. The business code is shared between system participants (information distribution company, service provider) by any means. For example, when a service provider participates in the information distribution system, the information distribution company (distribution control server 10) generates a business code to be assigned to the service provider. The information distribution company notifies the service provider of the generated business code. The information distribution company also notifies other service providers participating in the system of the generated business code.

[0046] The distribution control server 10 stores the acquired personal identification code in a user information database.

[0047] <Data storage and location information transmission> Service providers accumulate data that is generated when they provide services to users. For example, as shown in Fig. 6, when Hospital A provides medical services to each of Users U1 to U3, Hospital A accumulates the results for each user. For example, Hospital A accumulates the medical examination results (e.g., disease name and test results) for each of Users U1 to U3.

[0048] The service provider (service server 20) stores the personal identification code of each user in association with the data obtained as a result of the service provided. For example, in the example of Fig. 6, the service server 20-1 of Hospital A uses an "accumulation database" to store the personal identification code of each of users U1 to U3 in association with the examination results (for example, specific disease names such as stomach cancer, lung cancer, etc.). The details of the accumulation database will be described later.

[0049] Every time a service provider accumulates data (user data resulting from the provision of a service), it transmits "location information" to the distribution control server 10. The location information is information about the storage location of the data accumulated at the service provider (data accumulation entity; service provider), etc. The location information includes a personal identification code, a business code, the type of accumulated data, etc.

[0050] The distribution control server 10 stores the acquired location information in a "location information database". The location information database will be described in detail later. The location information database stores a personal identification code, a business code, and a data type in association with each other.

[0051] <Data distribution through sharing> A service provider that wishes to obtain data accumulated by other service providers (data resulting from the other service providers providing services to users) can obtain that data through "sharing."

[0052] Here, with reference to FIG. 7, a case will be described in which Hospital B acquires data of User U1 stored in Hospital A through "sharing."

[0053] The service server 20-2 of Hospital B, which is the requester of data sharing, transmits a "data sharing request" to the distribution control server 10 (step S11).

[0054] Based on the sharing request, the distribution control server 10 identifies the target of data distribution (user U1) and the data accumulator (hospital A) of the data to be distributed. The distribution control server 10 transmits an inquiry about data sharing to the terminal 30 possessed by the identified target (user U1) (step S12).

[0055] The terminal 30 that receives the data sharing inquiry acquires the user's intention regarding data sharing. For example, the terminal 30 acquires the intention of the user U1 using a GUI (Graphical User Interface). In the above example, the terminal 30 displays a GUI with the content such as "You can receive better service by sharing the examination results from Hospital A with Hospital B. Do you want to share?" and acquires the user's intention (agree or disagree to data sharing).

[0056] The terminal 30 transmits a response to the inquiry about data sharing (agreement to data sharing or refusal to data sharing) to the distribution control server 10 (step S13).

[0057] If the user's consent is obtained, the distribution control server 10 transmits a sharing instruction to the data accumulator (the service server 20-1 of Hospital A) (step S14).

[0058] Upon receiving the sharing instruction, the service server 20-1 of Hospital A refers to the storage database and transmits the examination results of user U1 (e.g., the specific disease name, such as stomach cancer, lung cancer, etc.) to the designated data sharing destination service server 20-2 (step S15).

[0059] Next, a case where a user cannot respond to an inquiry about data sharing based on his / her own will will be described. In the first embodiment, it is assumed that a user who has visited a tourist spot suddenly becomes ill and is taken to hospital by ambulance. The user also visits the tourist spot through a tour or the like planned by a travel agency.

[0060] First, the user operates the terminal 30 to access a website operated by a travel agency and apply to participate in a sightseeing tour. At that time, the user can make advance settings in case the user's physical condition suddenly changes at the tourist spot (see FIG. 8). In the example of FIG. 8, a user who wishes to make such advance settings presses the "Register emergency lifesaving system" button.

[0061] In addition, travel agencies will explain on their websites etc. the risks involved in a sudden change in health during the trip, as well as the need to register in advance with an emergency medical system in order to deal with such risks.

[0062] In registering with the emergency lifesaving system, the user inputs settings to the service server 20-4 for sharing information that the user does not want others to know, such as the name of an illness (past illness, current illness), with an emergency hospital or the like only in an emergency (when the user is unable to consent to data sharing of their own volition) (see FIG. 9). In the following explanation, the information that the user sets in the travel agency's service server 20-4 is referred to as "unconsented sharing setting information." Data sharing that is performed without the user's consent is referred to as "unconsented data sharing."

[0063] For example, a user registers unconsented sharing setting information in the travel agency's service server 20-4 as shown in Fig. 9. As shown in Fig. 9, the unconsented sharing setting information includes the type of data to be shared without consent, the accumulator of the target data, the validity period, the activation condition, and the invalidation condition.

[0064] The validity period determines the period during which data can be shared without the user's consent (hereinafter referred to as the "no-consent sharing period"). The example in Figure 9 shows that the stored data can be shared without the user's consent for 10 minutes after the start of no-consent data sharing.

[0065] The enabling condition is a condition (trigger condition) for enabling data sharing without consent. In other words, the enabling condition is a condition set by a user for realizing data sharing without the user's consent. Alternatively, the enabling condition is also a condition for starting data sharing without consent.

[0066] For example, as shown in Fig. 9, thresholds related to vital data such as body temperature and pulse rate are set as the activation condition. Fig. 9 shows that the activation condition is met when the subject's body temperature is abnormal (higher than 39 degrees or lower than 34 degrees) and the pulse rate is abnormal (more than 100 beats or less than 50 beats). When the activation condition is met, the above-mentioned unconsented sharing period is set.

[0067] The invalidation condition is a condition for canceling the unconsented sharing period (unconsented data sharing). For example, as shown in Fig. 9, a threshold value for vital data such as body temperature is set as the invalidation condition. For example, Fig. 9 shows that the unconsented sharing period is canceled when the subject's body temperature returns to normal (35 degrees or higher or 37 degrees or lower).

[0068] In FIG. 9, the validity period, the enabling condition, and the invalidation condition are set to initial values. A user who wishes to change these initial values ​​presses the "change settings" button. For example, the user changes the threshold value of the vital data or lengthens or shortens the validity period according to his / her medical history, current physical condition, symptoms of the disease, etc. For example, a user who has been ill for a long time, is currently in poor physical condition, has severe symptoms of the disease, etc. may set a long unconsented sharing period (validity period). On the other hand, a user who is not worried about illness, is in good physical condition, etc. may set a short unconsented sharing period (validity period). The service server 20-4 of the travel agency may display a GUI on the terminal 30 that allows the validity period, etc. to be changed, and acquire the settings desired by the user.

[0069] The travel agency's service server 20-4 notifies the distribution control server 10 of the acquired non-consent sharing setting information (see FIG. 10). Specifically, the service server 20-4 transmits to the distribution control server 10 a "non-consent sharing setting notification" including the user's personal identification code, the non-consent sharing setting information, the travel agency's business code, and the like.

[0070] The distribution control server 10 identifies the user based on the personal identification code, and stores the unconsented sharing setting information in the corresponding entry of the user information database.

[0071] Furthermore, a user who has made advance settings for when a health condition suddenly changes (a user who has set unconsented sharing setting information) is provided with a wearable device 40. For example, a travel agency delivers the wearable device 40 to the home of user U2 who made the above advance settings. At that time, the travel agency sets the personal identification code of user U2 in the wearable device 40 provided to the user.

[0072] The user wears the wearable terminal 40. In the drawings disclosed in this application, illustration of the terminal 30 and the wearable terminal 40 carried by the user is omitted as appropriate.

[0073] The wearable device 40 acquires vital data of a user (tourist). For example, the wearable device 40 acquires vital data such as body temperature and pulse rate of the user U2 (see FIG. 11). The wearable device 40 transmits the acquired vital data to the travel agency's service server 20-4 periodically or at a predetermined timing. Specifically, the wearable device 40 transmits a "physical condition information notification" including the user's personal identification code, vital data, and location information to the travel agency's service server 20-4.

[0074] The service server 20-4 stores the vital data and location information included in the health information notification in an accumulation database. More specifically, the service server 20-4 identifies the user (customer, tourist) from the personal identification code included in the health information notification, and stores the vital data and location information in the corresponding entry.

[0075] The travel agency's service server 20-4 refers to the acquired vital data and checks whether there is any change in the physical condition of the customer (tourist). More specifically, the service server 20-4 checks whether there is any sudden change in the physical condition of the user using predetermined criteria and the acquired vital data.

[0076] If it is determined that the user's physical condition has suddenly changed, the service server 20-4 notifies the distribution control server 10 of that fact (step S21 in FIG. 12). Specifically, the service server 20-4 transmits to the distribution control server 10 a "notification of sudden change in physical condition" including the user's personal identification code, vital data (vital data at the time of the sudden change in physical condition), the business code of the travel agency, etc.

[0077] The distribution control server 10 identifies the user whose health condition has suddenly changed based on the personal identification code, etc., included in the notification of the sudden change in health condition, and determines whether the activation conditions for that user are met using the acquired vital data (step S22).

[0078] If the enabling condition is met, the distribution control server 10 determines that the user is a user who cannot respond to inquiries about data sharing (a person unable to consent). The distribution control server 10 sets the start of data sharing without consent for the user. That is, the distribution control server 10 sets a period of data sharing without consent for the user whose health condition has suddenly changed. At that time, the distribution control server 10 determines the time to terminate data sharing without consent based on the validity period of the data sharing setting information for the user, and reflects this in the user information database.

[0079] Furthermore, if the health condition of a customer (tourist) suddenly changes, the service server 20-4 of the travel agency makes a "request for medical assistance" to an emergency hospital (emergency hospital close to a tourist spot) close to the tourist (step S23). Specifically, the service server 20-4 transmits a "request for medical assistance" including the personal identification code, vital data, location information, and business code of the travel agency of the person in need of medical assistance whose health condition suddenly changes to the service server 20-3 of the emergency hospital.

[0080] The emergency hospital deals with the person in need of medical care. The emergency hospital acquires information about the health of the person in need of medical care in order to provide the person in need of medical care with more appropriate medical care. Specifically, the service server 20-3 of the emergency hospital specifies data about the person in need of medical care that is necessary for emergency medical care and transmits a sharing request to the distribution control server 10 (step S24). For example, the service server 20-3 requests the distribution control server 10 to share data about the illness (pre-existing illness, current illness) of the person in need of medical care.

[0081] Specifically, the service server 20-3 of the emergency hospital transmits a sharing request including the personal identification code of the person in need of assistance (personal identification code generated by the travel agency), the business code of the travel agency, the data type "disease name", and information of the data sharing destination to the distribution control server 10. In the example of Fig. 12, the information of the data sharing destination is the name of the emergency hospital and the address of the service server 20-3 (address of the data sharing destination).

[0082] The distribution control server 10 identifies the user based on a personal identification code or the like included in the sharing request. If unconsented data sharing is set for the identified user (if the unconsented sharing period has not expired), the distribution control server 10 determines whether or not to accept the sharing request (agreement, disagreement) on behalf of the user.

[0083] Specifically, if the data type of the unconsented sharing setting information and the data type included in the sharing request match, the distribution control server 10 treats the user as having agreed to the sharing request. If the data type of the unconsented sharing setting information and the data type included in the sharing request do not match, the distribution control server 10 treats the user as having rejected the sharing request.

[0084] For example, in the above example, since the user sets “disease name” as the type of target data and the emergency hospital’s service server 20-4 also requests data sharing of “disease name,” the user is treated as having agreed to the sharing request from the emergency hospital.

[0085] If the user is treated as having agreed to the sharing request, the distribution control server 10 transmits a sharing instruction to the service server 20-1 of Hospital A that stores the "disease name" of the user (step S25).

[0086] The service server 20-1 of Hospital A transmits the specific disease name corresponding to the specified data type to the service server 20-3 of the emergency hospital (step S26). The service server 20-3 presents the data acquired from Hospital A (disease name; past illness, current illness) and the vital data acquired from the travel agency to the doctor, etc.

[0087] Based on this data, the doctor begins providing medical care to the user. Medical care activities by the doctor consist of three phases: first aid phase, transportation phase, and medical provision phase.

[0088] In the first aid phase, until the ambulance arrives at the scene (tourist destination), tourist destination staff who receive instructions from the emergency hospital and the doctor at the emergency hospital who has obtained the name of the illness, etc. work together to provide medical care to the person in need of medical care (see Figure 13). The doctor at the emergency hospital instructs the tourist destination staff on the necessary treatment based on the vital signs data and the name of the illness (pre-existing illness, current illness). Instructions are given using a mobile phone, etc.

[0089] The emergency hospital also dispatches an ambulance to the scene. When the ambulance arrives at the scene, the transportation phase begins (see Figure 14). The transportation phase is carried out through cooperation between the ambulance crew and the doctor at the emergency hospital. The doctor at the emergency hospital gives the necessary instructions to the ambulance crew.

[0090] The person in need of medical care is brought to an emergency hospital. When the person in need of medical care is brought to the emergency hospital, the medical care provision phase begins. The doctor at the emergency hospital provides life-saving medical care to the transported user (patient) (see Figure 15).

[0091] In this way, the distribution control server 10 controls data sharing in which data stored in a first server (service server 20-1) is transmitted from the first server to a second server (service server 20-3). At that time, when an enabling condition set in advance by a user is satisfied, the distribution control server 10 sets a no-consent sharing period during which data stored in the service server 20-1 can be shared with the service server 20-3 without the consent of the user. When the service server 20-3 requests data sharing of data stored in the service server 20-1 during the no-consent setting period, the distribution control server 10 instructs the service server 20-1 to transmit the stored data to the service server 20-3.

[0092] Next, each device included in the information distribution system according to the first embodiment will be described in detail.

[0093] [Distribution control server] Fig. 16 is a diagram showing an example of a processing configuration (processing module) of the distribution control server 10 according to the first embodiment. Referring to Fig. 16, the distribution control server 10 includes a communication control unit 201, a user registration unit 202, a setting management unit 203, a personal identification code control unit 204, a location information management unit 205, a consentless sharing setting control unit 206, a data distribution control unit 207, and a storage unit 208.

[0094] The communication control unit 201 is a means for controlling communication with other devices. For example, the communication control unit 201 receives data (packets) from the service server 20. The communication control unit 201 also transmits data to the service server 20. The communication control unit 201 passes data received from other devices to other processing modules. The communication control unit 201 transmits data acquired from other processing modules to other devices. In this way, the other processing modules transmit and receive data to and from other devices via the communication control unit 201. The communication control unit 201 has a function as a receiving unit that receives data from other devices and a function as a transmitting unit that transmits data to other devices.

[0095] The user registration unit 202 is a means for implementing the above-mentioned user registration (system registration of a user). The user registration unit 202 acquires personal information (such as name, date of birth, contact information, etc.) from the terminal 30 of the user.

[0096] When the user registration unit 202 acquires the personal information, it generates a user ID for identifying the user. For example, the user registration unit 202 assigns a unique value each time a user registers in the system, and uses the assigned value as the user ID.

[0097] The user registration unit 202 stores the user ID and personal information in the user information database (see FIG. 17). For example, when user U4 is registered, the entry shown in the bottom row of FIG. 17 is added. Note that at the user registration stage, information regarding data sharing without consent and a personal identification code are not set. Also, the end date and time field shown in FIG. 17 is set with the date and time when the unconsented sharing period ends, but the date is not shown in FIG. 17.

[0098] 17 is merely an example, and is not intended to limit the items to be stored, etc. For example, the date and time of user registration, etc. may be registered in the user information database.

[0099] The user registration unit 202 transmits the generated user ID to the terminal 30.

[0100] The setting management unit 203 is a means for managing various settings related to users who have registered in the system. For example, the setting management unit 203 manages and controls the "unconsented sharing setting information" that the user has set in the travel agency's service server 20-4.

[0101] The setting management unit 203 receives a no-consent sharing setting notification from the service server 20-4. The setting management unit 203 identifies the user who performed the no-consent sharing setting based on the personal identification code (personal identification code generated by the travel agency) included in the no-consent sharing setting notification and the business code of the travel agency. The setting management unit 203 stores the no-consent sharing setting information included in the no-consent sharing setting notification for the identified user in the user information database. Note that in FIG. 17, the field that stores the no-consent sharing setting information is represented as the "setting information field." Also, in FIG. 17, the no-consent sharing setting information is represented collectively as "S01" and "S02."

[0102] Actual unconsented sharing setting information includes information such as the type of target data, the accumulator of the target data, the validity period, the activation conditions, and the invalidation conditions, as shown in Fig. 18. Note that in the drawings including Fig. 17 and Fig. 18, the business codes of the service providers are replaced with the names of the service providers for ease of understanding.

[0103] The personal identification code control unit 204 is a means for controlling the "personal identification code" transmitted and received between the distribution control server 10 and the service server 20. The personal identification code control unit 204 periodically or at a predetermined timing transmits a "user information provision request" including personal identification information (e.g., name, etc.) of a user whose user registration has been completed to each service provider (service server 20).

[0104] The personal identification code control unit 204 receives the user information from the service server 20 in response to the transmission of the user information request. As described above, the user information includes a personal identification code and a business code. The personal identification code control unit 204 stores the acquired personal identification code in the field of the corresponding business code in the user information database.

[0105] For example, when user registration for user U1 has been performed, a user information request including personal identification information of user U1 is sent periodically or at a predetermined timing to the service server 20. If a personal identification code for user U1 has been generated at the timing of receiving the personal identification information of user U1, the service server 20 sends the user information to the distribution control server 10 in response to the user information request.

[0106] The personal identification code control unit 204 extracts the user's personal identification code and business code from the user information, and stores the personal identification code in the user information database.

[0107] In this way, the personal identification code control unit 204 stores the user ID of the user and the personal identification code generated by each service provider (service server 20) in association with each other. Since different service providers generate different personal identification codes, the user information database stores the personal identification code for each service provider.

[0108] The location information management unit 205 is a means for managing location information acquired from a service provider. The location information management unit 205 stores the location information acquired from each service server 20 in a location information database (see FIG. 19). As shown in FIG. 19, the location information database stores a personal identification code, a business code, and a data type in association with each other. Note that the location information database shown in FIG. 19 is merely an example, and is not intended to limit the items to be stored. For example, the date and time when the location information was registered may be registered in the location information database.

[0109] The non-consent sharing setting control unit 206 is a means for controlling the setting of non-consent data sharing. The non-consent sharing setting control unit 206 mainly controls the "notification of sudden change in health condition" received from the service server 20-4. The operation of the non-consent sharing setting control unit 206 according to the first embodiment will be described with reference to FIG. 20.

[0110] The non-consent sharing setting control unit 206 extracts the personal identification code and the business code included in the sudden change in health condition notification received from the service server 20-4. The non-consent sharing setting control unit 206 refers to the user information database and identifies the user corresponding to the extracted personal identification code and business code (step S101).

[0111] The non-consent sharing setting control unit 206 refers to the non-consent sharing setting information field of the identified user, and determines whether non-consent sharing setting information is set for the identified user (step S102).

[0112] If no consent-free sharing setting information is set (step S102, No branch), the consent-free sharing setting control unit 206 does not take any particular action. Alternatively, the consent-free sharing setting control unit 206 notifies the service server 20-4, which is the source of the sudden change in health condition notification, that no consent-free sharing setting information is set for the corresponding user.

[0113] If the specified user has unconsented sharing setting information set (step S102, Yes branch), the unconsented sharing setting control unit 206 reads out the enabling condition of the setting information from the user information database. The unconsented sharing setting control unit 206 uses the vital data included in the sudden change in health condition notification to determine whether the read out enabling condition is satisfied (step S103).

[0114] If the validation condition is not met (step S103, No branch), the non-consent sharing setting control unit 206 does not take any particular action.

[0115] If the enabling condition is met (step S103, Yes branch), the non-consent sharing setting control unit 206 sets a non-consent sharing period for the user (step S104). If the enabling condition is met, the non-consent sharing setting control unit 206 sets the user to "person unable to consent."

[0116] More specifically, the non-consent sharing setting control unit 206 sets a flag in the non-consent sharing field of the user information database to set that the non-consent sharing period is in progress. The non-consent sharing setting control unit 206 also calculates the date and time after the valid period has elapsed from the current time, and writes the calculated date and time in the non-consent sharing end date and time field (end date and time field in FIG. 17) of the user information database. The non-consent sharing setting control unit 206 sets the end date and time of the non-consent sharing period based on the valid period set by the user.

[0117] The unconsented sharing setting control unit 206 performs control relating to the cancellation of unconsented data sharing in addition to the above-described processing of the sudden change in health condition notification.

[0118] The non-consent sharing setting control unit 206 accesses the user information database periodically or at a predetermined timing, and checks the setting value (end date and time) of the non-consent sharing end date and time field. The non-consent sharing setting control unit 206 compares the current time with the setting value, and if it is determined that the non-consent sharing period has ended, it resets the flag of the corresponding non-consent sharing field. In other words, the non-consent sharing setting control unit 206 reflects the fact that the non-consent sharing period has ended in the user information database.

[0119] Furthermore, the non-consent sharing setting control unit 206 periodically acquires vital data of a user (person unable to consent) for whom non-consent data sharing has been set, from the service server 20-4. Specifically, the non-consent sharing setting control unit 206 acquires vital data of a person unable to consent by transmitting a sharing instruction to the service server 20-4 via the data distribution control unit 207. Alternatively, the service server 20-4 may periodically transmit vital data of a person requiring assistance to the distribution control server 10, so that the non-consent sharing setting control unit 206 acquires vital data.

[0120] The non-consent sharing setting control unit 206 uses the acquired vital data to determine whether the invalidation condition for the user is met. If the invalidation condition is not met, the non-consent sharing setting control unit 206 does not take any special action. If the invalidation condition is met, the non-consent sharing setting control unit 206 cancels the non-consent data sharing (non-consent sharing period) for the person who cannot give consent. Specifically, the non-consent sharing setting control unit 206 resets the flag in the corresponding non-consent data sharing field.

[0121] In this way, when the invalidation condition set by the user for canceling the non-consent sharing period is satisfied, the non-consent sharing setting control unit 206 cancels the non-consent sharing period.

[0122] The data distribution control unit 207 is a means for controlling data distribution of accumulated data of users (user data held by a service provider). The data distribution control unit 207 controls data distribution related to "sharing". The operation of the data distribution control unit 207 according to the first embodiment will be described with reference to FIG. 21.

[0123] The data distribution control unit 207 receives a sharing request from the service server 20 (step S201). The sharing request includes the personal identification code of the user who is the target of data acquisition, the business code, the type of data that the data sharing destination wishes to acquire, information on the data sharing destination (data transmission destination), and the like.

[0124] For example, in the example of Fig. 7 where user U1 is in good health, the sharing request includes the personal identification code generated by Hospital B for user U1, the business code of Hospital B, the data type (e.g., disease name), and information about Hospital B (the address of service server 20-2). In contrast, in the example of Fig. 12 where user U2's health has suddenly changed, the sharing request includes the personal identification code generated by the travel agency for user U2, the business code of the emergency hospital, the data type (disease name), and information about the emergency hospital (the address of service server 20-3).

[0125] The data distribution control unit 207 identifies a target person of data distribution based on the personal identification code and business code included in the sharing request (step S202). Specifically, the data distribution control unit 207 refers to the user information database shown in FIG. 17 to identify the target person.

[0126] In the example of Fig. 7, when a sharing request including the business code of Hospital B and the personal identification code of "IDB1" is received from Hospital B, the data distribution control unit 207 determines that user U1 is the target of data distribution from the entry in the second line shown in Fig. 17. In the example of Fig. 12, when a sharing request including the business code of the travel agency and the personal identification code of "IDC1" is received from the emergency hospital, the data distribution control unit 207 determines that user U2 is the target of data distribution from the entry in the third line shown in Fig. 17.

[0127] The data distribution control unit 207 identifies a service provider that stores the necessary data using the identified user's personal identification code and the data type included in the sharing request. Specifically, the data distribution control unit 207 refers to the location information database shown in Fig. 19 and identifies a service provider that stores data corresponding to the data type included in the sharing request.

[0128] In the example of Fig. 7, Hospital A is identified based on the personal identification code "IDA1" of user U1 and the data type "disease name" included in the sharing request. Similarly, in the example of Fig. 12, Hospital A is identified based on the personal identification code "IDA2" of user U2 and the data type "disease name" included in the sharing request.

[0129] If the combination of the user's personal identification code and the data type included in the sharing request is not stored in the location information database, the data distribution control unit 207 sends a negative response to the sender of the sharing request, indicating that data sharing is not possible. In the above example, if the combination of user U1's identification code "IDA1" and data type "disease name" is not registered in the location information database, a negative response is sent to Hospital B (service server 20-2).

[0130] When the target of data distribution and the accumulator of the data to be distributed are specified, the data distribution control unit 207 accesses the user information database and determines whether or not to inquire about data sharing of the target of data distribution.

[0131] Specifically, the data distribution control unit 207 checks whether or not a sharing period without consent is set for the data distribution target (step S203). Specifically, the data distribution control unit 207 refers to the sharing period without consent field of the data distribution target, and acquires whether or not a sharing period without consent is set depending on whether or not a flag is set in the field.

[0132] If the unconsented sharing period has not been set (step S203, No branch), the data distribution control unit 207 inquires of the data distribution target regarding data sharing (step S204).

[0133] If the non-consent sharing period is set (step S203, Yes branch), the data distribution control unit 207 does not inquire of the data distribution target regarding data sharing. The data distribution control unit 207 treats the data distribution target as having agreed to the data sharing inquiry (set as agreed; step S205).

[0134] When making an inquiry about data sharing to a data distribution target, the data distribution control unit 207 transmits the inquiry about data sharing to the contact information of the data distribution target. In the example of Fig. 7, the inquiry is transmitted to the terminal 30 possessed by the user U1. In contrast, in the example of Fig. 12, since the user U2 is a person who cannot give consent, the inquiry is not transmitted to the terminal 30 of the user U2.

[0135] The data sharing inquiry includes information such as the requester of the data sharing, the data accumulator, the type of data to be shared, etc. In the above example, Hospital B is set as the requester of the data sharing, Hospital A is set as the data accumulator, and "disease name" is set as the type of data to be shared.

[0136] The data distribution control unit 207 receives a response to the data sharing inquiry from the terminal 30 .

[0137] If the user rejects the data sharing (step S206, No branch), the data distribution control unit 207 notifies the data sharing request source that the data sharing is not possible (step S207). In the example of Fig. 7, if the user U1 rejects the request for data sharing, the data distribution control unit 207 transmits a negative response to the sharing request to the service server 20-2 of Hospital B.

[0138] If the user agrees to data sharing (step S206, Yes branch) or if the user is treated as having agreed to data sharing, the data circulation control unit 207 transmits a sharing instruction to the data accumulator (step S208). In the above example, the sharing instruction is transmitted to the service server 20-1 of Hospital A, which is the data accumulator. In this case, the sharing instruction is transmitted to Hospital A in both the example of FIG. 7 and the example of FIG. 12.

[0139] The sharing instruction includes a personal identification code generated by the data accumulator, information on the data sharing destination, and the data type of the data to be shared. In the example of Fig. 7, a sharing instruction including the personal identification code "IDA1" of user U1, the address of the service server 20-2 of Hospital B, and the data type "disease name" is sent to the service server 20-1 of Hospital A. In the example of Fig. 12, a sharing instruction including the personal identification code "IDA2" of user U2, the address of the service server 20-3 of the emergency hospital, and the data type "disease name" is sent to the service server 20-1 of Hospital A.

[0140] In this way, the data distribution control unit 207 transmits a sharing instruction including a personal identification code generated by the data accumulator, the personal identification code of a user who has agreed to data sharing or a user who is treated as having agreed.

[0141] The storage unit 208 stores information necessary for the operation of the distribution control server 10. A user information database is constructed in the storage unit 208. Furthermore, the storage unit 208 also stores a database that stores names of service providers in association with their business codes.

[0142] [Service Server] Fig. 22 is a diagram showing an example of a processing configuration (processing module) of the service server 20 according to the first embodiment. Referring to Fig. 22, the service server 20 includes a communication control unit 301, a personal identification code management unit 302, a sharing request unit 303, a data accumulation unit 304, a data distribution unit 305, and a storage unit 306. The service server 20-1 of Hospital A and the service server 20-2 of Hospital B each have the configuration shown in Fig. 22.

[0143] The communication control unit 301 is a means for controlling communication with other devices. For example, the communication control unit 301 receives data (packets) from the distribution control server 10. The communication control unit 301 also transmits data to the distribution control server 10. The communication control unit 301 passes the data received from other devices to other processing modules. The communication control unit 301 transmits data acquired from other processing modules to other devices. In this way, the other processing modules transmit and receive data to and from other devices via the communication control unit 301. The communication control unit 301 has a function as a receiver that receives data from other devices and a function as a transmitter that transmits data to other devices.

[0144] The personal identification code management unit 302 is a means for managing personal identification codes. For example, when providing a service to a new customer, the personal identification code management unit 302 generates a personal identification code for the customer. Alternatively, the personal identification code management unit 302 obtains a personal identification code generated by a staff member of the service provider or the like.

[0145] The personal identification code management unit 302 transmits corresponding user information in response to receiving a user information provision request including the user's personal identification information from the distribution control server 10. The user information includes a personal identification code and a business code.

[0146] The sharing request unit 303 is a means for requesting the information distribution business operator to "share" the user's data. The sharing request unit 303 transmits a sharing request to the distribution control server 10 in response to an operation by a staff member of the service business operator or the like. Specifically, the sharing request unit 303 transmits a sharing request to the distribution control server 10, the sharing request including the personal identification code of the user who is the subject of data acquisition, the business code of the user's own device, the type of data desired to be acquired, information on the data sharing destination, and the like.

[0147] The data storage unit 304 is a means for storing data resulting from the provision of a service to a user. The data storage unit 304 stores the personal identification code of the user and the data resulting from the provision of the service to the user in an accumulation database in association with each other (see FIG. 23).

[0148] As shown in Fig. 23, the data accumulation unit 304 stores information on the generated data in a field corresponding to the type of the generated data. Note that Fig. 23 shows an example of an accumulation database constructed in the service server 20-1 of Hospital A.

[0149] The data accumulation unit 304 transmits location information to the distribution control server 10 every time data is stored in the accumulation database. For example, when a service is provided to a user U1 with a personal identification code "IDA1" and data on a disease name is generated as a medical examination result, location information including the personal identification code "IDA1", the business code "Hospital A", and the data type "Disease Name" is transmitted to the distribution control server 10.

[0150] The data distribution unit 305 is a means for realizing data distribution by “sharing.” The data distribution unit 305 processes a “sharing instruction” received from the distribution control server 10.

[0151] When a sharing instruction is received, the data distribution unit 305 refers to the accumulation database and identifies an entry corresponding to the personal identification code and data type included in the sharing instruction. For example, when a sharing instruction including the personal identification code "IDA1" and the data type "disease name" is received, the data distribution unit 305 identifies the entry shown in the top row of Fig. 23.

[0152] The data distribution unit 305 transmits the accumulated data described in the corresponding data type field of the identified entry to the data sharing destination specified in the sharing instruction. In the example of Fig. 7, "stomach cancer" is transmitted to the service server 20-2 of Hospital B. In the example of Fig. 12, "lung cancer" is transmitted to the service server 20-3 of the emergency hospital.

[0153] The storage unit 306 stores information necessary for the operation of the service server 20 .

[0154] [Emergency hospital service server] The service server 20-3 of the emergency hospital includes a rescue request processing unit 307 in addition to the components shown in FIG. 22 (see FIG. 24).

[0155] The rescue request processor 307 is a means for processing a rescue request received from the travel agency's service server 20-4.

[0156] When a rescue request is received from the service server 20-4, the rescue request processing unit 307 identifies the location (tourist spot) of the person in need of rescue based on the location information included in the rescue request (location information of the user whose physical condition has suddenly changed). The rescue request processing unit 307 notifies staff of an emergency hospital or the like of the identified location. The staff dispatches an ambulance to the person in need of rescue. Alternatively, the rescue request processing unit 307 may dispatch the ambulance.

[0157] The rescue request processing unit 307 transmits a sharing request including a personal identification code, business code, data type, and information on the data sharing destination to the distribution control server 10. At this time, the rescue request processing unit 307 sets the personal identification code of the person in need of rescue generated by the travel agency (the personal identification code included in the rescue request) as the personal identification code. The rescue request processing unit 307 sets the business code of the travel agency as the business code. The rescue request processing unit 307 sets the address of its own device (service server 20-4) and the like as the information on the data sharing destination. Note that the type of data required for rescue (for example, the name of a disease) is set as the data type.

[0158] When a negative response is received from the distribution control server 10, the rescue request processing unit 307 notifies staff, doctors, etc. that the data of the person in need of rescue cannot be acquired.

[0159] When data corresponding to the data type requested for sharing (for example, disease name) is received from the data accumulator, the rescue request processing unit 307 presents the acquired data and the vital data included in the rescue request to a doctor or the like.

[0160] [Travel agency service server] The travel agency service server 20-4 further comprises a shared setting management unit 308 and a physical condition information processing unit 309 in addition to the components shown in FIG. 22 (see FIG. 25).

[0161] The sharing setting management unit 308 is a means for managing the unauthorized sharing setting information input by the user. The sharing setting management unit 308 acquires unauthorized sharing setting information in accordance with the user's operation on the travel agency's homepage. For example, the sharing setting management unit 308 acquires unauthorized sharing setting information using a GUI as shown in FIG. 9.

[0162] When the sharing setting management unit 308 acquires the no-consent sharing setting information, it transmits to the distribution control server 10 a no-consent sharing setting notification including the user's personal identification code, the travel agency's business code, and the acquired no-consent sharing setting information.

[0163] When a user receives services from a travel agency, the user must register as a member. At that time, a membership number or the like is generated as the user's personal identification code.

[0164] The physical condition information processing unit 309 is a means for processing the physical condition information notification received from the wearable device 40 worn by the user. When the physical condition information notification is received from the wearable device 40, the physical condition information processing unit 309 identifies the user from a personal identification code included in the notification.

[0165] The physical condition information processing unit 309 accesses an internal database (accumulation database) and stores the location information and vital data included in the physical condition information notification in the entry of the identified user (see FIG. 26).

[0166] The health information processing unit 309 judges the user's health condition using the vital data of the user upon receiving a health information notification or by periodically accessing the accumulation database. Specifically, the health information processing unit 309 compares the vital data with a predetermined standard and judges whether the user's health condition has suddenly changed.

[0167] For example, the physical condition information processing unit 309 compares the vital data of each user with a standard such as "body temperature of 39 degrees or higher and pulse rate of 100 or more" to extract (discover) users whose physical condition has suddenly changed.

[0168] When a person whose health has suddenly changed is found, the health information processing unit 309 transmits a "notice of sudden change in health" to the distribution control server 10. The notice of sudden change in health includes a personal identification code of the person whose health has suddenly changed, a business code of the travel agency, vital data of the person whose health has suddenly changed, etc.

[0169] Furthermore, when a person whose health condition has suddenly changed is detected, the health condition information processing unit 309 identifies an emergency hospital to which medical assistance should be requested for the person whose health condition has suddenly changed, based on the location information of the person. For example, the health condition information processing unit 309 identifies an emergency hospital to which medical assistance should be requested for the person whose health condition has suddenly changed, by referring to table information or the like that stores location information of each emergency hospital.

[0170] The health information processing unit 309 transmits a "request for medical assistance" to the service server 20-3 of the identified emergency hospital. The request for medical assistance includes a personal identification code of the person whose health has suddenly changed, a business code of the travel agency, vital data of the person whose health has suddenly changed (vital data at the time of the sudden change in health), and location information.

[0171] [Device] Fig. 27 is a diagram showing an example of a processing configuration (processing module) of the terminal 30 according to the first embodiment. Referring to Fig. 27, the terminal 30 includes a communication control unit 401, a personal information input unit 402, a setting control unit 403, an inquiry processing unit 404, and a storage unit 405.

[0172] The communication control unit 401 is a means for controlling communication with other devices. For example, the communication control unit 401 receives data (packets) from the distribution control server 10. The communication control unit 401 also transmits data to the distribution control server 10. The communication control unit 401 passes the data received from other devices to other processing modules. The communication control unit 401 transmits data acquired from other processing modules to other devices. In this way, the other processing modules transmit and receive data to and from other devices via the communication control unit 401. The communication control unit 401 has a function as a receiver that receives data from other devices and a function as a transmitter that transmits data to other devices.

[0173] The personal information input unit 402 is a means for inputting personal information to the distribution control server 10 when registering a user. The personal information input unit 402 uses any means to input personal information (such as name, date of birth, and contact information) to the distribution control server 10. For example, the personal information input unit 402 acquires the above personal information from the user using a GUI, and transmits the acquired personal information to the distribution control server 10.

[0174] The personal information input unit 402 stores the user ID issued by the distribution control server 10 in the storage unit 405 .

[0175] The setting control unit 403 is a means for controlling the unauthorized sharing setting information. The setting control unit 403 accesses a homepage provided by the service server 20-4 of the travel agency in response to a user's operation. The setting control unit 403 transmits unauthorized sharing setting information acquired from a GUI (GUI shown in FIG. 8 and FIG. 9) displayed on the homepage to the service server 20-4.

[0176] The inquiry processor 404 is a means for processing an inquiry received from the distribution control server 10 when data is distributed by sharing. The inquiry processor 404 acquires the user's intention (agreement or disagreement to data sharing) using a GUI that matches the content of the data sharing inquiry. The inquiry processor 404 transmits a response including the user's intention to the distribution control server 10.

[0177] The storage unit 405 stores information necessary for the operation of the terminal 30 .

[0178] [Wearable devices] 28 is a diagram illustrating an example of a processing configuration (processing module) of the wearable terminal 40 according to the first embodiment. Referring to FIG. 28, the wearable terminal 40 includes a communication control unit 501, a physical condition information control unit 502, and a storage unit 503.

[0179] The communication control unit 501 is a means for controlling communication with other devices. For example, the communication control unit 501 transmits data to the service server 20-4. The communication control unit 501 transmits data acquired from other processing modules to other devices.

[0180] The physical condition information control unit 502 is a unit that controls the physical condition information to be transmitted to the service server 20-4. For example, the physical condition information control unit 502 acquires vital data of the user as the physical condition information.

[0181] The physical condition information control unit 502 acquires vital data of the user periodically or at a predetermined timing. Specifically, the physical condition information control unit 502 acquires vital data such as body temperature and pulse rate using sensors (such as a temperature sensor and a heart rate sensor) built into the wearable terminal 40.

[0182] The physical condition information control unit 502 measures the current location periodically or at a predetermined timing. The physical condition information control unit 502 receives GPS signals from GPS (Global Positioning System) satellites to perform positioning, and generates location information including the latitude, longitude, and altitude of the device itself. Alternatively, the physical condition information control unit 502 may communicate with a wireless access point, and treat the location of the wireless access point as the location of the device itself. Alternatively, the physical condition information control unit 502 may generate location information based on the strength of radio waves received from the wireless access point.

[0183] The physical condition information control unit 502 periodically or at a predetermined timing transmits a physical condition information notification including a personal identification code, vital data, and location information to the travel agency's service server 20-4. For example, the physical condition information control unit 502 generates a physical condition information notification when the vital data is acquired or when the current location is measured, and transmits the generated physical condition information notification to the service server 20-4.

[0184] The storage unit 503 stores information necessary for the operation of the wearable terminal 40. For example, the storage unit 503 stores a personal identification code set in the wearable terminal 40 by a staff member of a travel agency or the like.

[0185] [System Operation] Next, the operation of the information distribution system according to the first embodiment will be described.

[0186] Fig. 29 is a sequence diagram showing an example of the operation of the information distribution system according to the embodiment 1. With reference to Fig. 29, data sharing when a user loses consciousness at a tourist spot will be described.

[0187] The distribution control server 10 receives a notification of a sudden change in health condition from the service server 20-4 of the travel agency (step S301).

[0188] The distribution control server 10 sets the target of data sharing to a person who cannot consent (step S302). The distribution control server 10 sets a non-consent sharing period for the target of data sharing.

[0189] The emergency hospital service server 20-3 receives the emergency medical request from the travel agency service server 20-4 (step S303).

[0190] The service server 20-3 transmits a sharing request regarding the person in need of assistance to the distribution control server 10 (step S304).

[0191] Since the target of the sharing request is a person who cannot give consent, the distribution control server 10 transmits a sharing instruction to the service server 20 of the data accumulator (step S305).

[0192] The service server 20 of the data accumulator transmits the accumulated data of the instructed user to the service server 20-3 of the emergency hospital (data sharing; step S306).

[0193] As described above, in the information distribution system according to the first embodiment, the third server (service server 20-4) acquires health information on the user's health from the wearable terminal 40 worn by the user, and detects a sudden change in the user's health based on the health information. When the service server 20-4 detects a sudden change in the user's health, it notifies the distribution control server 10 of the sudden change in the user's health. If the activation condition of the user who has been notified of the sudden change in health is satisfied, the distribution control server 10 sets a non-consent sharing period for the user who has been notified of the sudden change in health. Furthermore, when the service server 20-4 detects a sudden change in the user's health, it requests the service server 20-3 to rescue the user whose health has suddenly changed. The service server 20-3 requests the distribution control server 10 to share data necessary to rescue the user who has been requested to be rescued. Since a non-consent sharing period is set for a person whose health condition suddenly changes, the distribution control server 10 can transfer data necessary for providing medical care to the person in need of medical care (e.g., the name of the illness) to the emergency hospital service server 20-3 without obtaining the consent of the person in need of medical care.

[0194] As described above, in the first embodiment, the organizations that manage the "vital data (first information)" used as the activation condition and the "medical history (second information)" used by doctors at emergency hospitals are different. The user registers the activation condition in the system in advance and gives prior consent for the case of a sudden change in condition. The distribution control server 10 judges whether the activation condition is satisfied based on the user's vital data, and if satisfied, issues a sharing instruction to the hospital (hospital that accumulates medical history, etc.). As a result, the sharing period of the "medical history (disease name)", which is sensitive personal data, can be minimized. Furthermore, the distribution control server 10 stores an invalidation condition for data sharing without consent in the unconsented sharing setting information, so that the sharing period of the above-mentioned medical history, etc. can be minimized. For example, the user sets in advance an invalidation condition for ending data sharing without consent when the vital data recovers to a predetermined value.

[0195] [Second embodiment] Next, the second embodiment will be described in detail with reference to the drawings.

[0196] In the first embodiment, a case where a user's physical condition suddenly changes during a sightseeing tour planned by a travel agency is described. In the second embodiment, a case where a user's physical condition suddenly changes during daily life is described.

[0197] The following description will focus on the differences between the first and second embodiments.

[0198] In the second embodiment, the user sets the unauthorized sharing setting information directly to the information distribution company (distribution control server 10) rather than through a travel agency. The user who registered the unauthorized sharing setting information is provided with a wearable device 40 by the information distribution company.

[0199] With reference to FIG. 30, the outline of the operation of the information distribution system according to the second embodiment will be described.

[0200] The wearable terminal 40 worn by the user transmits a physical condition information notification to the distribution control server 10 periodically or at a predetermined timing (step S31).

[0201] The distribution control server 10 detects a change in the user's physical condition using the vital data included in the physical condition information notification. More specifically, the distribution control server 10 determines whether the enabling condition set by the user is satisfied (step S32).

[0202] If the activation condition is met and it is determined that the user requires medical assistance, the distribution control server 10 identifies the user's current location from the location information included in the health information notification, and transmits a request for medical assistance to the service server 20-3 of an emergency hospital close to the user (step S33).

[0203] When an emergency hospital receives a request for medical assistance, it dispatches an ambulance to the person in need of medical assistance.

[0204] The distribution control server 10 transmits a sharing instruction to the service server 20-1 of Hospital A that stores the names of the illnesses (past illnesses, current illnesses) of the users (step S34).

[0205] The service server 20-1 of Hospital A transmits the name of the user's illness (specific name of illness such as stomach cancer) to the designated destination (service server 20-3 of the emergency hospital) (step S35).

[0206] The doctor at the emergency hospital will carry out rescue activities (first aid phase, transportation phase, medical care provision phase) based on the user's vital data included in the rescue request and the name of the user's illness sent from Hospital A.

[0207] Next, each device for realizing the information distribution system according to the second embodiment will be described in detail.

[0208] Fig. 31 is a diagram showing an example of a processing configuration (processing module) of the distribution control server 10 according to the second embodiment. Referring to Fig. 31, a physical condition information processing unit 209 is added instead of the unconsented sharing setting control unit 206 in the distribution control server 10 according to the first embodiment.

[0209] The setting management unit 203 according to the second embodiment acquires unauthorized sharing setting information from a user and stores it in a user information database. In addition, identification information such as a user ID is set in the wearable terminal 40 provided to the user who has set unauthorized sharing setting information.

[0210] The physical condition information processing unit 209 has some functions of the non-consent sharing setting control unit 206 of the distribution control server 10 and the physical condition information processing unit 309 of the service server 20-4 described in the first embodiment. Specifically, the physical condition information processing unit 209 acquires vital data from the wearable device 40 of the user, and uses the vital data to determine whether or not the user is unable to give consent.

[0211] If the user is determined to be unable to give consent, the physical condition information processing unit 209 transmits a rescue request to the service server 20-3 of the emergency hospital. Also, if the user is determined to be unable to give consent, the physical condition information processing unit 209 transmits a sharing instruction to Hospital A that stores the user data of the user (data set as target data in the unconsented sharing setting information).

[0212] Furthermore, the physical condition information processing unit 209 also controls the release of the unconsented sharing period described in the first embodiment. A detailed description of the rescue request and the sharing instruction will be omitted because the contents of the rescue request and the sharing instruction in the second embodiment will be clear to those skilled in the art who have read the description of the first embodiment.

[0213] The processing configuration of the service server 20-3 of the emergency hospital according to the second embodiment can be the same as the processing configuration of the service server 20-3 according to the first embodiment. The rescue request processing unit 307 of the service server 20-3 according to the second embodiment presents the name of the disease acquired from the service server 20-1 of the data accumulator and the vital data acquired from the distribution control server 10 to a doctor or the like.

[0214] The processing configuration and operation of the service server 20-1 and the wearable terminal 40 according to the second embodiment can be the same as the processing configuration and operation of the service server 20-1 and the wearable terminal 40 according to the first embodiment. Therefore, the description of these servers and terminals will be omitted.

[0215] As described above, in the information distribution system according to the second embodiment, the distribution control server 10 acquires vital data of a user from the wearable terminal 40 worn by the user. The distribution control server 10 uses the acquired vital data to determine whether or not the activation condition of the user is satisfied. If the activation condition is satisfied, the distribution control server 10 instructs the service server 20-1 of Hospital A to transmit the data accumulated in Hospital A to an emergency hospital. As a result, even if the user's physical condition suddenly changes outside of the trip, an appropriate non-consent sharing period is set for the user, and the user's privacy is appropriately protected.

[0216] Next, the hardware of each device constituting the information distribution system will be described.

[0217] The distribution control server 10 can be configured by an information processing device (so-called a computer), and has the configuration exemplified in Fig. 32. For example, the distribution control server 10 has a processor 311, a memory 312, an input / output interface 313, and a communication interface 314. The components such as the processor 311 are connected by an internal bus or the like, and are configured to be able to communicate with each other.

[0218] However, the configuration shown in Fig. 32 is not intended to limit the hardware configuration of the distribution control server 10. The distribution control server 10 may include hardware not shown, and may not include the input / output interface 313 as necessary. Furthermore, the number of processors 311 and the like included in the distribution control server 10 is not intended to be limited to the example shown in Fig. 32, and for example, the distribution control server 10 may include multiple processors 311.

[0219] The processor 311 is, for example, a programmable device such as a central processing unit (CPU), a micro processing unit (MPU), or a digital signal processor (DSP). Alternatively, the processor 311 may be a device such as a field programmable gate array (FPGA), or an application specific integrated circuit (ASIC). The processor 311 executes various programs including an operating system (OS).

[0220] The memory 312 is a random access memory (RAM), a read only memory (ROM), a hard disk drive (HDD), a solid state drive (SSD), etc. The memory 312 stores an OS program, application programs, and various data.

[0221] The input / output interface 313 is an interface for a display device and an input device (not shown). The display device is, for example, a liquid crystal display, etc. The input device is, for example, a keyboard, a mouse, etc. that accepts user operations.

[0222] The communication interface 314 is a circuit, a module, etc. that communicates with other devices. For example, the communication interface 314 includes a network interface card (NIC).

[0223] The functions of the distribution control server 10 are realized by various processing modules. The processing modules are realized, for example, by the processor 311 executing a program stored in the memory 312. The program can be recorded in a computer-readable storage medium. The storage medium can be a non-transitory medium such as a semiconductor memory, a hard disk, a magnetic recording medium, or an optical recording medium. That is, the present invention can also be embodied as a computer program product. The program can be downloaded via a network, or updated using a storage medium storing the program. The processing modules may also be realized by a semiconductor chip.

[0224] Note that the service server 20, the terminal 30, the wearable terminal 40, etc. can also be configured by information processing devices like the distribution control server 10, and their basic hardware configurations are not described here because they are no different from the distribution control server 10. For example, the wearable terminal 40 may be provided with a sensor or the like for acquiring vital data of the user.

[0225] The distribution control server 10, which is an information processing device, is equipped with a computer, and the functions of the distribution control server 10 can be realized by causing the computer to execute a program. Also, the distribution control server 10 executes a control method of the distribution control server 10 by the program.

[0226] [Variations] The configuration, operation, and the like of the information distribution system described in the above embodiment are merely examples, and are not intended to limit the system configuration, and the like.

[0227] In the above embodiment, it has been described that a travel agency acquires vital data of a user, detects a sudden change in the user's health condition based on the acquired vital data, and notifies the distribution control server 10 of the change. However, the business entity that detects such a sudden change in the user's health condition and notifies the distribution control server 10 of the change is not limited to a travel agency. Any business entity can detect and notify the sudden change in health condition. For example, a business entity that operates a care facility or the like may detect and notify the sudden change in the user's health condition.

[0228] In the above embodiment, it has been described that the unauthorized sharing setting information of the user is registered in the distribution control server 10 via the travel agency's service server 20-4. However, the unauthorized sharing setting information may be directly input to the distribution control server 10. For example, the unauthorized sharing setting information may be registered on a personal portal that the distribution control server 10 creates for each user.

[0229] In the above embodiment, the travel agency's service server 20-4 acquires a health information notification (vital data) from the wearable device 40. However, the wearable device 40 may transmit the health information notification (vital data) to the distribution control server 10. In this case, the distribution control server 10 may detect a sudden change in the user's health using the acquired vital data and a preset activation condition. When a sudden change in health is detected, the distribution control server 10 sets the user as a person unable to consent and notifies the travel agency of the sudden change in the user's health. The travel agency's service server 20-4 transmits a medical aid request to the emergency hospital's service server 20-3 to provide medical aid to the user.

[0230] In the above embodiment, it has been described that when a user is determined to be unable to consent, the distribution control server 10 issues a sharing instruction to the data accumulator without inquiring about data sharing to the user. However, even when a user is determined to be unable to consent, the distribution control server 10 may inquire about data sharing to the user. Specifically, when the distribution control server 10 does not receive a response (agreement or refusal to share data) from the user within a predetermined period (e.g., 3 minutes) after the inquiry, the distribution control server 10 may send a sharing instruction to the data accumulator. That is, even if the enabling condition is met, it is not necessarily the case that the user is in a situation where he or she cannot operate the terminal 30. Therefore, the distribution control server 10 may further limit the opportunities for sharing data without the user's consent.

[0231] In the above embodiment, a case has been described in which a threshold value related to the vital data of a user is set as the activation condition or the invalidation condition. However, a condition related to data other than vital data may be set as the activation condition or the invalidation condition. For example, a threshold value related to an activity amount measured using an acceleration sensor or the like may be set as the activation condition or the invalidation condition. Specifically, an activation condition may be set such that if the movement of a user is not detected for a predetermined period of time, the user is determined to be unconscious.

[0232] In the above embodiment, the type of data shared when data is shared without consent is described by taking "disease name" as an example. However, it goes without saying that the type of data shared when data is shared without consent is not limited to "disease name". For example, test results and health check results (weight, height) may be the subject of data sharing without consent. Alternatively, information such as a health insurance card number may be the subject of data sharing without consent. Alternatively, information regarding the user's family (for example, contact information, etc.) may be the subject of data sharing without consent.

[0233] In the above embodiment, a case where data is acquired from one data accumulator when data is shared without consent has been described. However, data may be acquired from multiple data accumulators when data is shared without consent, and the acquired data may be transmitted to an emergency hospital or the like. In this case, the service server 20-4 may be configured to allow multiple combinations of target data types and data accumulators to be input on a GUI screen such as that shown in FIG. 9. That is, the non-consensual sharing setting information may include multiple combinations of target data types and target data accumulators. In this case, the distribution control server 10 may transmit a sharing instruction to each data accumulator.

[0234] In the above embodiment, a case has been described in which the unconsented sharing setting information includes a validity period and an invalidation condition. However, this information does not have to be included in the unconsented sharing setting information. For example, a predetermined period may be used for the validity period. Furthermore, the invalidation condition is not necessary if the unconsented data sharing is cancelled when the validity period has elapsed. Alternatively, the distribution control server 10 may cancel the unconsented data sharing in response to receiving information from the emergency hospital that provided medical care to the person in need of medical care that the user has recovered.

[0235] In the above embodiment, the travel agency service server 20-4 detects a sudden change in the user's physical condition. However, the detection may be performed by the wearable device 40. The wearable device 40 may measure the amount of activity of the user according to an output signal from an acceleration sensor or the like, and when it determines that the activity has stopped, may transmit a physical condition information notification including the vital data of the user to the travel agency service server 20-4.

[0236] The travel agency's service server 20-4 may store not only the latest vital data but also vital data transmitted in the past. The service server 20-4 (physical condition information processing unit 309) may detect a sudden change in the user's physical condition using the past vital data (vital data history). In this case, the service server 20-4 may input the vital data (vital data history) to a learning model obtained by machine learning to detect a sudden change in the user's physical condition.

[0237] In the above embodiment, it has been described that a sharing request is sent to the distribution control server 10 once during the unconsented sharing period, and data sharing without consent is realized. However, data sharing without consent can be realized any number of times during the unconsented sharing period.

[0238] In the above embodiment, it has been described that when the distribution control server 10 receives a notification of a sudden change in health condition from a travel agency, it sets the end time of the unconsented sharing period according to the validity period set in advance. Here, the distribution control server 10 may periodically and continuously acquire the vital data of a user for whom the unconsented sharing setting is set, and automatically extend the unconsented sharing period while it is determined that the activation condition of the user is satisfied.

[0239] In the above embodiment, input of the activation condition and the invalidation condition has been described with reference to FIG. 9. Here, the initial values ​​set for the activation condition and the invalidation condition may be different for each user. For example, the service server 20-4 of a travel agency obtains vital data from each user in advance when the user is in good health. The service server 20-4 uses the obtained vital data to determine initial values ​​of thresholds (activation condition, invalidation condition) that determine a sudden change in the user's health and recovery from the sudden change in health. The service server 20-4 reflects the determined initial values ​​in the GUI shown in FIG. 9.

[0240] When the distribution control server 10 sets a sharing period without consent for a user, it may contact people related to the user (for example, family, friends, superiors at work, etc.) to that effect. In this case, the user registers emergency contact information in the distribution control server 10 when registering as a user. Alternatively, the distribution control server 10 may leave a record of the fact that a sharing period without consent was set as history, and notify the user of the history on the terminal 30 or make it possible to check the history on a personal portal. Note that the information left as the history is expected to include the date and time when the sharing period without consent was set, the sharing source, the sharing destination, an overview of the shared data, etc.

[0241] In the above embodiment, a case has been described in which the user information database is configured inside the distribution control server 10, but the database may be constructed in an external database server or the like. That is, some of the functions of the distribution control server 10 may be implemented in another server. More specifically, the above-described "unconsented sharing setting control unit (unconsented sharing setting control means)", "data distribution control unit (data distribution control means)", etc. may be implemented in any of the devices included in the system.

[0242] The form of data transmission between the devices (the distribution control server 10, the service server 20) is not particularly limited, but the data transmitted between these devices may be encrypted. The name of the user's illness and other information are transmitted between these devices, and in order to appropriately protect this information, it is desirable to transmit and receive encrypted data.

[0243] In the flow charts (flow charts, sequence diagrams) used in the above description, multiple steps (processes) are described in order, but the order of execution of the steps executed in the embodiments is not limited to the order described. In the embodiments, the order of the steps shown in the figures can be changed to a degree that does not affect the content, such as executing each process in parallel.

[0244] The above-mentioned embodiments have been described in detail to facilitate understanding of the present disclosure, and it is not intended that all of the configurations described above are necessary. In addition, when a plurality of embodiments are described, each embodiment may be used alone or in combination. For example, it is possible to replace a part of the configuration of an embodiment with the configuration of another embodiment, or to add the configuration of another embodiment to the configuration of an embodiment. Furthermore, it is possible to add, delete, or replace a part of the configuration of an embodiment with another configuration.

[0245] The above explanation makes it clear that the present invention has industrial applicability, and the present invention is suitably applicable to information distribution systems in which accumulated data is distributed by providing services to users.

[0246] A part or all of the above-described embodiments can be described as, but is not limited to, the following supplementary notes. [Appendix 1] A first server that accumulates data generated by providing a service to a user; A second server; and A distribution control server that controls data sharing in which the accumulated data is transmitted from the first server to the second server; Including, The distribution control server includes: storing an enabling condition set by the user for realizing the data sharing without the user's consent; When the enabling condition is satisfied, a non-consent sharing period is set during which data stored in the first server can be shared with the second server without the consent of the user. [Appendix 2] The system described in Appendix 1, wherein the distribution control server instructs the first server to transmit the accumulated data to the second server when the second server requests the data sharing of the accumulated data during the non-consent setting period. [Appendix 3] The system described in Appendix 1 or 2, wherein the distribution control server sets an end date and time of the non-consent sharing period based on a validity period set by the user. [Appendix 4] The system according to any one of appendices 1 to 3, wherein the distribution control server is set by the user and cancels the unconsented sharing period when an invalidation condition for canceling the unconsented sharing period is met. [Appendix 5] A third server acquires health information on the user's health from a wearable device worn by the user, and detects a sudden change in the user's health based on the health information; When the third server detects a sudden change in the user's physical condition, it notifies the distribution control server of the sudden change in the user's physical condition, The system described in any one of Appendices 1 to 4, wherein the distribution control server sets the non-consent sharing period for the user who has been notified of the sudden change in health condition if the activation condition for the user who has been notified of the sudden change in health condition is met. [Appendix 6] When the third server detects a sudden change in the user's physical condition, the third server requests the second server to provide assistance to the user whose physical condition has suddenly changed; The system described in Appendix 5, wherein the second server requests the sharing of data necessary to rescue the user for whom rescue is requested. [Appendix 7] The system described in Appendix 5 or 6, wherein the wearable terminal acquires vital data of the user and notifies the third server of the acquired vital data as the health information. [Appendix 8] 8. The system according to claim 6 or 7, wherein the second server is a server managed by an emergency hospital. [Appendix 9] The system according to any one of claims 6 to 8, wherein the third server is a server managed by a travel agency. [Appendix 10] The system described in Appendix 1, wherein the distribution control server acquires vital data of the user from a wearable device worn by the user, determines whether the activation condition is met using the acquired vital data, and if the activation condition is met, instructs the first server to transmit the accumulated data to the second server. [Appendix 11] The system described in any one of Appendix 1 to 10, wherein if the non-consent sharing period is not set, the distribution control server inquires the user about the data sharing, and if the user agrees to the data sharing, instructs the first server to send the accumulated data to the second server. [Appendix 12] a data distribution control unit that controls data sharing in which a first server that accumulates data generated by providing a service to a user transmits the accumulated data to a second server; a storage unit that stores an enabling condition set by the user for realizing the data sharing without the user's consent; a setting control unit that sets a non-consent sharing period during which data stored in the first server can be shared with the second server without the consent of the user when the enabling condition is satisfied; A server device comprising: [Appendix 13] In the server device, A first server that accumulates data generated by providing a service to a user performs control regarding data sharing in which the accumulated data is transmitted to a second server; storing an enabling condition set by the user for realizing the data sharing without the user's consent; The method for controlling a server device further comprises setting a non-consent sharing period during which, when the enabling condition is satisfied, data stored in the first server can be shared with the second server without the consent of the user. [Appendix 14] A computer installed in the server device A process in which a first server, which accumulates data generated by providing a service to a user, controls data sharing by transmitting the accumulated data to a second server; storing an enabling condition set by the user for realizing the data sharing without the user's consent; a process of setting a non-consent sharing period during which data stored in the first server can be shared with the second server without the consent of the user when the enabling condition is satisfied; A computer-readable storage medium that stores a program for executing the above.

[0247] The disclosures of the above cited prior art documents are incorporated herein by reference. Although the embodiments of the present invention have been described above, the present invention is not limited to these embodiments. It will be understood by those skilled in the art that these embodiments are merely illustrative and that various modifications are possible without departing from the scope and spirit of the present invention. In other words, the present invention naturally includes various modifications and amendments that a person skilled in the art can make in accordance with the entire disclosure, including the scope of the claims, and the technical ideas. [Explanation of symbols]

[0248] 10 Distribution Control Server 20 Service Server 20-1 Service Server 20-2 Service Server 20-3 Service Server 20-4 Service Server 30 Terminals 40 Wearable devices 101 First Server 102 Second Server 103 Distribution Control Server 201 Communication control section 202 User Registration Department 203 Settings Management Department 204 Personal Identification Code Control Unit 205 Location Information Management Department 206 Non-consent sharing setting control section 207 Data Distribution Control Section 208 Memory section 209 Physical condition information processing section 301 Communication Control Unit 302 Personal Identification Code Management Department 303 Sharing Request Department 304 Data Storage Unit 305 Data Distribution Department 306 Storage section 307 Emergency Medical Service Department 308 Shared settings management department 309 Physical condition information processing section 311 Processor 312 Memory 313 Input / Output Interface 314 Communication Interface 401 Communication control section 402 Personal information input section 403 Setting control unit 404 Query Processing Unit 405 Storage section 501 Communication control section 502 Physical condition information control unit 503 Storage section

Claims

1. A first server that accumulates data generated by providing a service to a user; A second server; and A distribution control server that controls data sharing in which the accumulated data is transmitted from the first server to the second server; Including, The distribution control server includes: storing an enabling condition set by the user for realizing the data sharing without the user's consent; setting a non-consent sharing period during which data stored in the first server can be shared with the second server without the consent of the user when the enabling condition is satisfied; A system that acquires vital data of the user from a wearable device worn by the user, determines whether the activation condition is met using the acquired vital data, and if the activation condition is met, instructs the first server to transmit the accumulated data to the second server.

2. The system of claim 1 , wherein the distribution control server instructs the first server to transmit the accumulated data to the second server when the second server requests data sharing of the accumulated data during the non-consent sharing period.

3. The system according to claim 1 or 2, wherein the distribution control server sets an end date and time of the non-consent sharing period based on a validity period set by the user.

4. The system according to claim 1 , wherein the distribution control server cancels the unconsented sharing period when an invalidation condition set by the user for canceling the unconsented sharing period is satisfied.

5. a third server that acquires health information on the user's health from a wearable device worn by the user and detects a sudden change in the user's health based on the health information; When the third server detects a sudden change in the user's physical condition, it notifies the distribution control server of the sudden change in the user's physical condition, The system described in any one of claims 1 to 4, wherein the distribution control server sets the non-consent sharing period for the user who has been notified of the sudden change in health condition if the activation condition for the user who has been notified of the sudden change in health condition is met.

6. When the third server detects a sudden change in the user's physical condition, the third server requests the second server to provide assistance to the user whose physical condition has suddenly changed; The system according to claim 5 , wherein the second server requests the data sharing of data necessary to rescue the user for whom rescue has been requested.

7. The system according to claim 5 or 6, wherein the wearable device acquires vital data of the user, and notifies the third server of the acquired vital data as the physical condition information.

8. a data distribution control unit that controls data sharing in which a first server that accumulates data generated by providing a service to a user transmits the accumulated data to a second server; a storage unit that stores an enabling condition set by the user for realizing the data sharing without the user's consent; a setting control unit that sets a non-consent sharing period during which data stored in the first server can be shared with the second server without the consent of the user when the enabling condition is satisfied; an instruction unit that acquires vital data of the user from a wearable device worn by the user, determines whether or not the enabling condition is satisfied using the acquired vital data, and instructs the first server to transmit the accumulated data to the second server if the enabling condition is satisfied; A server device comprising:

9. In the server device, A first server that accumulates data generated by providing a service to a user performs control regarding data sharing for transmitting the accumulated data to a second server; storing an enabling condition set by the user for realizing the data sharing without the user's consent; setting a non-consent sharing period during which data stored in the first server can be shared with the second server without the consent of the user when the enabling condition is satisfied; A control method for a server device, comprising: acquiring vital data of the user from a wearable device worn by the user; determining whether the activation condition is met using the acquired vital data; and, if the activation condition is met, instructing the first server to transmit the accumulated data to the second server.

10. A computer installed in the server device A process in which a first server, which accumulates data generated by providing a service to a user, controls data sharing by transmitting the accumulated data to a second server; storing an enabling condition set by the user for realizing the data sharing without the user's consent; a process of setting a non-consent sharing period during which data stored in the first server can be shared with the second server without the consent of the user when the enabling condition is satisfied; a process of acquiring vital data of the user from a wearable device worn by the user, determining whether or not the enabling condition is satisfied using the acquired vital data, and instructing the first server to transmit the accumulated data to the second server if the enabling condition is satisfied; A program for executing.

Images