System, server device, server device control method and program

Abstract

Provided is a system that contributes to appropriate protection of a user with reduced mental capacity. The system comprises a service server and a distribution control server. The service server is operated by a first service provider, and accumulates data generated by providing a service to a user. The distribution control server provides a data distribution service for the accumulated data. If the mental capacity of the user is reduced, the distribution control server limits the provision of the service to the user with the reduced mental capacity.

Description

[Technical Field]

[0001] The present invention relates to a system, a server device, a control method for a server device, and a storage medium. [Background technology]

[0002] There are information distribution systems that provide personal information held by hospitals and other institutions to information recipient devices such as businesses with the consent of the individuals. Such systems include, for example, information trading devices managed by information banks and the like, information source devices managed by information source companies, and information recipient devices managed by information recipients. The information trading devices store personal information acquired from the information source devices. The information trading devices transmit personal information desired by the utilizing business or the like from the stored personal information to the information recipient devices.

[0003] Patent Document 1 describes an information management system, an information management method, and an information management program for conducting transactions using users' personal information. The information management server in Patent Document 1 includes a registrant information storage unit that stores personal information of registrants, a provision history storage unit that stores a provision history of the personal information, and a control unit connected to a purchaser terminal. The control unit acquires information acquisition conditions from the purchaser terminal and extracts personal information from the registrant information storage unit based on the information acquisition conditions. The control unit provides the extracted personal information to the purchaser terminal and records the provision history of the personal information in the provision history storage unit. The control unit collects a provision fee based on the provision history recorded in the provision history storage unit and returns compensation to the registrant who provided the personal information based on the provision fee.

[0004] Users of information distribution systems are expected to include users with reduced cognitive abilities (decision-making ability, judgment ability). Patent Document 2 describes an information presentation system that presents information tailored to individuals with different cognitive abilities. The information presentation system in Patent Document 2 includes an event processing means, a message selection means, and a message presentation means. The event processing means accepts any event registration including message content and generates a message transmission notification for an event that meets conditions. The message selection means selects a presentation message for the registered event that is in line with the message content and is tailored to the cognitive function of each individual who is the communication target. The message presentation means performs voice synthesis on the presentation message selected by the message selection means and outputs the selected presentation message based on the message transmission notification to the individual's device as a voice. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Japanese Patent Application Laid-Open No. 2019-128648 [Patent Document 2] Japanese Patent Application Publication No. 2018-189682 Summary of the Invention [Problem to be solved by the invention]

[0006] When a user with reduced cognitive ability uses an information distribution system, there is a possibility that data that the user does not want to receive may be passed on to external businesses, etc. This problem cannot be solved by applying the technologies disclosed in Patent Document 1 or Patent Document 2. This is because Patent Document 1 merely discloses that compensation is given to registrants who provide personal information, while Patent Document 2 merely provides information that corresponds to the cognitive ability of each user.

[0007] The main object of the present invention is to provide a system, a server device, a method for controlling a server device, and a storage medium that contribute to the appropriate protection of users with reduced mental capacity. [Means for solving the problem]

[0008] According to a first aspect of the present invention, a system is provided which includes a service server operated by a first service provider and which stores data generated by providing services to users, and a distribution control server which provides a data distribution service for the stored data, wherein the distribution control server restricts the provision of services to a user with reduced mental capacity when the user's mental capacity has declined.

[0009] According to a second aspect of the present invention, a server device is provided that includes an acquisition unit that acquires information regarding a user's cognitive ability, and a data distribution control unit that provides a data distribution service regarding accumulated data generated by a service provider providing services to users, and that, if the user's mental capacity declines, restricts the provision of services to the user with declined mental capacity.

[0010] According to a third aspect of the present invention, there is provided a method for controlling a server device, which acquires information about a user's cognitive ability, provides a data distribution service related to accumulated data generated by a service provider providing services to users, and, if the user's mental capacity has declined, restricts the provision of services to the user with declined mental capacity.

[0011] According to a fourth aspect of the present invention, there is provided a computer-readable storage medium that stores a program for causing a computer mounted on a server device to execute the following processes: a process for acquiring information regarding a user's cognitive ability; a process for providing a data distribution service regarding accumulated data generated by a service provider providing services to users; and a process for restricting the provision of services to users with reduced mental capacity if the user's mental capacity has declined. [Effects of the Invention]

[0012] According to each aspect of the present invention, a system, a server device, a control method for a server device, and a storage medium are provided that contribute to the appropriate protection of users with impaired mental capacity. Note that the effects of the present invention are not limited to those described above. The present invention may achieve other effects instead of or in addition to the effects described above. [Brief explanation of the drawings]

[0013] [Figure 1] FIG. 1 is a diagram for explaining an outline of an embodiment. [Figure 2] FIG. 2 is a flowchart for explaining an outline of the operation of one embodiment. [Figure 3] FIG. 3 is a diagram illustrating an example of a schematic configuration of an information distribution system according to the first embodiment. [Figure 4] FIG. 4 is a diagram for explaining the operation of the information distribution system according to the first embodiment. [Figure 5] FIG. 5 is a diagram for explaining the operation of the information distribution system according to the first embodiment. [Figure 6] FIG. 6 is a diagram for explaining the operation of the information distribution system according to the first embodiment. [Figure 7] FIG. 7 is a diagram for explaining the operation of the information distribution system according to the first embodiment. [Figure 8] FIG. 8 is a diagram for explaining the operation of the information distribution system according to the first embodiment. [Figure 9] FIG. 9 is a diagram illustrating an example of catalog information according to the first embodiment. [Figure 10] FIG. 10 is a diagram for explaining the operation of the information distribution system according to the first embodiment. [Figure 11] FIG. 11 is a diagram showing an example of a display on the terminal according to the first embodiment. [Figure 12] FIG. 12 is a diagram illustrating an example of a display on the terminal according to the first embodiment. [Figure 13] FIG. 13 is a diagram illustrating an example of a display on the terminal according to the first embodiment. [Figure 14] FIG. 14 is a diagram illustrating an example of a display on the terminal according to the first embodiment. [Figure 15] FIG. 15 is a diagram for explaining the operation of the information distribution system according to the first embodiment. [Figure 16] FIG. 16 is a diagram for explaining the operation of the information distribution system according to the first embodiment. [Figure 17] FIG. 17 is a diagram illustrating an example of a processing configuration of the distribution control server according to the first embodiment. [Figure 18] FIG. 18 is a diagram illustrating an example of a user information database according to the first embodiment. [Figure 19] FIG. 19 is a diagram illustrating an example of a part of the user information database according to the first embodiment. [Figure 20] FIG. 20 is a diagram illustrating an example of a location information database according to the first embodiment. [Figure 21] FIG. 21 is a flowchart showing an example of the operation of the distribution control server according to the first embodiment. [Figure 22] FIG. 22 is a flowchart showing an example of the operation of the distribution control server according to the first embodiment. [Figure 23] FIG. 23 is a flowchart showing an example of the operation of the distribution control server according to the first embodiment. [Figure 24] FIG. 24 is a diagram illustrating an example of a processing configuration of the service server according to the first embodiment. [Figure 25] FIG. 25 is a diagram illustrating an example of the accumulation database according to the first embodiment. [Figure 26] FIG. 26 is a diagram illustrating an example of a processing configuration of the trading server according to the first embodiment. [Figure 27] FIG. 27 is a diagram showing an example of the account holder list according to the first embodiment. [Figure 28] FIG. 28 is a diagram illustrating an example of a processing configuration of a terminal according to the first embodiment. [Figure 29]FIG. 29 is a sequence diagram showing an example of the operation of the information distribution system according to the first embodiment. [Figure 30] FIG. 30 is a sequence diagram showing an example of the operation of the information distribution system according to the first embodiment. [Figure 31] FIG. 31 is a diagram showing an example of a display on a terminal according to the second embodiment. [Figure 32] FIG. 32 is a diagram showing an example of a display on a terminal according to the second embodiment. [Figure 33] FIG. 33 is a diagram showing an example of a display on a terminal according to the second embodiment. [Figure 34] FIG. 34 is a diagram showing an example of a display on a terminal according to the second embodiment. [Figure 35] FIG. 35 is a diagram showing an example of a display on a terminal according to the second embodiment. [Figure 36] FIG. 36 is a diagram illustrating an example of a part of the user information database according to the second embodiment. [Figure 37] FIG. 37 is a diagram for explaining the operation of the information distribution system according to the second embodiment. [Figure 38] FIG. 38 is a diagram for explaining the operation of the information distribution system according to the second embodiment. [Figure 39] FIG. 39 is a diagram for explaining the operation of the information distribution system according to the second embodiment. [Figure 40] FIG. 40 is a diagram illustrating an example of a schematic configuration of an information distribution system according to the third embodiment. [Figure 41] FIG. 41 is a diagram illustrating an example of a processing configuration of a trust server according to the third embodiment. [Figure 42] FIG. 42 is a diagram illustrating an example of a hardware configuration of a distribution control server according to the present disclosure. DETAILED DESCRIPTION OF THE INVENTION

[0014] First, an overview of one embodiment will be described. Note that the reference numerals in the drawings are added to each element for convenience as an example to facilitate understanding, and the description of this overview is not intended to be limiting in any way. Furthermore, unless otherwise specified, the blocks shown in each drawing represent functional units, not hardware units. Connection lines between blocks in each drawing include both bidirectional and unidirectional lines. Unidirectional arrows are used to schematically indicate the flow of main signals (data) and do not exclude bidirectionality. Note that in this specification and drawings, elements that can be similarly described may be assigned the same reference numerals to avoid redundant explanation.

[0015] The system according to one embodiment includes a service server 101 and a distribution control server 102 (see FIG. 1). The service server 101 is operated by a first service provider and stores data generated by providing services to users. The distribution control server 102 provides a data distribution service for the stored data. If a user's mental capacity declines, the distribution control server 102 restricts the provision of services to the user with the declined mental capacity.

[0016] Fig. 2 is a flowchart for explaining the outline of the operation of the system according to one embodiment. As shown in Fig. 2, the distribution control server 102 acquires information about the user's mental capacity by any means (step S1). Thereafter, if the distribution control server 102 determines that the user's mental capacity has declined based on the acquired information about the mental capacity, it restricts the provision of services to the user with declined mental capacity (step S2).

[0017] As explained above, in a system according to one embodiment, if it is determined that a user's mental capacity (cognitive ability, judgment ability) has declined, the system limits the data distribution services provided to the user (for example, services that share or provide the user's accumulated data to businesses, etc.). As a result, the accumulated data of a user with declined mental capacity (especially data important for privacy protection, such as medical history) will not be passed on to external businesses, etc., and system users will be appropriately protected.

[0018] Specific embodiments will be described in more detail below with reference to the drawings.

[0019] [First embodiment] The first embodiment will be described in more detail with reference to the drawings.

[0020] [System Configuration] Fig. 3 is a diagram showing an example of a schematic configuration of an information distribution system according to the first embodiment. As shown in Fig. 3, participating members (actors) of the information distribution system include information distribution companies, service companies, data utilization companies, and trading companies.

[0021] The information distribution business is a body that controls data distribution between businesses (service businesses, data utilization businesses). The information distribution business includes at least one or more distribution control servers 10.

[0022] The distribution control server 10 is a server device that controls (realizes) data distribution between service providers and controls data distribution between service providers and data utilization businesses. The distribution control server 10 is a device that provides data distribution services for data stored at service providers.

[0023] A service provider is an entity that provides services to individuals. A service provider may be a private business or a public institution. Examples of service providers include medical institutions (hospitals, pharmacies, etc.) that provide medical services to users, retailers, and educational institutions that teach languages, sports, arts, etc. to customers.

[0024] Each service provider has a service server 20 for providing services to customers. The service server 20 is managed and operated by the service provider. The service server 20 accumulates (stores) data (user data) generated when the service provider provides services to users.

[0025] Data utilization businesses are entities that do not provide services directly to individuals. Examples of data utilization businesses include pharmaceutical companies and sports manufacturers. For example, data utilization businesses develop new drugs or products using data acquired by service providers.

[0026] The data utilizing business operator is provided with a business operator terminal 30 for acquiring data from the service business operator.

[0027] A trading business is an entity that realizes transactions between service providers and data users. A trading business realizes data distribution between data generators (service providers) and data consumers (data users).

[0028] The trading company is provided with a trading server 40 for realizing the data distribution.

[0029] A user of the information distribution system uses a terminal 50 .

[0030] The devices shown in Fig. 3 are connected to each other via a network. For example, the distribution control server 10 and the service server 20 are connected by wired or wireless communication means and are configured to be able to communicate with each other.

[0031] 3 is an example and is not intended to limit the configuration of the information distribution system disclosed in the present application. For example, an information distribution business may include two or more distribution control servers 10. Furthermore, with regard to trading businesses and data utilizing businesses, the information distribution system includes business terminals 30 and trading servers 40 according to the number of businesses participating in the system.

[0032] [System operation overview] Next, an outline of the operation of the information distribution system according to the first embodiment will be explained. First, the basic operation of the information distribution system according to the first embodiment will be explained. Then, the operation of the information distribution system taking into consideration the decline in the user's decision-making ability will be explained.

[0033] In the first embodiment, a description will be given taking a "medical institution" as an example of a service provider. In particular, a case will be described in which two medical institutions, medical institution A and medical institution B, participate in an information distribution system. Note that medical institution A is equipped with a service server 20-1, and medical institution B is equipped with a service server 20-2.

[0034] "Sharing" and "provision" are methods of data distribution in information distribution systems.

[0035] "Sharing" is a means by which a service provider can obtain data accumulated by other service providers. For example, data distribution through "sharing" is used when medical institution A obtains data generated by the provision of services by medical institution B.

[0036] "Sharing" is used to improve the convenience of service users themselves, so in principle, no compensation is incurred for data distribution. In other words, "sharing" is used to utilize data accumulated by other service providers in order for users to receive better services from the service providers.

[0037] "Provision" is a means by which data utilization businesses obtain data accumulated by other service businesses. For example, data distribution by "provision" is used when a pharmaceutical company obtains the results of health checkups and examinations from medical institutions A and B.

[0038] "Provision" is a method used by data utilization businesses that do not provide services directly to users, and therefore, in principle, a fee is charged for data distribution. In other words, "provision" is used by users to receive compensation from data utilization businesses.

[0039] <User registration> As shown in Figure 4, whether data distribution is by sharing or by providing, users must register in advance (user registration, system registration). More specifically, users register when joining the system. The users operate their own terminals 50 to input their personal information (name, date of birth, contact information, account information, etc.) into the distribution control server 10.

[0040] The distribution control server 10 generates a user ID (Identifier) for identifying the user, and issues the generated user ID to the user. The distribution control server 10 stores the generated user ID in association with the acquired personal information (such as name). More specifically, the distribution control server 10 stores the user ID in association with the personal information using a "user information database." Details of the user information database will be described later.

[0041] The distribution control server 10 opens a personal portal for users who have completed user registration. The users log in to the personal portal and manage and change various information set in the information distribution system via the personal portal.

[0042] <Generate personal identification code> Once user registration is complete, the user will enter into an individual contract with the service provider from which they wish to receive services. Specifically, the user will provide their name and other information to the service provider and request a new contract (a contract to receive services) with that service provider. For example, a user who wishes to visit a medical institution will submit their health insurance card, etc., with their name and other information printed on it, to the medical institution.

[0043] The service provider generates a "personal identification code" to identify a new customer (user). For example, a medical institution assigns a patient card number to manage users (patients) and generates the patient card number as a personal identification code. The service server 20 stores the generated personal identification code (e.g., the patient card number) in its own database or the like.

[0044] Once the personal identification code is generated, the user can receive services from the service provider. For example, the user receives medical services (health checkups, examinations, etc.) from a medical institution. Data generated when the service is provided to the user (examination results, disease name, etc.) is accumulated by the service provider and becomes subject to data distribution.

[0045] <Notification of personal identification code> The generated personal identification code is notified to the information distribution business. The distribution control server 10 acquires the personal identification code generated by each service business.

[0046] Specifically, the distribution control server 10 periodically or at a predetermined timing transmits a "request for user information" including personal identification information of users whose user registration has been completed to each service server 20 (see FIG. 5). The personal identification information is information for identifying a user, and examples thereof include a name or a combination of a name and a date of birth.

[0047] If there is a personal identification code corresponding to the personal identification information, the service server 20 transmits to the distribution control server 10 information about the corresponding user (customer) (hereinafter referred to as user information).

[0048] The user information includes the generated personal identification code of the user and the service provider's business code. The business code is identification information (ID) for identifying the service provider participating in the information distribution system.

[0049] For example, different codes are assigned to medical institution A (service server 20-1) and medical institution B (service server 20-2). The business code is shared by any means among system participants (information distribution businesses, service businesses, trading businesses, data utilization businesses, etc.). For example, when a service business participates in the information distribution system, the information distribution business (distribution control server 10) generates a business code to be assigned to the service business. The information distribution business notifies other service businesses, etc. of the generated business code and the corresponding service business name, etc.

[0050] The distribution control server 10 stores the acquired personal identification code in the user information database.

[0051] <Data storage and location information transmission> Service providers accumulate data that arises when they provide services to users. For example, as shown in Figure 6, when medical institution A provides medical services to each of users U1 to U3, medical institution A accumulates the results for each user. For example, medical institution A accumulates the results of health checkups (examination results; for example, data such as height, weight, and blood pressure) for each user of users U1 to U3.

[0052] The service provider (service server 20) stores the personal identification code of each user in association with the data obtained as a result of the service provided. For example, in the example of Fig. 6, the service server 20-1 uses an "accumulation database" to store the personal identification code of each of users U1 to U3 in association with the medical examination results A1 to A3. The accumulation database will be described in detail later.

[0053] Every time a service provider accumulates data (user data resulting from the provision of a service), it transmits "location information" to the distribution control server 10. The location information is information about the storage location of the data accumulated at the service provider (the entity accumulating the data; the service provider), etc. The location information includes a personal identification code, a business code, the type of accumulated data, etc.

[0054] The distribution control server 10 stores the acquired location information in a "location information database." The location information database will be described in detail later. The location information database stores personal identification codes, business code, and data types in association with each other.

[0055] <Data distribution through sharing> A service provider that wishes to obtain data accumulated by another service provider (data resulting from the other service provider providing services to users) can obtain that data through "sharing."

[0056] Here, with reference to FIG. 7, a case will be described in which medical institution B acquires data (examination results A1) of user U1 stored in medical institution A by "sharing."

[0057] Medical institution B (service server 20-2) transmits a "sharing request" to the distribution control server 10 (step S11).

[0058] Based on the sharing request, the distribution control server 10 identifies the target of data distribution (user U1) and the data accumulator (medical institution A) of the data to be distributed. The distribution control server 10 transmits an inquiry regarding data sharing to the terminal 50 possessed by the identified target (user U1) (step S12).

[0059] The terminal 50 that receives the inquiry about data sharing acquires the user's intention regarding data sharing. For example, the terminal 50 acquires the intention of the user U1 using a GUI (Graphical User Interface). In the above example, the terminal 50 displays a GUI with the content such as "By sharing medical examination results A1 from medical institution A with medical institution B, you can receive better service. Do you want to share?" and acquires the user's intention (agree or disagree to data sharing).

[0060] The terminal 50 transmits a response to the inquiry about data sharing (agreement to data sharing or denial of data sharing) to the distribution control server 10 (step S13).

[0061] If the user's consent is obtained, the distribution control server 10 transmits a sharing instruction to the data accumulator (medical institution A) (step S14).

[0062] Upon receiving the sharing instruction, medical institution A (service server 20-1) refers to the storage database and transmits the medical examination results A1 of user U1 to service server 20-2, which is the designated data sharing destination (step S15).

[0063] Next, data distribution through "provision" will be explained.

[0064] <Opening an account> Users who wish to receive compensation for providing data must open an account with a trading company. Opening an account for data provision will be explained with reference to Figure 8.

[0065] A trading business partner will partner with at least one of the multiple service businesses participating in the information distribution system. For example, a trading business that handles medical data will partner with a medical institution (hospital, pharmacy, etc.). Or, a trading business that handles educational data will partner with an education provider. The trading business will store the business code of the service business partner.

[0066] In addition, trading businesses store the business code of the data-utilizing business. For example, trading businesses generate the business code of the data-utilizing business when starting a transaction with the data-utilizing business. The business code of the data-utilizing business is shared among the information distribution business, trading businesses, and data-utilizing business by any method.

[0067] Trading businesses sell data accumulated by partner service providers to data-utilizing businesses. For example, if the partner service provider shown in Figure 8 is a medical institution, the trading business will sell the data accumulated by the partner medical institution to pharmaceutical companies, etc. All or part of the compensation obtained from the sale of the data will be paid to the users involved in the provided data.

[0068] As mentioned above, users who wish to receive compensation for providing data via a trading company must open an account with the trading company (trading server 40). Users participating in the information distribution system who wish to earn revenue by providing data open an "information account" with the trading server 40.

[0069] The user presents the user ID issued by the distribution control server 10 to the trading server 40 to open an information account. The trading server 40 stores the acquired user ID. The trading server 40 manages the user IDs of users who have opened accounts in an account holder list.

[0070] <Catalogue information> To realize data distribution through "provision," information distribution businesses prepare catalog information. The person in charge (system administrator) at the information distribution business defines the catalog information that lists the data that can be sold (see Figure 9). The catalog information is information that shows details of the data that the information distribution system can sell to data utilization businesses.

[0071] The dataset name included in the catalog information shown in Fig. 9 is information for identifying the catalog information. For example, a dataset related to a health checkup is given the name "Examination Results 1," and a dataset related to examination results is given the name "Examination Results 1."

[0072] The business code is as described above. The data type indicates the type of data accumulated by the service business. For example, information such as "height," "weight," and "blood pressure" in medical examination results, and "disease name," "medication," and "test results" in examination results correspond to data types. The data format specifies the format in which the data is provided.

[0073] The data utilizing business acquires the catalog information via the business operator. More specifically, the business operator terminal 30 transmits a “catalog information presentation request” to the business server 40.

[0074] Upon receiving the catalog information presentation request, the transaction server 40 transmits a “catalog information transmission request” to the distribution control server 10 .

[0075] In response to receiving the catalog information transmission request, the distribution control server 10 transmits the catalog information defined by the information distributor to the transaction server 40 .

[0076] The transaction server 40 selects catalog information related to the partner service provider and transmits it to the business operator terminal 30. For example, in the above example, the transaction server 40 selects catalog information related to the business of a pharmaceutical company and transmits it to the data-utilizing business operator. The data-utilizing business operator views the received catalog information and identifies the catalog information necessary for its own business.

[0077] <Data distribution through provision> Data utilization businesses that wish to obtain data accumulated by service providers can obtain that data by "provision."

[0078] Here, with reference to FIG. 10, a case will be described in which a data utilization business acquires data (examination results) accumulated in medical institution A through "provision."

[0079] First, the data utilizing business refers to the catalog information presented by the trading business and identifies the necessary catalog information. Then, the business terminal 30 transmits a request for provision to the trading server 40, including information on the data utilizing business, the name of the data set of the identified catalog information, and the conditions required for the data to be provided (hereinafter referred to as search conditions) (step S21).

[0080] The information on the data utilizing business includes the name of the data utilizing business, the business code, the data recipient (the address to which the data will be sent), etc. The search criteria include, for example, "more than 100 pieces of height data."

[0081] The transaction server 40 examines the acquired provision request. If no problems are found during the examination, the transaction server 40 transmits the acquired provision request and the list of account holders to the distribution control server 10 (step S22).

[0082] The distribution control server 10 identifies the personal identification code of the user who is listed on the account holder list and who is related to the requested catalog information. The distribution control server 10 sends an inquiry about data provision to the contact information (an email address that can be received by the terminal 50) of the user corresponding to the identified personal identification code (step S23).

[0083] The data request includes information about the data requester (data utilization business), the data accumulator (Medical Institution A in the example of Figure 10), and the type of data requested (for example, height).

[0084] The terminal 50 that has received the inquiry about data provision displays a GUI for acquiring the intention of each user regarding the data provision. The terminal 50 acquires the intention of the user (agreement or disagreement to the data provision) using the GUI.

[0085] The terminal 50 transmits a response to the inquiry about the data provision (agreement to the data provision or refusal to provide the data) to the distribution control server 10 (step S24).

[0086] The distribution control server 10 transmits a provision instruction to the data accumulator (medical institution A) for the users who have given consent (step S25). For example, as described above, if the provision of 100 or more sets of height data is requested, the distribution control server 10 transmits a provision instruction to the service server 20-1 for the height data of the 100 or more users who have given consent to the data provision.

[0087] Furthermore, the distribution control server 10 pays a fee to users who agree to the provision of data.

[0088] Upon receiving the provision instruction, medical institution A (service server 20-1) refers to the storage database and transmits the data of the users who have agreed to the provision to the specified data destination (step S26). In the above example, if each of users U1 to U3 has agreed to the provision of data, the height data of each user is transmitted to the business operator terminal 30.

[0089] <Responses when decision-making capacity declines> From the perspective of user protection, it is desirable for the information distribution system to restrict the provision of services to a user when the user's mental capacity has declined. Below, we will explain an information distribution system that takes into account the decline or possibility of a decline in the user's mental capacity.

[0090] In the first embodiment, it is assumed that a user has mental capacity when he or she creates an account (personal portal) with an information distribution company. In addition, in the first embodiment, an explanation will be given using an example in which a user suffers from dementia as a cause of a decline in mental capacity. However, it goes without saying that the cause of a decline in mental capacity is not limited to dementia.

[0091] As described above, a user accesses the distribution control server 10 and registers as a user. Once user registration is complete, the distribution control server 10 opens a "personal portal" that serves as an interface for the user when using (participating in) the information distribution system. The user sets up various settings for using the information distribution system via the personal portal.

[0092] Users can configure various settings for using the information distribution system on the personal portal (see Figure 11). As shown in Figure 11, users can configure settings on the personal portal that assume a situation in which they themselves have developed dementia. The distribution control server 10 acquires configuration information that determines how to limit the services provided to users with reduced mental capacity. In Figure 11, a user who wishes to configure settings for when they develop dementia presses the "Dementia Support" button.

[0093] When the "Dementia Support" button is pressed, the distribution control server 10 displays a GUI (Graphical User Interface) such as that shown in Fig. 12 on the terminal 50. As shown in Fig. 12, the user can configure settings related to a contract with a new service provider in the event of cognitive decline, and settings related to a request for utilization (data sharing, data provision) of data accumulated by a service provider with which the user already has a contract.

[0094] To set up a contract with a new service provider, the user presses the "New Contract Settings" button. To set up the utilization of data accumulated by an existing contracted service provider, the user presses the "Consent Management Settings" button.

[0095] When the "New Contract Settings" button is pressed, the distribution control server 10 displays a GUI such as that shown in Fig. 13 on the terminal 50. As shown in Fig. 13, the distribution control server 10 displays a GUI that allows a person with cognitive impairment to select whether or not to enter into contracts with all new service providers if the person with cognitive impairment becomes a person with cognitive impairment in the future. Alternatively, the distribution control server 10 displays a GUI that allows a person with cognitive impairment to select whether or not to enter into contracts with each service provider.

[0096] When the "Consent Management Settings" button shown in Fig. 12 is pressed, the distribution control server 10 displays a GUI such as that shown in Fig. 14 on the terminal 50. As shown in Fig. 14, if a user becomes a person with cognitive impairment in the future, the distribution control server 10 displays a GUI that allows the person with cognitive impairment to choose whether or not to refuse all data distribution (data sharing, data provision). In addition, the distribution control server 10 displays a GUI that allows the person with cognitive impairment to choose whether or not to agree to data distribution for each service provider and data utilization provider.

[0097] In Figure 14, it is shown that inquiries regarding data sharing will be judged by each service provider, and inquiries regarding data provision will be uniformly denied. Note that in Figure 14, if "NO" is selected in the settings regarding data provision requests, a GUI will be displayed for each data-utilizing business to select whether or not to agree to data distribution, similar to the settings regarding data sharing requests.

[0098] In this way, the distribution control server 10 acquires from the user "setting information" that defines how to limit the services provided to the user when the user's mental capacity declines. The setting information includes new contract settings regarding the conclusion of a new contract between the user and the service provider, and consent management settings regarding the utilization of data accumulated by the service provider.

[0099] <Cognitive Ability Test> Here, the user undergoes a cognitive ability test periodically or at a predetermined timing. In particular, a user who has set up dementia support needs to undergo a cognitive ability test. For example, as shown in FIG. 15, the user undergoes a dementia test at a medical institution or the like. The distribution control server 10 acquires the test results of the user periodically or at a predetermined timing. For example, the distribution control server 10 can acquire the dementia test results through "data sharing." Note that the cognitive ability test is not limited to be conducted at a medical institution, but may also be conducted by a service provided by a private company or the like.

[0100] If the test result is "non-dementia patient," the distribution control server 10 does not take any special measures. That is, the information distribution system does not restrict the user's use of the system. On the other hand, if the test result is "dementia patient," the information distribution system may restrict the user's use of the system.

[0101] Specifically, the distribution control server 10 operates in accordance with the "new contract settings" and "consent management settings" set by the user on the personal portal.

[0102] For example, when a dementia patient attempts to conclude a new contract with a new service provider, the service provider (service server 20) inquires of the distribution control server 10 whether or not a new contract with the user is possible. Specifically, the service server 20 sends a "contract feasibility determination request" including the user's personal identification information (e.g., name, etc.) and the provider code to the distribution control server 10 (see Figure 16).

[0103] When processing the contract possibility determination request received from the service server 20, the distribution control server 10 refers to the cognitive ability of the user (dementia-related test results) and determines the response to be sent to the service server 20. For example, if the user suffers from dementia and is not permitted to enter into a new contract with the service provider (service server 20) that sent the contract possibility determination request, the distribution control server 10 sends a notice to the service server 20 that the contract is not possible.

[0104] Furthermore, when processing a request for data distribution (data sharing, data provision), the distribution control server 10 refers to the consent management settings to determine whether to treat the person with cognitive impairment as having consented to or refused data distribution. For example, if a user suffers from dementia and has refused data distribution to the requester of data distribution, the distribution control server 10 treats the user as having refused data distribution. In other words, the distribution control server 10 automatically refuses the request for data distribution without inquiring about the dementia patient.

[0105] Next, each device included in the information distribution system according to the first embodiment will be described in detail.

[0106] [Distribution control server] Fig. 17 is a diagram showing an example of the processing configuration (processing module) of the distribution control server 10 according to the first embodiment. Referring to Fig. 17, the distribution control server 10 includes a communication control unit 201, a user registration unit 202, a setting management unit 203, a cognitive ability acquisition unit 204, a contract feasibility determination unit 205, a personal identification code control unit 206, and a location information management unit 207. Furthermore, the distribution control server 10 includes a data distribution control unit 208, a catalog information management unit 209, and a storage unit 210.

[0107] The communication control unit 201 is a means for controlling communication with other devices. For example, the communication control unit 201 receives data (packets) from the service server 20. The communication control unit 201 also transmits data to the service server 20. The communication control unit 201 passes data received from other devices to other processing modules. The communication control unit 201 transmits data acquired from other processing modules to other devices. In this way, other processing modules transmit and receive data to and from other devices via the communication control unit 201. The communication control unit 201 has a function as a receiving unit that receives data from other devices and a function as a transmitting unit that transmits data to other devices.

[0108] The user registration unit 202 is a means for realizing the above-mentioned user registration (system registration of a user). The user registration unit 202 acquires personal information (such as name, date of birth, contact information, and account information) from the user's terminal 50.

[0109] When the user registration unit 202 acquires the personal information, it generates a user ID for identifying the user. For example, the user registration unit 202 assigns a unique number each time a user registers in the system, and uses the assigned number as the user ID.

[0110] The user registration unit 202 stores the user ID and personal information in the user information database (see FIG. 18). For example, when user U3 is registered, the entry shown in the bottom row of FIG. 18 is added. Note that at the user registration stage, information regarding the user's cognitive ability (mental ability), setting information for when the user suffers from dementia, and personal identification code are not set.

[0111] 18 is an example and is not intended to limit the items to be stored, etc. For example, the date and time at which the user was registered may be registered in the user information database.

[0112] The user registration unit 202 transmits the generated user ID to the terminal 50.

[0113] The setting management unit 203 is a means for managing various settings related to users who have registered in the system. For example, the setting management unit 203 displays a GUI such as that shown in Fig. 11 in response to an operation on the personal portal by a user via the terminal 50.

[0114] When the "Dementia Support" button is pressed, the setting management unit 203 displays a GUI such as that shown in Fig. 12. When the "New Contract Settings" button shown in Fig. 12 is pressed, the setting management unit 203 displays a GUI such as that shown in Fig. 13. When the "Consent Management Settings" button shown in Fig. 12 is pressed, the setting management unit 203 displays a GUI such as that shown in Fig. 14.

[0115] The setting management unit 203 acquires a setting regarding whether or not the user will be able to enter into a new contract with the service provider when the user suffers from dementia in the future (when the user loses mental capacity), using a GUI such as that shown in Fig. 13. In this case, it is preferable that the setting management unit 203 presents the user with settings (initial values, default values) that take into consideration the convenience and protection of the user. In other words, it is preferable that the setting management unit 203 allows each user to make the necessary selection in accordance with recommended guidelines established by the information distribution company, taking into consideration the convenience of the user, etc.

[0116] In the example of Figure 13, even if cognitive ability declines, it is not recommended to refuse new contracts with all service providers. For example, contracts with medical institutions are permitted, but contracts with retail stores are recommended to be refused.

[0117] The setting management unit 203 acquires settings regarding how to handle requests for data distribution (data sharing, data provision) when the user suffers from dementia in the future, using a GUI such as that shown in Fig. 14. Note that, even in the consent management settings, it is preferable that the setting management unit 203 presents to the user settings (initial values, default values) that take into consideration the convenience and protection of the user.

[0118] In the example of Figure 14, it is recommended that even if a user's cognitive ability declines, whether or not to share data is set individually for each service provider, and that data provision be uniformly refused for all service providers. For example, it is recommended that even if a user's cognitive ability declines, data sharing requests from hospitals and other institutions used by the user will be accepted, but data provision requests from pharmaceutical companies and other institutions that obtain personal information for profit will not be accepted.

[0119] The setting management unit 203 registers the setting information (setting information related to restrictions on services provided when a user suffers from dementia; service restriction setting information) acquired using a GUI such as that shown in Fig. 13 or 14 in the user information database. Note that in Fig. 18, the setting information related to user ID01 is collectively represented as "S01."

[0120] The actual setting information includes settings related to the contract for each service provider (new contract settings) and settings related to requests for data distribution (data sharing, data provision) (consent management settings), as shown in Figure 19. Note that in the drawings including Figure 19, the business codes of the service providers, etc. are replaced with the names of the service providers, etc., for ease of understanding.

[0121] The cognitive ability acquisition unit 204 is a means for acquiring the cognitive ability (dementia diagnosis result) of a user who has made settings for when their cognitive ability has declined. The cognitive ability acquisition unit 204 accesses the user information database periodically or at a predetermined timing, and extracts users (entries) for which setting information (service restriction setting information) has been set.

[0122] The cognitive ability acquisition unit 204 identifies entries for which nothing is set in the cognitive ability field of the extracted user, or for which a predetermined period of time (e.g., six months) has passed since a dementia diagnosis result was set in that field.

[0123] The cognitive ability acquisition unit 204 acquires the dementia diagnosis result from a service provider (medical institution) that holds the dementia diagnosis result of the user of the identified entry. For example, the cognitive ability acquisition unit 204 transmits a data sharing instruction regarding the dementia diagnosis result to the service provider. The cognitive ability acquisition unit 204 stores the acquired dementia diagnosis result (e.g., non-dementia patient, mild dementia patient, moderate dementia patient, severe dementia patient, etc.) in a user information database.

[0124] When acquiring a dementia diagnosis result through data sharing, the cognitive ability acquisition unit 204 may inquire of the user about data sharing (acquire consent). Alternatively, the cognitive ability acquisition unit 204 may consider that consent to acquiring a dementia diagnosis result through data sharing has been obtained from the user based on the fact that the setting information has been set.

[0125] The contract eligibility determination unit 205 is a means for processing a contract eligibility determination request received from the service server 20. Upon receiving a contract eligibility determination request from the service server 20, the contract eligibility determination unit 205 extracts the personal identification information (for example, name or a combination of name and date of birth) and the business code included in the request.

[0126] The contract eligibility determination unit 205 searches the user information database using the extracted personal identification information as a key. If the search fails, the contract eligibility determination unit 205 notifies the service server 20 that the user corresponding to the personal identification information is not a registered user of the information distribution system.

[0127] If the search is successful, the contract feasibility determination unit 205 refers to the cognitive ability field of the user (entry) identified by the search. If nothing is set in the field or if "non-dementia patient" is set, the contract feasibility determination unit 205 notifies the service server 20 that a contract can be made with the user corresponding to the personal identification information.

[0128] If the cognitive ability field is set to indicate that the user is a dementia patient, the contract feasibility determination unit 205 refers to the new contract setting corresponding to the business code acquired from the service server 20. If a new contract with the service business is permitted in the new contract setting, the contract feasibility determination unit 205 notifies the service server 20 that a contract with the user corresponding to the personal identification information is possible. If a new contract with the service business is not permitted in the new contract setting, the contract feasibility determination unit 205 notifies the service server 20 that a contract with the user corresponding to the personal identification information is not possible.

[0129] The personal identification code control unit 206 is a means for controlling the "personal identification code" transmitted and received between the distribution control server 10 and the service server 20. The personal identification code control unit 206 periodically or at a predetermined timing transmits a "user information provision request" including personal identification information (e.g., name, etc.) of a user whose user registration has been completed to each service provider (service server 20).

[0130] In response to the transmission of the user information request, the personal identification code control unit 206 receives the user information from the service server 20. As described above, the user information includes a personal identification code and a business code. The personal identification code control unit 206 stores the acquired personal identification code in the field of the corresponding business code in the user information database.

[0131] For example, when user registration for user U1 has been completed, a request for providing user information including personal identification information of user U1 is sent periodically or at a predetermined timing to the service server 20. If a personal identification code for user U1 has been generated at the time the personal identification information of user U1 is received, the service server 20 sends the user information to the distribution control server 10 in response to the request for providing user information.

[0132] The personal identification code control unit 206 extracts the user's personal identification code and business code from the user information, and stores the personal identification code in the user information database.

[0133] In this way, the personal identification code control unit 206 stores the user ID of the user and the personal identification code generated by each service provider (service server 20) in association with each other. Since different service providers generate different personal identification codes, the user information database stores the personal identification code for each service provider.

[0134] The location information management unit 207 is a means for managing location information acquired from service providers. The location information management unit 207 stores the location information acquired from each service server 20 in a location information database (see FIG. 20). As shown in FIG. 20, the location information database stores personal identification codes, business codes, and data types in association with each other. Note that the location information database shown in FIG. 20 is an example and is not intended to limit the items to be stored. For example, the date and time when the location information was registered may also be registered in the location information database.

[0135] The data distribution control unit 208 is a means for controlling data distribution by "sharing" or "provision."

[0136] First, data distribution related to "sharing" will be explained.

[0137] The data distribution control unit 208 receives a sharing request from the service server 20. The sharing request includes the personal identification code of the user who is the target of data acquisition, the business code of the sender of the sharing request, and the type of data desired to be acquired. In the example of Fig. 7, the sharing request includes the personal identification code generated for user U1 by medical institution B (service server 20-2), the business code of medical institution B, and "height" as the data type.

[0138] The data distribution control unit 208 identifies the target person for data distribution based on the personal identification code and business operator code included in the sharing request. Specifically, the data distribution control unit 208 identifies the target person by referring to the user information database shown in Fig. 18. In the above example, when a sharing request including the personal identification code "IDB1" is received from medical institution B, the data distribution control unit 208 determines from the entry in the second row shown in Fig. 18 that user U1 is the target person for data distribution.

[0139] The data distribution control unit 208 then identifies a service provider that stores the required data using the identified user's personal identification code and the data type included in the sharing request. Specifically, the data distribution control unit 208 refers to the location information database shown in Fig. 20 and identifies a service provider that stores data corresponding to the data type included in the sharing request. In the above example, medical institution A is identified based on user U1's personal identification code "IDA1" and the data type "height" included in the sharing request.

[0140] If the combination of the user's personal identification code and the data type included in the sharing request is not stored in the location information database, the data distribution control unit 208 sends a negative response to the sender of the sharing request, indicating that the data cannot be shared. In the above example, if the combination of user U1's identification code "IDA1" and data type "height" is not registered in the location information database, a negative response is sent to medical institution B (service server 20-2).

[0141] When the target of data distribution and the accumulator of the data to be distributed are identified, the data distribution control unit 208 accesses the user information database and determines whether to inquire about data sharing with the target of data distribution.

[0142] Specifically, the data distribution control unit 208 refers to the cognitive ability field of the data distribution target. If nothing is set in the field or if "non-dementia patient" is set, the data distribution control unit 208 inquires about data sharing from the data distribution target.

[0143] If the cognitive ability field indicates that the person is a dementia patient, the data distribution control unit 208 does not inquire about data sharing from the data distribution target (dementia patient).

[0144] The data distribution control unit 208 refers to the setting information in the user information database and checks the consent management setting [Data Sharing] corresponding to the business code of the data sharing requester (Medical Institution B in the above example). If the setting permits data sharing with the data sharing requester, the data distribution control unit 208 considers that the data distribution target has agreed to data sharing. If the consent management setting [Data Sharing] does not permit data sharing with the data sharing requester, the data distribution control unit 208 considers that the data distribution target has refused data sharing.

[0145] When making an inquiry about data sharing to a data distribution target, the data distribution control unit 208 sends the inquiry about data sharing to the contact information of the data distribution target. In the above example, the inquiry is sent to the terminal 50 owned by user U1.

[0146] The data sharing inquiry includes information such as the source of the data sharing request, the data accumulator, the type of data to be shared, etc. In the above example, Medical Institution B is set as the source of the data sharing request, Medical Institution A as the data accumulator, and "height" as the type of data to be shared.

[0147] The data distribution control unit 208 receives a response to the data sharing inquiry from the terminal 50 .

[0148] If the user has refused data sharing or is treated as having refused data sharing, the data distribution control unit 208 notifies the source of the data sharing request that data sharing is not possible. In the above example, the data distribution control unit 208 transmits a negative response to the sharing request to the service server 20-2 of medical institution B.

[0149] If the user agrees to data sharing or is deemed to have agreed to data sharing, the data distribution control unit 208 sends a sharing instruction to the data accumulator. In the above example, the sharing instruction is sent to the service server 20-1 of Medical Institution A, which is the data accumulator.

[0150] The sharing instruction includes a personal identification code generated by the data accumulator, information about the data sharing destination, and the type of data to be shared. In the above example, a sharing instruction including the personal identification code "IDA1" of user U1, the address of service server 20-2 of medical institution B, and the data type "height" is sent to service server 20-1 of medical institution A.

[0151] In this way, the data distribution control unit 208 transmits a sharing instruction including a personal identification code of the user (target person) who has agreed to data sharing, which is generated by the data accumulator.

[0152] Next, data distribution related to "provision" will be explained.

[0153] The data distribution control unit 208 receives the request for provision and the list of account holders from the transaction server 40.

[0154] The data distribution control unit 208 identifies the catalog information requested to be provided from the data set name included in the provision request.

[0155] The data distribution control unit 208 refers to the location information database and identifies the personal identification code corresponding to the data type and business code included in the identified catalog information. In the example of Fig. 10, personal identification codes "IDA1" to "IDA3" corresponding to users U1 to U3, respectively, are identified.

[0156] The data distribution control unit 208 identifies the users who correspond to the specified personal identification code and are listed in the account holder list. The data distribution control unit 208 refers to the user information database and identifies each user (at least one or more data distribution targets) who corresponds to the specified personal identification code and is listed in the account holder list.

[0157] When the data distribution target person is specified, the data distribution control unit 208 accesses the user information database and determines whether or not to inquire about the provision of data to the data distribution target person.

[0158] The data distribution control unit 208 refers to the cognitive ability field of the data distribution target. If nothing is set in this field or if "non-dementia patient" is set, the data distribution control unit 208 inquires about data provision to the data distribution target.

[0159] If the cognitive ability field is set to indicate that the person is a dementia patient, the data distribution control unit 208 does not make an inquiry to the data distribution target (dementia patient) regarding the provision of data.

[0160] The data distribution control unit 208 accesses the user information database and references the consent management setting [Data Provision] corresponding to the business code of the data provision requester (in the above example, the data utilization business operator). If the setting permits data provision to the data provision requester, the data distribution control unit 208 considers that the data distribution target has agreed to the data provision. If the consent management setting [Data Provision] does not permit data provision to the data provision requester, the data distribution control unit 208 considers that the data distribution target has refused data provision.

[0161] When making an inquiry about data provision to a data distribution target, the data distribution control unit 208 sends the inquiry about data provision to the contact information of the data distribution target. In the above example, if each of users U1 to U3 has opened an information account with the trading company and is not a dementia patient, the inquiry about data provision is sent to the terminal 50 carried by each user.

[0162] The data provision inquiry includes information about the source of the data request, information about the data accumulator, and the type of data requested to be provided. In the above example, an inquiry is sent to each terminal 50, including the data utilization business as the source of the data request, medical institution A as the data accumulator, and "height" as the type of data requested to be provided.

[0163] The data distribution control unit 208 transmits a provision instruction to the data accumulator for users who have given consent or who are treated as having given consent. The provision instruction includes the personal identification code of the user who has given consent to the data provision (user who is treated as having given consent), information on the data provision destination (address of the business operator terminal 30), and the data type of the data to be provided.

[0164] The data distribution control unit 208 pays a predetermined amount to users who have agreed to the provision of data (users who are treated as having agreed to the provision of data). The data distribution control unit 208 makes the payment by referring to the account information of each user. Alternatively, the data distribution control unit 208 may instruct the trading company (trading server 40) to pay the predetermined amount to the user while specifying the user's user ID.

[0165] The catalog information management unit 209 is a means for managing catalog information, and stores the catalog information created by the system administrator in the storage unit 210.

[0166] The catalog information management unit 209 receives a "catalog information transmission request" from the transaction server 40. In response to the reception of the request, the catalog information management unit 209 transmits the catalog information stored in the storage unit 210 to the transaction server 40.

[0167] The storage unit 210 stores information necessary for the operation of the distribution control server 10. A user information database is constructed in the storage unit 210. Furthermore, the storage unit 210 also constructs a database that stores names of service providers in association with provider codes.

[0168] The operation of the distribution control server 10 according to the first embodiment will be described with reference to the drawings.

[0169] <Operations when signing a new contract> 21 is a flowchart showing an example of the operation of the distribution control server 10 according to the first embodiment. With reference to FIG. 21, the operation of the distribution control server 10 when processing a "contract availability determination request" will be described.

[0170] The distribution control server 10 receives a "contract availability determination request" regarding a contract with a new customer from the service server 20 (step S101).

[0171] The distribution control server 10 determines whether or not the user corresponding to the individual identification information included in the contract possibility determination request is a dementia patient (step S102).

[0172] If the user is not a dementia patient (step S102, No branch), the distribution control server 10 sets "contract possible" in the response to the contract possibility determination request (step S103).

[0173] If the user is a dementia patient (step S102, Yes branch), the distribution control server 10 determines whether or not the user has set up a contract permission in advance with the service provider (step S104).

[0174] If the user has previously permitted the service provider to make a new contract (step S104, Yes branch), the distribution control server 10 sets "contract permitted" in the response to the contract availability determination request (step S103).

[0175] If the user has not previously permitted the service provider to enter into a new contract (step S104, No branch), the distribution control server 10 sets "contract not permitted" in the response to the contract availability determination request (step S105).

[0176] The distribution control server 10 transmits a response to the request for determining whether or not the contract can be concluded to the service server 20 (step S106).

[0177] In this way, the service server 20 of the service provider (second service provider) that intends to enter into a contract with the user requests the distribution control server 10 to determine whether or not it is possible to enter into a contract with the user before the service provider starts providing the service to the user. If the new contract setting indicates that a new contract with the service provider is permitted, the distribution control server 10 permits the user to enter into a contract with the service provider. If the new contract setting indicates that a new contract with the service provider is denied, the distribution control server 10 denies the user from entering into a contract with the service provider.

[0178] <Data sharing behavior> 22 is a flowchart showing an example of the operation of the distribution control server 10 according to the first embodiment. With reference to FIG. 22, the operation of the distribution control server 10 when processing a "sharing request" will be described.

[0179] The distribution control server 10 receives from a service server 20 a "sharing request" regarding data accumulated by another service server 20 (step S201).

[0180] The distribution control server 10 identifies the data sharing target based on the sharing request, and determines whether the data sharing target is a dementia patient (step S202).

[0181] If the data sharing target person is not a dementia patient (step S202, No branch), the distribution control server 10 transmits a data sharing inquiry to the data sharing target person (step S203).

[0182] If the data sharing target person agrees to the data sharing (step S204, Yes branch), the distribution control server 10 transmits a "sharing instruction" to the data accumulator (service server 20 of the data accumulator) (step S205).

[0183] If the data sharing target person refuses the data sharing (step S204, No branch), the distribution control server 10 notifies the data sharing requester (the service server 20 that made the data sharing request) that the data sharing is not possible (step S206).

[0184] If the data sharing target is a dementia patient (step S202, Yes branch), the distribution control server 10 determines whether or not the user has set in advance to allow data sharing for the service sharing requester (step S207).

[0185] If the user permits the service provider to share the data (step S207, Yes branch), the distribution control server 10 transmits a "sharing instruction" to the data accumulator (service server 20 of the data accumulator) (step S205).

[0186] If the user does not permit the service provider to share the data (step S207, No branch), the distribution control server 10 notifies the data sharing requester (service server 20 of the data sharing requester) that sharing is not permitted (step S206).

[0187] <Data sharing behavior> 23 is a flowchart showing an example of the operation of the distribution control server 10 according to the first embodiment. With reference to FIG. 23, the operation of the distribution control server 10 when processing a "provision request" will be described.

[0188] The distribution control server 10 receives a "provision request" regarding data accumulated by another service server 20 from the transaction server 40 (step S301).

[0189] The distribution control server 10 identifies the data recipient based on the request for provision and the list of account holders, and determines whether the data recipient is a dementia patient (step S302).

[0190] If the data provision target is not a dementia patient (step S302, No branch), the distribution control server 10 transmits an inquiry about data provision to the data provision target (step S303).

[0191] If the data provider agrees to the data provision (step S304, Yes branch), the distribution control server 10 transmits a "provision instruction" to the data accumulator (service server 20 of the data accumulator) (step S305).

[0192] If the data providing target refuses to provide the data (step S304, No branch), the distribution control server 10 ends the processing for the data providing target.

[0193] If the data sharing target is a dementia patient (step S302, Yes branch), the distribution control server 10 determines whether the user has previously set permission for data provision to the data requester (e.g., a pharmaceutical company) (step S306).

[0194] If the user has given permission for the data requester (data utilization business operator) to provide data (step S306, Yes branch), the distribution control server 10 sends a "provision instruction" to the data accumulator (data accumulator's service server 20) (step S305).

[0195] If the user does not permit the data requester (data utilizing business operator) to provide data (step S306, No branch), the distribution control server 10 ends the processing related to the data providing target.

[0196] As explained with reference to Figures 22 and 23, if the consent management settings allow the data stored in the service server 20 to be distributed to other businesses, the distribution control server 10 instructs the service server 20 to distribute the stored data.

[0197] [Service Server] 24 is a diagram showing an example of a processing configuration (processing modules) of the service server 20 according to the first embodiment. Referring to FIG. 24, the service server 20 includes a communication control unit 301, a contract control unit 302, a personal identification code management unit 303, a sharing request unit 304, a data accumulation unit 305, a data distribution unit 306, and a storage unit 307.

[0198] The communication control unit 301 is a means for controlling communication with other devices. For example, the communication control unit 301 receives data (packets) from the distribution control server 10. The communication control unit 301 also transmits data to the distribution control server 10. The communication control unit 301 passes data received from other devices to other processing modules. The communication control unit 301 transmits data acquired from other processing modules to other devices. In this way, other processing modules transmit and receive data to and from other devices via the communication control unit 301. The communication control unit 301 has a function as a receiving unit that receives data from other devices and a function as a transmitting unit that transmits data to other devices.

[0199] The contract control unit 302 is a means for controlling the contract with the user. When a user (customer) applies for the provision of a service, the contract control unit 302 acquires information such as the user's name and date of birth. For example, an employee of the service provider enters the information into the service server 20.

[0200] When the user's personal information is acquired, the contract control unit 302 transmits to the distribution control server 10 a contract approval / disapproval determination request including the user's personal identification information (for example, name, etc.) and the business code.

[0201] The contract control unit 302 receives a response (contract possible, contract impossible) to the request to determine whether or not a contract can be made from the distribution control server 10. The contract control unit 302 notifies the received response to an employee or the like of the service provider. If the response is "contract possible," the employee or the like takes steps to provide the service to the new customer. If the response is "contract impossible," the employee or the like informs the customer that the service cannot be provided.

[0202] The personal identification code management unit 303 is a means for managing personal identification codes. For example, when providing a service to a new customer, the personal identification code management unit 303 generates a personal identification code for the customer. Alternatively, the personal identification code management unit 303 obtains a personal identification code generated by an employee of the service provider or the like.

[0203] The personal identification code management unit 303 transmits the corresponding user information in response to receiving a request for providing user information including the user's personal identification information from the distribution control server 10. The user information includes a personal identification code and a business code.

[0204] The sharing request unit 304 is a means for requesting the information distribution business operator to "share" the user's data. The sharing request unit 304 transmits a sharing request to the distribution control server 10 in response to an operation by a service provider employee or the like. Specifically, the sharing request unit 304 transmits a sharing request to the distribution control server 10, which includes the personal identification code of the user who is the target of data acquisition, the business code of the user's own device, and the type of data that the user wishes to acquire.

[0205] The data storage unit 305 is a means for storing data resulting from the provision of services to users. The data storage unit 305 stores the personal identification code of the user and the data resulting from the provision of services to the user in an accumulation database in association with each other (see FIG. 25).

[0206] As shown in Fig. 25, the data accumulation unit 305 stores information on the generated data in a field corresponding to the type of the generated data. Note that Fig. 25 shows an example of an accumulation database constructed in the service server 20-1 of the medical institution A.

[0207] Every time data is stored in the storage database, the data accumulation unit 305 transmits location information to the distribution control server 10. For example, when a service is provided to a user U1 with a personal identification code "IDA1" and height data is generated as a result of a medical examination, location information including the personal identification code "IDA1," the business code "medical institution A," and the data type "height" is transmitted to the distribution control server 10.

[0208] The data distribution unit 306 is a means for realizing data distribution by “sharing” or “provision.” The data distribution unit 306 processes a “sharing instruction” or a “provision instruction” received from the distribution control server 10.

[0209] When a sharing instruction is received, the data distribution unit 306 refers to the accumulation database and identifies an entry corresponding to the personal identification code and data type included in the sharing instruction. For example, when a sharing instruction including the personal identification code "IDA1" and the data type "height" is received, the data distribution unit 306 identifies the entry shown in the top row of Fig. 25.

[0210] The data distribution unit 306 transmits the stored data described in the data type field corresponding to the identified entry to the data sharing destination specified in the sharing instruction. In the above example, the height of 170 cm is transmitted to the service server 20-2 of medical institution B.

[0211] The data distribution unit 306 processes the provision instruction in the same way as the sharing instruction. The data distribution unit 306 transmits the stored data determined by the personal identification code and data type included in the provision instruction to the data destination specified by the provision instruction.

[0212] The storage unit 307 stores information necessary for the operation of the service server 20 .

[0213] [Operator terminal] A detailed description of the processing configuration of the business operator terminal 30 will be omitted. The business operator terminal 30 simply presents information to a user (such as an employee of a data utilization business operator) and accepts operations from the user. Specifically, the business operator terminal 30 simply displays a list of catalog information acquired from the transaction server 40, and transmits a request for provision to the transaction server 40, including the data set name and search conditions of the catalog information selected by the user.

[0214] [Trade Server] 26 is a diagram showing an example of a processing configuration (processing module) of the trading server 40 according to the first embodiment. Referring to FIG. 26, the trading server 40 includes a communication control unit 401, an account opening unit 402, a catalog information request unit 403, a provision request processing unit 404, and a storage unit 405.

[0215] The communication control unit 401 is a means for controlling communication with other devices. For example, the communication control unit 401 receives data (packets) from the distribution control server 10. The communication control unit 401 also transmits data to the distribution control server 10. The communication control unit 401 hands over data received from other devices to other processing modules. The communication control unit 401 transmits data acquired from other processing modules to other devices. In this way, other processing modules transmit and receive data to and from other devices via the communication control unit 401. The communication control unit 401 has a function as a receiving unit that receives data from other devices and a function as a transmitting unit that transmits data to other devices.

[0216] The account opening unit 402 is a means for opening an account for a user who wishes to distribute data through provision. The account opening unit 402 acquires a user ID from the user's terminal 50. The account opening unit 402 adds the acquired user ID to a list of account holders (see FIG. 27).

[0217] The catalog information request unit 403 is a means for transmitting a “catalog information transmission request” to the distribution control server 10 .

[0218] When the catalog information request unit 403 receives a “catalog information presentation request” from the business operator terminal 30 , it transmits a “catalog information transmission request” to the distribution control server 10 .

[0219] In response to sending the request, the catalog information requesting unit 403 acquires catalog information stored in the distribution control server 10. The catalog information requesting unit 403 selects catalog information related to the service provider with which the device is affiliated, and transmits it to the data utilizing business (business terminal 30). The catalog information requesting unit 403 selects catalog information related to the affiliated service provider based on the business code of the affiliated service provider and the business code included in the catalog information.

[0220] The provision request processing unit 404 is a means for processing provision requests received from the business operator terminal 30. The provision request processing unit 404 examines the search conditions included in the provision request. Specifically, the provision request processing unit 404 examines the consistency between the data utilization purpose of the data utilizing business operator and the utilization purpose of the target data type. For example, if the content is "utilization purpose: development of new drugs, data type: height", the examination will pass. In other words, the data utilizing business operator (business operator terminal 30) inputs the above-mentioned utilization purpose and data type into the transaction server 40 when requesting data provision.

[0221] If the examination is passed, the provision request processing unit 404 transmits the provision request acquired from the business operator terminal 30 together with the list of account holders to the distribution control server 10 .

[0222] The storage unit 405 stores information necessary for the operation of the transaction server 40. The storage unit 405 stores the business code of the partner service business.

[0223] [Device] 28 is a diagram showing an example of a processing configuration (processing module) of the terminal 50 according to the first embodiment. Referring to FIG. 28, the terminal 50 includes a communication control unit 501, a personal information input unit 502, a setting control unit 503, an inquiry processing unit 504, an account information input unit 505, and a storage unit 506.

[0224] The communication control unit 501 is a means for controlling communication with other devices. For example, the communication control unit 501 receives data (packets) from the distribution control server 10. The communication control unit 501 also transmits data to the distribution control server 10. The communication control unit 501 passes data received from other devices to other processing modules. The communication control unit 501 transmits data acquired from other processing modules to other devices. In this way, other processing modules transmit and receive data to and from other devices via the communication control unit 501. The communication control unit 501 has a function as a receiving unit that receives data from other devices and a function as a transmitting unit that transmits data to other devices.

[0225] The personal information input unit 502 is a means for inputting personal information to the distribution control server 10 when a user registers. The personal information input unit 502 uses any means to input personal information (such as name, date of birth, contact information, and account information) to the distribution control server 10. For example, the personal information input unit 502 acquires the above personal information from the user using a GUI and transmits the acquired personal information to the distribution control server 10.

[0226] The personal information input unit 502 stores the user ID issued by the distribution control server 10 in the storage unit 506 .

[0227] The setting control unit 503 is a means for controlling various settings (setting changes) when using the information distribution system. The setting control unit 503 performs various settings when using the information distribution system in accordance with the GUI (GUI shown in FIGS. 11 to 14) displayed by accessing the personal portal.

[0228] The query processing unit 504 is a means for processing queries received from the distribution control server 10 when data is distributed by sharing or by providing. The query processing unit 504 obtains the user's intention (agreement or disagreement to data distribution) using a GUI that matches the content of the query (data sharing, data provision). The query processing unit 504 transmits a response including the user's intention to the distribution control server 10.

[0229] The account information input unit 505 is a means for inputting information for opening an information account, which is required when distributing data through provision, to the trading server 40. The account information input unit 505 transmits the user ID of the user to the trading server 40.

[0230] The storage unit 506 stores information necessary for the operation of the terminal 50 .

[0231] [System Operation] Next, the operation of the information distribution system according to the first embodiment will be described.

[0232] 29 is a sequence diagram showing an example of the operation of the information distribution system according to the first embodiment. With reference to FIG. 29, the system operation regarding data sharing will be described.

[0233] The service server 20 of a service provider that wishes to share data transmits a sharing request including the data type and the like to the distribution control server 10 (step S401).

[0234] In response to receiving the sharing request, the distribution control server 10 identifies the target person with whom the data is to be shared (step S402).

[0235] The distribution control server 10 checks the cognitive ability of the identified data sharing target person (step S403).

[0236] The distribution control server 10 obtains whether or not data sharing is permitted by inquiring of the data sharing target person or by referring to the setting information (step S404).

[0237] If data sharing is possible, the distribution control server 10 transmits a sharing instruction to the service server 20 of the data accumulator (step S405).

[0238] The service server 20 of the data accumulator transmits the accumulated data of the specified user to the service server 20 of the data sharing requester (data sharing; step S406).

[0239] 30 is a sequence diagram showing an example of the operation of the information distribution system according to the first embodiment. With reference to FIG. 30, the system operation regarding data provision will be described.

[0240] The trading server 40 of the trading company transmits a request for provision including the data set name and the like to the distribution control server 10 (step S501).

[0241] In response to receiving the request for provision, the distribution control server 10 identifies the target person to whom the data is to be provided (step S502).

[0242] The distribution control server 10 checks the cognitive ability of the identified data providing target person (step S503).

[0243] The distribution control server 10 inquires of the data recipient or refers to the setting information to obtain whether or not data can be provided (step S504).

[0244] If the data can be provided, the distribution control server 10 transmits a provision instruction to the service server 20 of the data accumulator (step S505).

[0245] The service server 20 of the data accumulator transmits the accumulated data of the instructed user to the business operator terminal 30 of the data utilization business operator that requested the provision of data (data provision; step S506).

[0246] As described above, the information distribution system according to the first embodiment appropriately acquires the user's mental capacity (cognitive ability, judgment ability), and restricts the provision of services to the user if it is determined that the user's mental capacity has declined. As a result, the accumulated data of a user with declined mental capacity will not be passed on to external businesses, etc., and no disadvantages such as the infringement of the user's privacy will occur. Furthermore, before the user's cognitive ability declines, the user can set restrictions on the provision of services, imagining the situation in which their cognitive ability will decline. As a result, the user can continue to use the information distribution system with peace of mind, even if their cognitive ability declines.

[0247] [Second embodiment] Next, the second embodiment will be described in detail with reference to the drawings.

[0248] In the first embodiment, a case where a user sets up an information distribution system in preparation for the case where the user loses mental capacity (cognitive ability, judgment ability) in the future, and the information distribution system operates according to the set up, is described. In the second embodiment, a case where a proxy is set up in preparation for the case where the user loses mental capacity is described.

[0249] The following description will focus on the differences between the first and second embodiments.

[0250] <Proxy settings> In the dementia support settings, the user sets a proxy to act in the event that the user loses decision-making capacity in the future. For example, the user sets "proxy information," "proxy authority information," and "proxy viewing range information" as information about the proxy. The proxy information includes, for example, the proxy's name, date of birth, contact information, etc. The proxy authority information is information that defines the authority granted to the proxy. The proxy viewing range information is information that defines the range of access the proxy has to the accumulated data. Note that the legal requirements for becoming a proxy for a user with reduced decision-making capacity are outside the scope of the present disclosure, and therefore detailed explanations thereof will be omitted. The user sets a child, parent, etc. as a proxy.

[0251] The setting management unit 203 of the distribution control server 10 displays, for example, a GUI such as that shown in Fig. 31 on the user's terminal 50. When the "agent authority setting" button in Fig. 31 is pressed, the setting management unit 203 displays a GUI such as that shown in Fig. 32. As shown in Fig. 32, the setting management unit 203 enables a setting as to whether an agent is authorized to enter into a new contract (agent new contract setting). The setting management unit 203 also enables a setting as to whether an agent is authorized to consent to data distribution (agent consent management setting).

[0252] When the "Agent New Contract Settings" button shown in Fig. 32 is pressed, the setting management unit 203 displays a GUI such as that shown in Fig. 33 and obtains the authority given to the agent by the principal. As shown in Fig. 33, the setting management unit 203 makes it possible to select whether to give the agent the authority to make contracts with all service providers. Alternatively, the distribution control server 10 makes it possible to select, for each service provider, whether to give the agent the authority to make new contracts.

[0253] When the "Proxy Consent Management Settings" button shown in FIG. 32 is pressed, the setting management unit 203 displays a GUI such as that shown in FIG. 34 and acquires the authority to be granted to the proxy by the principal. As shown in FIG. 34, the setting management unit 203 allows the user to select whether or not to grant the proxy the authority to consent to requests from service providers, etc., regarding data distribution (data sharing, data provision). In this case, the setting management unit 203 allows the user to select whether or not to grant the proxy the authority to consent to requests from all service providers (data utilization businesses), or whether or not to grant authority for each service provider (data utilization business). Note that the setting management unit 203 may display a setting in FIG. 34 that allows the user to select, for example, "Do not grant authority to all service providers."

[0254] When the "Set proxy viewing range" button is pressed in Fig. 31, the setting management unit 203 displays a GUI as shown in Fig. 35. As shown in Fig. 35, the setting management unit 203 allows the proxy to select the service providers whose stored data can be viewed. In this case, the setting management unit 203 allows the proxy to select whether to allow the proxy to view data stored by all service providers or to allow the proxy to view data stored by each service provider for each service provider.

[0255] The setting management unit 203 stores information about the agent (agent information, agent authority information, agent viewing range information) acquired using the GUI in the user information database (see FIG. 36). FIG. 36 is a diagram showing an extracted portion of the user information database. Note that the "agent new contract setting" and "agent consent management setting" listed in the agent authority information in FIG. 36 state whether or not the agent has been granted authority to make a new contract for each service provider, and whether or not the agent has been granted authority to consent to data distribution (data sharing, data provision).

[0256] <New contract by agent> When a proxy is set for a user with reduced cognitive ability, the distribution control server 10 treats the actions of the proxy as actions of the user within the scope of the authority granted to the proxy.

[0257] Specifically, when a user wishes to enter into a contract with a new service provider, if the user is a dementia patient and has a proxy set up, the contract feasibility determination unit 205 inquires of the proxy whether or not the user can enter into a contract with the service provider.

[0258] If the agent accepts the contract, the contract permission determination unit 205 permits the user (user with reduced cognitive ability) to enter into a contract with the service provider.

[0259] 37, the service server 20 transmits a contract feasibility determination request including the user's personal identification information to the distribution control server 10. If the cognitive ability of the user corresponding to the personal identification information has declined, an agent has been set, and the agent has been given the authority to enter into a contract with the service provider with which the new contract will be made, the contract feasibility determination unit 205 of the distribution control server 10 transmits a "new contract inquiry" to the agent.

[0260] Specifically, the contract feasibility determination unit 205 references the cognitive ability field and the agent information field in the user information database to acquire the user's cognitive ability and the agent's setting status. The contract feasibility determination unit 205 also references the agent new contract setting field to acquire whether the principal has given the agent the authority to enter into a contract with the service provider with whom the principal wishes to enter into a new contract.

[0261] If the above three conditions are met, the contract possibility determination unit 205 sends the above "new contract inquiry" to the proxy contact information in the user information database. The new contract inquiry includes personal identification information of the user (proxy) with reduced cognitive ability, information on the service provider with whom the new contract will be made (for example, the business type and name of the service provider), etc.

[0262] The agent uses the agent terminal 60 to check the content of the new contract inquiry (the business details of the service provider to be contracted) and judges whether or not to accept the contract. The agent terminal 60 transmits the confirmation result (contract acceptable / unacceptable) to the distribution control server 10. Note that even if the agent is authorized to enter into a contract with a new service provider, the agent can of course refuse the contract if the agent judges that it is not appropriate for the principal to enter into a contract with the service provider.

[0263] The contract availability determination unit 205 of the distribution control server 10 transmits the result (contract available or unavailable) acquired from the agent to the service server 20 as a response to the contract availability determination request.

[0264] In this way, the distribution control server 10 refers to the proxy authority information when a user who has set up a proxy and whose mental capacity has declined wishes to enter into a contract with a fourth service provider. If the proxy authority information grants the proxy the authority to enter into a new contract with the fourth service provider, the distribution control server 10 inquires of the proxy regarding the conclusion of a new contract between the user and the fourth service provider. If the proxy agrees to enter into a contract with the fourth service provider, the distribution control server 10 permits the user to enter into a contract with the fourth service provider. If the proxy refuses to enter into a contract with the fourth service provider, the distribution control server 10 refuses to enter into a contract between the user and the fourth service provider. If the proxy authority information does not grant the proxy the authority to enter into a new contract with the fourth service provider, the distribution control server 10 refuses to enter into a contract with the fourth service provider.

[0265] Handling Data Sharing Requests by Agents When processing a request for data sharing, if the cognitive ability of the corresponding user has declined and a proxy has been set for the user, the distribution control server 10 processes the request for data sharing in accordance with the proxy consent management settings.

[0266] Specifically, if the agent is authorized to agree to a request from the service sharing requester (service provider), the data distribution control unit 208 of the distribution control server 10 will inquire about data sharing from the agent (see step S12a in Figure 38).

[0267] The distribution control server 10 treats the response from the agent as a response from the user himself / herself. If the agent is not authorized to agree to an inquiry from a service sharing requester (service provider), the data distribution control unit 208 of the distribution control server 10 treats the user as having refused data sharing.

[0268] Processing data requests by agents The distribution control server 10 processes requests for data provision in the same way as requests for data sharing. That is, if a representative has been designated for the person with cognitive impairment and the representative has been given the authority to consent to requests from data utilization businesses, the distribution control server 10 will inquire of the representative.

[0269] In this way, the distribution control server 10 sets up a proxy and, when a user with impaired mental capacity requests data distribution of stored data, references the proxy authority information. If the proxy authority information grants the proxy the authority to consent to the distribution of the stored data to the data distribution destination, the distribution control server 10 inquires about the data distribution to the proxy. If the proxy consents to the data distribution, the distribution control server 10 distributes the stored data to the data distribution destination (issues a sharing instruction and a provision instruction to the service server 20). If the proxy rejects the data distribution, the distribution control server 10 does not distribute the stored data. If the proxy authority information does not grant the proxy the authority to consent to the distribution of the stored data to the data distribution destination, the distribution control server 10 does not distribute the stored data.

[0270] <Viewing of stored data by a proxy> The agent can request to view the stored data of the user (see FIG. 39). Specifically, the agent terminal 60 transmits a view request to the distribution control server 10, which includes the agent identifying information, the personal identifying information of the agent (proxy), the business code of the service business that has stored the data the agent wishes to view, and the type of data to view (step S31). Examples of the agent identifying information that identifies the agent include the agent's name, or a combination of the agent's name and date of birth.

[0271] The data distribution control unit 208 of the distribution control server 10 refers to the user information database and determines whether an agent has been set for the user corresponding to the personal identification information, and whether the set agent matches the agent specified in the agent identification information.

[0272] If the request is not from a valid agent (if the agent's name, etc. does not match), the data distribution control unit 208 rejects the request to view from the agent (sends a negative response).

[0273] If the request is from a legitimate agent (if the agent's name, etc. matches), the data distribution control unit 208 refers to the agent viewing range information and determines whether the agent is permitted to view the data stored by the service provider corresponding to the business code included in the viewing request.

[0274] If viewing is not permitted, the data distribution control unit 208 rejects the viewing request from the proxy (transmits a negative response).

[0275] If viewing is permitted, the data distribution control unit 208 sends a "disclosure instruction" to the service server 20 of the service provider corresponding to the provider code included in the viewing request (step S32). The disclosure instruction includes the personal identification code of the user (represented), the data type, and the recipient of the data (contact information of the representative), etc.

[0276] In accordance with the disclosure instruction, the service server 20 transmits the corresponding stored data to the agent (agent terminal 60) (step S33).

[0277] The service server 20 processes the "disclosure instruction" in the same way as the "provision instruction," so detailed explanation will be omitted.

[0278] In this way, when an agent requests to view the stored data, the distribution control server 10 checks whether the user who set up the agent has mental capacity and the agent viewing range information. If the user's mental capacity has declined and the agent viewing range information indicates that the agent can view the stored data, the distribution control server 10 instructs the corresponding service server 20 to disclose the stored data to the agent.

[0279] A detailed description of the processing configuration of the agent terminal 60 according to the second embodiment will be omitted. The agent terminal 60 only needs to present information to the agent and accept operations from the agent. The agent terminal 60 only needs to process inquiries about data sharing and send viewing requests.

[0280] As described above, the information distribution system according to the second embodiment allows a proxy to be set in case the user's cognitive ability declines. When the user's cognitive ability declines, the distribution control server 10 requests a pre-set proxy to perform various procedures (such as determining whether to consent to data distribution from service providers, etc.). At this time, the user can set the authority to grant to the proxy in advance, thereby preventing the proxy from performing actions against the user's will. Furthermore, since the proxy can view stored data on behalf of a user with cognitive decline, it is possible to avoid situations such as when necessary data cannot be accessed in an emergency situation due to the user's lack of consent.

[0281] [Third embodiment] Next, the third embodiment will be described in detail with reference to the drawings.

[0282] In the second embodiment, a case where a proxy is set up in case the user loses mental capacity is described. In the third embodiment, a case where an information distribution business operator outsources the function related to the "user's proxy" to an external party is described.

[0283] The following description will focus on the differences between the first to third embodiments.

[0284] Fig. 40 is a diagram showing an example of a schematic configuration of an information distribution system according to the third embodiment. As shown in Fig. 40, the information distribution system according to the third embodiment includes a data trust business operator.

[0285] A data trust business is a business that provides users with various services related to data management. In this respect, the data trust business is an example of a service business. The data trust business concludes a contract regarding data management with the user. The data trust business is equipped with a trust server 70.

[0286] [Trust Server] 41 is a diagram showing an example of the processing configuration (processing module) of the trusted server 70 according to the third embodiment. Referring to FIG. 41, the trusted server 70 includes a communication control unit 601, a contractor information acquisition unit 602, an agent management unit 603, and a storage unit 604.

[0287] The communication control unit 601 is a means for controlling communication with other devices. For example, the communication control unit 601 receives data (packets) from the distribution control server 10. The communication control unit 601 also transmits data to the distribution control server 10. The communication control unit 601 hands over data received from other devices to other processing modules. The communication control unit 601 transmits data acquired from other processing modules to other devices. In this way, other processing modules transmit and receive data to and from other devices via the communication control unit 601. The communication control unit 601 has a function as a receiving unit that receives data from other devices and a function as a transmitting unit that transmits data to other devices.

[0288] The contractor information acquisition unit 602 is a means for acquiring information about a user (contractor) who has entered into a contract for data management. The contractor information acquisition unit 602 may acquire information about the contractor from the information distribution company by data sharing, or may acquire information about the contractor by other methods. When data sharing is used, the information distribution company acts as a data accumulator.

[0289] The contractor information acquisition unit 602 periodically or at a predetermined timing acquires the contractor's cognitive ability, settings related to dementia (service restriction setting information), information about the agent (agent information, agent authority information, agent viewing range information), etc. The contractor information acquisition unit 602 stores the acquired information in a contractor information database. The specific configuration of the contractor information database overlaps with part of the configuration of the user information database of the distribution control server 10, so a detailed description will be omitted.

[0290] The agent management unit 603 is a means for controlling and managing the agent of the user. The agent management unit 603 accesses the contractor information database and periodically checks the status of the user's cognitive ability (mental capacity).

[0291] If the user's cognitive ability has declined (the user has dementia) and a proxy has been set up in advance, the proxy management unit 603 notifies the set proxy of "proxy start." Specifically, the proxy management unit 603 sends a "proxy start notification" to the proxy terminal 60 of the proxy. The proxy start notification includes the name of the user (proxy, delegate), etc.

[0292] Upon receiving the notification, the agent recognizes that the proxy service has begun. The agent performs the proxy service based on the authority, scope of access, etc., of the agent set by the user.

[0293] When the user's cognitive ability is not declining and a proxy has not been set for the user, the proxy management unit 603 may recommend that the user set a proxy. Specifically, the proxy management unit 603 makes the recommendation based on the user's attribute information (e.g., age, etc.).

[0294] If the agent management unit 603 determines that a proxy should be set up, it sends a "proxy setting recommendation notice" to the user's terminal 50. The terminal 50, upon receiving the notice, notifies the user accordingly. The user sets up the proxy as explained in the second embodiment on the personal portal provided by the distribution control server 10.

[0295] The proxy management unit 603 may also examine whether the proxy settings of the user are appropriate. Specifically, the proxy management unit 603 examines the proxy settings that the user has already set and the proxy settings that have been set in accordance with the above recommendations.

[0296] For example, the agent management unit 603 examines the authority given to the agent (authority to enter into a contract with a new service provider, authority to consent to data distribution, authority to view data). For example, if the agent is able to enter into a new contract with all service providers or is able to view all stored data, the agent management unit 603 determines that the settings related to the agent are inappropriate.

[0297] If the settings are inappropriate, the proxy management unit 603 prompts the user to reset the proxy settings. At that time, the proxy management unit 603 may provide the user with recommended settings. Specifically, the proxy management unit 603 may transmit the recommended settings to the user's terminal 50.

[0298] If the user's cognitive ability declines and the user has not yet been assigned a proxy, the proxy management unit 603 may select a proxy and set its authority. Alternatively, the data trust business operator itself may become the proxy. In this case, the proxy management unit 603 notifies the distribution control server 10 that the selected proxy or data trust business operator has been appointed as the proxy. Specifically, the proxy management unit 603 notifies the distribution control server 10 of proxy information, proxy authority information, proxy viewing range information, etc.

[0299] The storage unit 604 stores information necessary for the operation of the trusted server 70 .

[0300] As described above, in the information distribution system according to the third embodiment, the data trust business operator provides various services to ensure that user data is used appropriately. For example, the data trust business operator determines the need for a proxy based on the user's age, etc., and recommends that the user set up a proxy as necessary. By setting up a proxy in accordance with the recommendation, the user can use the information distribution system with peace of mind.

[0301] Next, the hardware of each device constituting the information distribution system will be described. Fig. 42 is a diagram showing an example of the hardware configuration of the distribution control server 10.

[0302] The distribution control server 10 can be configured by an information processing device (so-called computer), and has the configuration exemplified in Fig. 42. For example, the distribution control server 10 includes a processor 311, a memory 312, an input / output interface 313, and a communication interface 314. The components such as the processor 311 are connected by an internal bus or the like, and are configured to be able to communicate with each other.

[0303] However, the configuration shown in Fig. 42 is not intended to limit the hardware configuration of the distribution control server 10. The distribution control server 10 may include hardware not shown, and may not include the input / output interface 313 as necessary. Furthermore, the number of processors 311 and the like included in the distribution control server 10 is not intended to be limited to the example shown in Fig. 42, and for example, the distribution control server 10 may include multiple processors 311.

[0304] The processor 311 is a programmable device such as a central processing unit (CPU), a micro processing unit (MPU), or a digital signal processor (DSP). Alternatively, the processor 311 may be a device such as a field programmable gate array (FPGA) or an application specific integrated circuit (ASIC). The processor 311 executes various programs including an operating system (OS).

[0305] The memory 312 is a random access memory (RAM), a read only memory (ROM), a hard disk drive (HDD), a solid state drive (SSD), etc. The memory 312 stores an OS program, application programs, and various data.

[0306] The input / output interface 313 is an interface for a display device and an input device (not shown). The display device is, for example, a liquid crystal display. The input device is, for example, a device that accepts user operations such as a keyboard or a mouse.

[0307] The communication interface 314 is a circuit, module, etc. that communicates with other devices. For example, the communication interface 314 includes a network interface card (NIC).

[0308] The functions of the distribution control server 10 are realized by various processing modules. The processing modules are realized, for example, by the processor 311 executing a program stored in the memory 312. The program can be recorded on a computer-readable storage medium. The storage medium can be a non-transitory medium such as a semiconductor memory, a hard disk, a magnetic recording medium, or an optical recording medium. That is, the present invention can also be embodied as a computer program product. The program can be downloaded via a network or updated using a storage medium storing the program. Furthermore, the processing modules can be realized by semiconductor chips.

[0309] The service server 20 and the like can also be configured using information processing devices in the same way as the distribution control server 10, and the basic hardware configuration is no different from that of the distribution control server 10, so a description thereof will be omitted.

[0310] The distribution control server 10, which is an information processing device, is equipped with a computer, and the functions of the distribution control server 10 can be realized by causing the computer to execute a program. Furthermore, the distribution control server 10 executes the control method of the distribution control server 10 by the program.

[0311] [Variations] The configuration, operation, etc. of the information distribution system described in the above embodiment are merely examples, and are not intended to limit the configuration, etc. of the system.

[0312] In the above embodiment, it has been explained on the assumption that the user's cognitive ability (mental capacity) has not declined when the user inputs service restriction setting information into the information distribution system. However, the distribution control server 10 may check whether the user has mental capacity when registering the user, and may reject the user registration if it determines that the user has no (or has declined) mental capacity. Alternatively, the distribution control server 10 may require the input of service restriction setting information as a condition for user registration for users who have declined mental capacity at the time of user registration. Alternatively, the distribution control server 10 may only allow user registration for users who submit a certificate certifying that their mental capacity has not declined.

[0313] In the above embodiment, the distribution control server 10 has been described as acquiring information about dementia from a medical institution. However, the distribution control server 10 may also confirm whether or not a user has cognitive ability using a simple test or the like. For example, the distribution control server 10 may ask predetermined questions to the user and determine whether or not the user is a dementia patient based on the results. More specifically, the distribution control server 10 may input the answers from the user into a learning model obtained by machine learning and acquire a determination result (non-dementia patient, dementia patient).

[0314] Alternatively, the cognitive ability test may be performed on the terminal 50 owned by the user, rather than at a medical institution or a private service. Specifically, the terminal 50 may determine the cognitive ability of the user based on the user's usage status, operation status, etc. For example, the cognitive ability may be determined based on the number of input errors. In this way, the dementia test may be performed by an application for testing cognitive ability installed on the terminal 50.

[0315] In the above embodiment, it has been described that the distribution control server 10 refers to the service restriction setting information and operates according to the setting depending on whether the user is a dementia patient. Here, the service restriction setting information may describe detailed settings according to the level (symptoms) of the user's dementia. For example, the setting information may describe a setting such that data distribution is permitted for mild dementia and data distribution is denied for severe dementia. In other words, the distribution control server 10 may limit the services provided to a user depending on the level of the user's mental capacity (cognitive ability).

[0316] In the above embodiment, it has been described that the service setting information and the setting information related to the agent (agent new contract setting, agent consent management setting) are used to set whether or not to enter into a contract and whether or not to grant consent for each service provider. However, the distribution control server 10 may provide a GUI that groups the service providers and enables the setting of whether or not to enter into a new contract and the setting of consent management for each group. For example, the distribution control server 10 may divide the service providers into groups such as "medical institutions," "educational institutions," and "retailers," and enable the setting of new contracts and consent management for each group.

[0317] In the above embodiment, the proxy viewing range information describes a case where the service providers that the proxy can view stored data are set. Here, the proxy viewing range information may grant the proxy the authority to view data on a data type basis in addition to the service providers. For example, even if the data is stored at the same medical institution, the information may be set so that "previous conditions" can be viewed but "current conditions" cannot be viewed.

[0318] The user himself / herself does not have to set up a proxy. For example, in the third embodiment, it has been described that the trust server 70 recommends that the user set up a proxy if no proxy has been set up. In this case, if the user's cognitive ability has declined, the trust server 70 may ask a relative or the like of the user to set up a proxy or to act as the proxy.

[0319] The form of data transmission and reception between each device (distribution control server 10, service server 20, etc.) is not particularly limited, but data transmitted and received between these devices may be encrypted. User names and other information are transmitted and received between these devices, and in order to appropriately protect this information, it is desirable to transmit and receive encrypted data.

[0320] In the flow charts (flowcharts, sequence diagrams) used in the above explanation, multiple steps (processes) are described in order, but the execution order of the steps executed in the embodiments is not limited to the order described. In the embodiments, the order of the illustrated steps can be changed to the extent that the content is not affected, such as by executing each process in parallel.

[0321] The above-described embodiments have been described in detail to facilitate understanding of the present disclosure, and it is not intended that all of the above-described configurations are required. Furthermore, when multiple embodiments are described, each embodiment may be used alone or in combination. For example, it is possible to replace part of the configuration of one embodiment with the configuration of another embodiment, or to add the configuration of another embodiment to the configuration of one embodiment. Furthermore, it is possible to add, delete, or replace part of the configuration of one embodiment with another configuration.

[0322] The above explanation makes it clear that the present invention has industrial applicability, and the present invention is suitably applicable to information distribution systems that handle accumulated data generated by providing services to users.

[0323] Some or all of the above embodiments can be described as, but are not limited to, the following supplementary notes. [Appendix 1] a service server operated by the first service provider and accumulating data generated by providing services to users; a distribution control server that provides a data distribution service for the stored data; Including, The distribution control server limits the provision of services to a user whose mental capacity has declined when the user's mental capacity has declined. [Appendix 2] The distribution control server A system as described in Appendix 1, which restricts the provision of services to a user with reduced mental capacity based on configuration information that defines how to restrict the services provided to the user with reduced mental capacity. [Appendix 3] The setting information is The system described in Appendix 1 or 2, including a new contract setting regarding the conclusion of a new contract between the user and a second service provider, and a consent management setting regarding the utilization of data accumulated by a third service provider. [Appendix 4] the service server of the second service provider requests the distribution control server to determine whether or not the second service provider can enter into a contract with the user before the second service provider starts providing the service to the user; The distribution control server If the new contract setting indicates that the user is permitted to enter into a new contract with the second service provider, permitting the user to enter into a contract with the second service provider; The system described in Appendix 3, wherein if the new contract setting rejects the new contract with the second service provider, the system rejects the contract between the user and the second service provider. [Appendix 5] The distribution control server The system described in Appendix 3 or 4, wherein if the consent management settings permit distribution of data stored in the service server to other businesses, the system instructs the service server to distribute the stored data. [Appendix 6] The distribution control server A system described in any one of Appendices 1 to 5, which obtains, as information regarding the user's agent, agent authority information that defines the authority granted to the agent, and agent viewing range information that defines the range within which the agent can view the accumulated data. [Appendix 7] The distribution control server If the agent is set and the user with impaired mental capacity wishes to enter into a contract with a fourth service provider, and the agent's authority to enter into a new contract with the fourth service provider is granted to the agent in the agent authority information, an inquiry regarding the conclusion of a contract with the fourth service provider is made to the agent, If the agent agrees to enter into a contract with the fourth service provider, authorize the fourth service provider to enter into the contract; If the agent refuses to enter into a contract with the fourth service provider, the fourth service provider will refuse to enter into a contract; The system described in Appendix 6, wherein if the agent authority information does not grant the agent the authority to enter into a new contract with the fourth service provider, the system refuses to enter into a contract with the fourth service provider. [Appendix 8] The distribution control server When the agent is set and the data distribution of the stored data is requested from the user whose mental capacity has decreased, and the agent is given the authority to consent to the distribution of the stored data to a data distribution destination in the agent authority information, an inquiry is made to the agent regarding the data distribution; If the agent agrees to the data distribution, the stored data is distributed to the data distribution destination, If the agent refuses to distribute the data, the stored data will not be distributed, A system as described in Appendix 6 or 7, in which the accumulated data is not distributed if the agent authority information does not grant the agent the authority to consent to the distribution of the accumulated data to a data distribution destination. [Appendix 9] The distribution control server A system as described in any one of Appendices 6 to 8, wherein when the agent requests to view the stored data, if the user who set up the agent has a decline in mental capacity and the agent viewing range information is set to allow the agent to view the stored data, the system instructs the service server to disclose the stored data to the agent. [Appendix 10] The data management system further includes a trust server of a data trust business operator that provides services related to data management to the user; The trusted server: A system according to any one of appendices 1 to 9, wherein if a proxy is set for a user with impaired cognitive abilities, the system notifies the set proxy that proxy has begun. [Appendix 11] The trusted server: The system described in Appendix 10, wherein if the user does not have a proxy set, it recommends setting a proxy based on the user's attribute information. [Appendix 12] A system described in any one of Appendices 1 to 11, wherein the distribution control server obtains a diagnosis result regarding the user's dementia as information regarding the user's mental capacity. [Appendix 13] an acquisition unit that acquires information about the cognitive ability of a user; a data distribution control unit that provides a data distribution service related to accumulated data generated by a service provider providing services to users, and that, when the user's mental capacity has declined, restricts the provision of services to the user whose mental capacity has declined; A server device comprising: [Appendix 14] In the server device, Obtaining information about the user's cognitive abilities; A method for controlling a server device that provides a data distribution service related to accumulated data generated by a service provider providing services to users, and that restricts the provision of services to users with reduced mental capacity if the users' mental capacity is reduced. [Appendix 15] The computer installed in the server device obtaining information about the user's cognitive ability; A process of providing a data distribution service related to accumulated data generated by a service provider providing a service to a user, and restricting the provision of services to the user whose mental capacity has declined when the user's mental capacity has declined; A computer-readable storage medium that stores a program for executing the above.

[0324] The disclosures of the above-cited prior art documents are incorporated herein by reference. Although the embodiments of the present invention have been described above, the present invention is not limited to these embodiments. Those skilled in the art will understand that these embodiments are merely illustrative and that various modifications are possible without departing from the scope and spirit of the present invention. In other words, the present invention naturally includes various modifications and alterations that may be made by those skilled in the art in accordance with the entire disclosure, including the claims, and the technical concepts thereof. [Explanation of symbols]

[0325] 10 Distribution Control Server 20 Service Server 20-1 Service Server 20-2 Service Server 30 Operator terminal 40 trading servers 50 devices 60 Agent terminal 70 Trust Server 101 Service Server 102 Distribution Control Server 201 Communication control unit 202 User Registration Department 203 Settings Management Department 204 Cognitive Acquisition Department 205 Contract Probability Judgment Department 206 Personal Identification Code Control Unit 207 Location Information Management Department 208 Data Distribution Control Unit 209 Catalog Information Management Department 210 Storage section 301 Communication Control Unit 302 Contract Control Section 303 Personal Identification Code Management Department 304 Sharing Request Department 305 Data Storage Unit 306 Data Distribution Department 307 Storage section 311 processor 312 memory 313 Input / Output Interface 314 Communication Interface 401 Communication control unit 402 Account Opening Department 403 Catalog Information Request 404 Provision Request Processing Unit 405 Storage section 501 Communication control unit 502 Personal information input section 503 Setting control unit 504 Query processing unit 505 Account information input section 506 Storage section 601 Communication control unit 602 Contractor Information Acquisition Department 603 Agent Management Department 604 Storage section

Claims

1. a service server operated by the first service provider and accumulating data generated by providing services to users; a distribution control server that provides a data distribution service for the stored data; Including, The distribution control server If the user's mental capacity declines, restricting the provision of services to the user whose mental capacity has declined; restricting the provision of services to the user with impaired mental capacity based on setting information that defines how to restrict the services to be provided to the user with impaired mental capacity; The setting information is A system including a new contract setting for entering into a new contract between the user and a second service provider, and a consent management setting for the utilization of data accumulated by a third service provider.

2. the service server of the second service provider requests the distribution control server to determine whether or not the second service provider can enter into a contract with the user before the second service provider starts providing the service to the user; The distribution control server If the new contract setting indicates that the user is permitted to enter into a new contract with the second service provider, the user is permitted to enter into a contract with the second service provider; The system according to claim 1 , wherein if the new contract setting indicates that the user is denied entry into a new contract with the second service provider, the system denies entry into a contract between the user and the second service provider.

3. The distribution control server The system described in claim 1 or 2, wherein if the consent management setting allows distribution of data stored in the service server to other businesses, the system instructs the service server to distribute the stored data.

4. The distribution control server A system described in any one of claims 1 to 3, which obtains, as information regarding the user's agent, agent authority information that defines the authority granted to the agent, and agent viewing range information that defines the range within which the agent can view the accumulated data.

5. The distribution control server If the agent is set and the user with impaired mental capacity wishes to enter into a contract with a fourth service provider, and the agent is authorized to enter into a new contract with the fourth service provider in the agent authority information, an inquiry regarding the conclusion of a contract with the fourth service provider is made to the agent, If the agent agrees to enter into a contract with the fourth service provider, authorize the fourth service provider to enter into a contract; If the agent refuses to enter into a contract with the fourth service provider, the fourth service provider is refused to enter into a contract; 5. The system according to claim 4, wherein if the agent authority information does not grant the agent authority to enter into a new contract with the fourth service provider, the system refuses to enter into a contract with the fourth service provider.

6. an acquisition unit that acquires information about the cognitive ability of a user; a data distribution control unit that provides a data distribution service related to accumulated data generated by a service provider providing services to users, and that, when the user's mental capacity has declined, restricts the provision of services to the user whose mental capacity has declined; Equipped with The data distribution control unit restricting the provision of services to the user with impaired mental capacity based on setting information that defines how to restrict the services to be provided to the user with impaired mental capacity; The setting information is A server device including a new contract setting for entering into a new contract between the user and a second service provider, and a consent management setting for utilizing data accumulated by a third service provider.

7. In the server device, Obtaining information about the user's cognitive abilities; A service provider provides a data distribution service regarding accumulated data generated by providing services to users, and when the user's mental capacity declines, restricts the provision of services to the user whose mental capacity has declined; A control method for a server device that restricts provision of services to the user with reduced mental capacity based on setting information that defines how to restrict services to be provided to the user with reduced mental capacity, comprising: The setting information is A method for controlling a server device, including setting up a new contract regarding the conclusion of a new contract between the user and a second service provider, and setting up consent management regarding the utilization of data accumulated by a third service provider.

8. The computer installed in the server device obtaining information about the user's cognitive ability; A process of providing a data distribution service related to accumulated data generated by a service provider providing a service to a user, and restricting the provision of services to the user whose mental capacity has declined when the user's mental capacity has declined; A process of restricting the provision of services to the user with reduced mental capacity based on setting information that defines how to restrict the services provided to the user with reduced mental capacity; A program for executing The setting information is A program including a new contract setting for entering into a new contract between the user and a second service provider, and a consent management setting for the utilization of data accumulated by a third service provider.

Images