JP7761146B2 - Systems and methods - Google Patents

Description

The present invention relates to a system and a method.

There is an information distribution system that provides personal information held by hospitals and other institutions to information recipient devices such as businesses based on the individual's consent.

For example, Patent Document 1 describes the provision of a personal data provision system, provision method, and information processing device that realize privacy protection according to the wishes of individuals. The personal data provision system of Patent Document 1 has multiple information processing devices. Each of the multiple information processing devices includes a first transmission unit and an encoding unit. The first transmission unit transmits an inquiry about the encoding method for the personal identifier to each individual's terminal. The encoding unit encodes each individual's identifier based on the response to the inquiry received from each individual's terminal to generate a code for each individual, and associates the individual's code with each individual's personal data.

Japanese Patent Application Laid-Open No. 2018-128884

In the information distribution system (data distribution system) disclosed in Patent Document 1, in order to make user data available to third parties, consent from the users who contributed to the generation of the user data is required. Here, in the personal data trading market, the personal data to be provided may be stored across multiple data providers.

In this case, the data provided to the data recipient must be assigned an ID that indicates that it is data from the same person. Without such an ID, the data recipient will not be able to utilize the data they have acquired.

An identifier known to individuals (user IDs issued by information distribution systems) could be used as the ID assigned to data. Using such an identifier would allow data utilization businesses to associate user data obtained through multiple data provision applications. This could result in the leakage of user privacy.

Furthermore, when an identifier known to an individual is used, the risk of privacy leaks increases if the individual does not adequately manage their IDs. In other words, even if the ID management of the data source and data recipient is adequate, the risk of privacy leaks increases if the individual does not adequately manage their IDs.

The primary objective of the present invention is to provide a system and method that contributes to protecting the privacy of users participating in an information distribution system.

According to a first aspect of the present invention, there is provided a system including a trading server, a service server operated by a service provider and storing at least one or more user data items generated by providing a service to users, a data utilization server operated by a data utilization provider and transmitting a data provision application to the trading server, the data provision application including the specified requirements, to obtain data from the at least one or more user data items that meets specified requirements through data provision, and a distribution control server that controls the data provision, wherein the trading server transmits the data provision application to the distribution control server, and the distribution control server transmits a provision instruction to the service server including information specifying data that meets the specified requirements and a target ID that is the user's ID and is generated in response to the data provision application, and the service server transmits the specified data and the target ID to the data utilization server.

According to a second aspect of the present invention, in a system including a trading server, a service server operated by a service provider and storing at least one or more user data items generated by providing a service to users, a data utilization server operated by a data utilization provider and transmitting a data provision application to the trading server, the data provision application including the specified requirements, to obtain data from the at least one or more user data items that meets specified requirements through data provision, and a distribution control server that controls the data provision, the trading server transmits the data provision application to the distribution control server, and the distribution control server transmits a provision instruction to the service server including information specifying data that meets the specified requirements and a target ID that is the user's ID and is generated in response to the data provision application, and the service server transmits the specified data and the target ID to the data utilization server.

According to each aspect of the present invention, a system and method are provided that contribute to protecting the privacy of users participating in an information distribution system. Note that the effects of the present invention are not limited to those described above. The present invention may achieve other effects instead of or in addition to the above effects.

FIG. 1 is a diagram for explaining an overview of an embodiment. FIG. 2 is a flowchart illustrating an example of the operation of one embodiment. FIG. 3 is a diagram illustrating an example of a schematic configuration of an information distribution system according to the first embodiment. FIG. 4 is a diagram for explaining the operation of the information distribution system according to the first embodiment. FIG. 5 is a diagram for explaining the operation of the information distribution system according to the first embodiment. FIG. 6 is a diagram for explaining the operation of the information distribution system according to the first embodiment. FIG. 7 is a diagram for explaining the operation of the information distribution system according to the first embodiment. FIG. 8 is a diagram for explaining the operation of the information distribution system according to the first embodiment. FIG. 9 is a diagram illustrating an example of catalog information according to the first embodiment. FIG. 10 is a diagram illustrating an example of a data provision application according to the first embodiment. FIG. 11 is a diagram for explaining the operation of the information distribution system according to the first embodiment. 12A, 12B, and 12C are diagrams showing examples of a data provision contract according to the first embodiment. FIG. 13 is a diagram for explaining the operation of the information distribution system according to the first embodiment. FIG. 14 is a diagram illustrating an example of data provision status information according to the first embodiment. FIG. 15 is a diagram for explaining the operation of the information distribution system according to the first embodiment. FIG. 16 is a diagram illustrating an example of a processing configuration of the distribution control server according to the first embodiment. FIG. 17 is a diagram illustrating an example of a part of the user information database according to the first embodiment. FIG. 18 is a diagram illustrating an example of a location information database according to the first embodiment. FIG. 19 is a diagram illustrating an example of the consent management database according to the first embodiment. FIG. 20 is a diagram illustrating an example of a processing configuration of the service server according to the first embodiment. FIG. 21 is a diagram illustrating an example of a customer information database according to the first embodiment. FIG. 22 is a diagram illustrating an example of a processing configuration of the trading server according to the first embodiment. FIG. 23 is a diagram illustrating an example of an account holder list according to the first embodiment. FIG. 24 is a diagram illustrating an example of a processing configuration of a terminal according to the first embodiment. FIG. 25 is a sequence diagram illustrating an example of the operation of the information distribution system according to the first embodiment. FIG. 26 is a diagram illustrating an example of the hardware configuration of a transaction server according to the present disclosure.

First, an overview of one embodiment will be described. Note that the reference numerals in this overview are added to each element for convenience as an example to aid understanding, and the description of this overview is not intended to be limiting in any way. Furthermore, unless otherwise specified, the blocks shown in each drawing represent functional units, not hardware units. Connection lines between blocks in each drawing include both bidirectional and unidirectional lines. Unidirectional arrows are used to schematically indicate the flow of the main signal (data) and do not exclude bidirectionality. Note that in this specification and drawings, elements that can be similarly described may be assigned the same reference numerals to avoid redundant explanation.

A system according to one embodiment includes a transaction server 101, a service server 102, a data utilization server 103, and a distribution control server 104 (see FIG. 1). The service server 102 is operated by a service provider and stores at least one or more user data items generated by providing services to users. The data utilization server 103 is operated by a data utilization provider and transmits a data provision request, including the specified requirements, to the transaction server, for obtaining at least one or more pieces of user data that meet certain requirements through data provision. The distribution control server 104 controls data provision. The transaction server 101 transmits the data provision request to the distribution control server 104 (step S1 in FIG. 2). The distribution control server 104 transmits a provision instruction to the service server 102, including information specifying the data that meets the specified requirements and a target ID, which is the user's ID and is generated in response to the data provision request (step S2). The service server 102 transmits the specified data and the target ID to the data utilization server 103 (step S3).

In the above system, the distribution control server 104 instructs the service server 102, which is the data provider, to send the target data for data provision (data that meets the specified requirements of the data recipient) along with the target ID corresponding to the data provision application. In other words, the distribution control server 104 generates a different target ID for each data provision application and instructs the service server 102 to send that target ID as the user's ID. This configuration prevents data utilization businesses from inappropriately associating user data obtained from multiple data provision applications. Furthermore, the provided user data is managed by a target ID that cannot be known by individuals. The target ID will not be leaked by the user himself, so the user's privacy is protected.

Specific embodiments are described in further detail below with reference to the drawings.

[First embodiment]
The first embodiment will be described in more detail with reference to the drawings.

[System configuration]
Fig. 3 is a diagram showing an example of a schematic configuration of an information distribution system according to the first embodiment. As shown in Fig. 3, participating members (actors) of the information distribution system include information distribution businesses, service businesses, data utilization businesses, and trading businesses.

An information distribution operator is an operator that provides a platform for data distribution services (information distribution services) for personal data stored by service operators. The information distribution operator controls the distribution of data between operators (service operators, data utilization operators). The information distribution operator is equipped with a distribution control server 10.

The distribution control server 10 is operated by an information distribution business operator. The distribution control server 10 is a server device that controls (realizes) data distribution between service providers and controls data distribution between service providers and data utilization businesses. The distribution control server 10 realizes information distribution services for data held by service providers.

A service provider is an entity that provides services to individuals. A service provider may be a private business or a public institution. Examples of service providers include medical institutions (hospitals, pharmacies, etc.) that provide medical services to users, retailers, and educational providers that teach languages, sports, arts, etc. to customers.

Each service provider is equipped with a service server 20 for providing services to customers. The service server 20 is managed and operated by the service provider. The service server 20 holds (stores) data generated by the service provider in providing services to users, data necessary to provide services to users, etc. The service provider holds user data related to the services it provides to users.

Data utilization businesses are entities that do not provide services directly to individuals. Examples of data utilization businesses include pharmaceutical companies. For example, pharmaceutical companies use data obtained from service providers to develop new drugs.

In this disclosure, entities that do not provide services to individuals will be referred to as "data utilization businesses" in the explanation, but it goes without saying that data utilization businesses will act as "service businesses" when providing services to users. In other words, depending on the business model of the data utilization business, the data utilization business may also be a service business.

The data utilization business operator is equipped with a data utilization server 30 for acquiring and utilizing data from the service business operator. The data utilization server 30 is operated by the data utilization business operator. The data utilization server 30 acquires at least one piece of user data from the service server 20 by providing data.

A trading business is an entity that realizes transactions between service providers and data utilization businesses. A trading business realizes data distribution between data generators (service providers) and data consumers (data utilization businesses). A trading business is an entity that acts as an intermediary in data distribution transactions between service providers and data utilization businesses.

The trading business operator is provided with a trading server 40 to realize the data distribution. The trading server 40 is operated by the trading business operator. The trading server 40 controls the data provision contract between the service operator and the data utilization business operator.

Users who use the information distribution system use terminal 50.

The devices shown in Figure 3 are connected to each other via a network. For example, the distribution control server 10 and the service server 20 are connected by wired or wireless communication means and are configured to be able to communicate with each other.

The configuration shown in Figure 3 is an example and is not intended to limit the configuration of the information distribution system disclosed in the present application. For example, an information distribution business may include two or more distribution control servers 10. Furthermore, with regard to trading businesses and data utilization businesses, the information distribution system includes data utilization servers 30 and trading servers 40 according to the number of businesses participating in the system.

[System Overview]
Next, the general operation of the information distribution system according to the first embodiment will be described.

Users enter into individual contracts with service providers from which they wish to receive services. For example, users may provide their name and other information to the service provider and request a new contract (a contract to receive the service) with that service provider.

For example, a user who wishes to visit a hospital would submit a health insurance card or other document with their name and other information to the hospital. Alternatively, in the case of an EC (Electronic Commerce) business that provides online shopping services, the user would access a service server 20 operated by the EC business and create an account.

The service provider generates a "personal identification ID" to identify new customers (users). For example, a hospital assigns a patient card number to manage users (patients) and generates the patient card number as the personal identification ID. An EC provider generates a membership number or the like to manage customers as the personal identification ID. The service server 20 stores the generated personal identification ID (for example, a patient card number or membership number) in a database or the like.

Once the personal identification ID is generated, the user can receive services from a service provider. For example, the user may receive medical services (health checkups, examinations, etc.) from a hospital. Or, the user may use an e-commerce provider to shop online.

In order for user data generated by a service provider when providing services to users to be subject to data distribution, the data must be "stored." Data storage occurs when a service provider (the provider of user data) registers user data in an information distribution system as data that can be provided to third parties.

The distribution control server 10 controls data accumulation so that data related to services provided to users by data accumulators (service providers) can be subject to data distribution. In other words, the distribution control server 10 controls data accumulation so that user data can be registered in the information distribution system as data that can be provided to third parties. The accumulated data becomes subject to data distribution.

In an information distribution system, there are two means of data distribution: "sharing" and "provision." The distribution control server 10 controls data sharing, which allows user data registered through data accumulation to be shared from one service server 20 to another service server 20. The distribution control server 10 controls data provision, which allows user data registered through data accumulation to be provided from the service server 20 to the data utilization server 30.

"Sharing" is a means by which service providers obtain data accumulated by other service providers. For example, data distribution through "sharing" is used when an e-commerce operator obtains data generated by a hospital in the course of providing services to users. The e-commerce operator uses the data obtained from the hospital through data sharing to provide better services to users.

"Sharing" is used to improve the convenience of service users themselves, so users are not paid compensation for data distribution (compensation for users). "Sharing" is used to utilize data accumulated by other service providers so that users can receive better services from the service providers.

"Provision" is a means by which data utilization businesses obtain data accumulated by other service providers. For example, data distribution by "provision" is used when a pharmaceutical company obtains the results of health checkups and examinations from a hospital. The pharmaceutical company uses the data obtained from hospitals through data provision to help develop new drugs.

Since "provision" is a method used by data utilization businesses that do not provide services directly to users, compensation is incurred for data distribution (compensation to users). In other words, when "provision" is made, compensation is paid to the user. Also, when "provision" is made, compensation is paid from the data acquirer (data recipient) to the data provider (data accumulator) and the information distribution system (information distribution business).

For the sake of convenience, this disclosure will be described assuming that no compensation (fees) are paid to trading businesses. In reality, a portion of the compensation paid by the data recipient to the data provider, etc. may be paid to the trading business as a "fee."

The distribution control server 10 controls data sharing so that data sharing destinations (service providers receiving data) can acquire the accumulated data. The distribution control server 10 controls data provision so that data providing destinations (data utilization businesses receiving data) can acquire the accumulated data.

<Creating a system account>
Users of the information distribution system must register in advance (user registration, system registration). More specifically, the user accesses the distribution control server 10 and performs procedures for creating an account. In the following explanation, an account created in the information distribution system will be referred to as a "system account."

To create a system account, the user operates the terminal 50 they own to access the distribution control server 10. In response to access from the terminal 50, the distribution control server 10 displays a WEB page for creating a system account.

The user performs an operation to generate a system account (for example, by pressing a specific button) and generates a system account. At that time, the distribution control server 10 acquires the information necessary to generate the user's system account. Specifically, the distribution control server 10 acquires the user's login information (login ID, password) and personal information (name, date of birth, contact information, account information, etc.).

Once login information, personal information, etc. are obtained, the distribution control server 10 generates a user ID (identifier) to uniquely identify the user in the information distribution system.

The distribution control server 10 stores the generated user's user ID, login information, and personal information (e.g., name, date of birth, contact information), etc., in association with each other. The distribution control server 10 stores this information in a "user information database." Details of the user information database will be provided later.

The distribution control server 10 issues the generated user ID to the user (terminal 50). The terminal 50 stores the issued user ID.

<ID linking>
As mentioned above, in order for the service provider to distribute user data held by the service provider, "data accumulation" is required. To achieve data accumulation, the system account ID (user ID) needs to be linked with the ID (personal identification ID) generated by the service provider.

For example, as shown in Figure 4, a user goes to a hospital counter and tells hospital staff that they wish to use the user data held by the hospital (applies for data use). The hospital staff then enters the user's personal identification information, the user's personal identification ID (e.g., patient card number), and the business code into the hospital terminal 60.

Personally identifiable information is information used to identify a user. Examples of personally identifiable information include the user's name, or a combination of the user's name and date of birth.

The business code is identification information (ID) used to identify service businesses participating in the information distribution system. For example, different codes are assigned to hospitals and e-commerce businesses. The business code is shared among system participants (information distribution businesses, service businesses, and data utilization businesses) by any means. For example, when a service business participates in the information distribution system, the information distribution business generates a business code to be assigned to the service business. The information distribution business notifies the service business, etc. of the generated business code.

The hospital terminal 60 sends an "ID linking request" including the acquired personal identification information, personal identification ID, and business code to the distribution control server 10.

Alternatively, a user who wishes to utilize an EC business's user data operates a terminal 50 to access the EC business's service server 20 (see Figure 5). The user logs in to an account with the EC business and submits an application for data utilization through that account. In response to the application, the service server 20 sends an "ID linking request" to the distribution control server 10, which includes the user's personal identification information, personal identification ID, and business code.

The distribution control server 10 obtains the personal identification information, personal identification ID, and business code of the service provider (e.g., hospital, e-commerce business) that is the target of ID federation from the hospital terminal 60 and the service server 20.

The distribution control server 10 identifies the service provider that is the target of ID federation from the business code. The distribution control server 10 also identifies the user registered in the system account from the personal identification information. The distribution control server 10 associates the service provider with the personal identification ID in the account of the identified user.

Once a personal identification ID is registered in a system account (ID linking is completed), the service provider that is the subject of ID linking will be able to "store" the user data of users who wish to utilize the data.

<Data accumulation>

When a service provider provides a service to a user, the service provider associates and stores the user's personal identification ID with the user's user data (personal data). For example, when a hospital examines a user and obtains a diagnosis, the hospital associates and stores the user's personal identification ID (such as a patient card number) with the diagnosis (for example, a specific diagnosis such as stomach cancer). For example, the service server 20 uses a "customer information database" to associate and store the user's personal identification ID with the user data. Details of the customer information database will be described later.

The service provider's service server 20 controls data accumulation each time it stores user data (data resulting from the provision of the service, data necessary for the provision of the service) for users who have completed ID linking (users who have applied for data utilization).

Specifically, the service server 20 registers the user's user data as accumulated data (user data subject to data distribution) in the information distribution system. Specifically, the service server 20 transmits "location information" regarding the user for whom ID federation has been completed to the distribution control server 10 (see Figure 6).

Location information is information about the storage location of user data (data storage entity; service provider), etc. Location information includes a data ID for identifying user data (stored data), a personal identification ID, a business code, the type of data held, etc.

The distribution control server 10 stores the acquired location information in a "location information database." Details of the location information database will be described later. The location information database stores data IDs, personal identification IDs, business codes, data types, etc. in association with each other.

<Data sharing>
A service provider that wishes to acquire data accumulated by another service provider (user data resulting from the provision of services to users by another service provider) acquires the data through "sharing."

Here, with reference to Figure 7, we will explain the case where EC operator B acquires user data (examination results; disease name) stored in Hospital A through "sharing." The hospital is equipped with service server 20-1, and the EC operator is equipped with service server 20-2.

EC operator B (service server 20-2) sends a "sharing request" to the distribution control server 10 (step S11).

Based on the sharing request, the distribution control server 10 identifies the user who is the target of data distribution and the data accumulator (Hospital A) of the data to be distributed. The distribution control server 10 sends an inquiry regarding data sharing to the terminal 50 held by the identified target user (step S12).

When the terminal 50 receives a data sharing inquiry, it acquires the user's intention regarding data sharing. For example, the terminal 50 acquires the user's intention using a GUI (Graphical User Interface). In the above example, the terminal 50 displays a GUI with the content, such as, "By sharing your hospital examination results with the EC operator, you will receive better service. Do you want to share?" and acquires the user's intention (agreement or disagreement to data sharing).

The terminal 50 sends a response to the data sharing inquiry (agreeing to data sharing or refusing data sharing) to the distribution control server 10 (step S13).

If the user's consent is obtained, the distribution control server 10 sends a sharing instruction to the data sharing source (Hospital A) (step S14).

Upon receiving the sharing instruction, Hospital A (service server 20-1) refers to the customer information database and sends the examination results (disease name) of the target user, etc. to the designated data sharing destination, service server 20-2 (step S15).

Next, we will explain data distribution through "provision."

<Opening an account>
A user who wishes to receive compensation for providing data must open an account with a trading company. The process of opening an account for providing data will be described with reference to FIG. 8.

A trading business partner will partner with at least one of the multiple service businesses participating in the information distribution system. For example, a trading business that handles medical data will partner with medical institutions (hospitals, pharmacies, etc.). Or, a trading business that handles educational data will partner with education providers. The trading business will store the business code for the service business with which it partners.

In addition, trading businesses store the business code of data-utilizing businesses. For example, trading businesses generate the business code of a data-utilizing business when starting a transaction with that data-utilizing business. The business code of a data-utilizing business is shared among information distribution businesses, trading businesses, and data-utilizing businesses by any method.

The trading business sells (intermediates sales of) data held by the partner service provider (accumulated data) to the data utilization business. For example, if the partner service provider shown in Figure 8 is a medical institution, the trading business sells the data held by the partner medical institution to pharmaceutical companies, etc.

As mentioned above, users who wish to receive compensation for providing data via a trading company must open an account with the trading company (trading server 40). Users participating in the information distribution system who wish to earn revenue by providing data open an "information account" with the trading server 40.

The user presents the user ID issued by the distribution control server 10 to the trading server 40 and opens an information account. The trading server 40 stores the acquired user ID. The trading server 40 manages the user IDs of users who have opened accounts in an account holder list.

<Catalogue information>
To realize data distribution through "provision," information distribution businesses prepare catalog information. The person in charge (system administrator) at the information distribution business defines the catalog information that lists the data available for sale (see Figure 9). The catalog information is information that shows details of the data that the information distribution system can sell to data utilization businesses.

The dataset name included in the catalog information shown in Figure 9 is information for identifying the catalog information. For example, a dataset related to a health checkup would be given the dataset name "Checkup Results 1," and a dataset related to examination results would be given the dataset name "Examination Results 1."

The data type included in the catalog information indicates the type of data held by the service provider (accumulated data that can be provided to third parties). For example, information such as "height," "weight," and "blood pressure" in medical examination results, and "disease name," "medication," and "test results" in examination results correspond to data types. The data format specifies the format in which the data will be provided.

The data utilization business obtains the catalog information via the trading business. More specifically, the data utilization server 30 sends a "catalog information presentation request" to the trading server 40.

Upon receiving a request to present catalog information, the transaction server 40 sends a "catalog information transmission request" to the distribution control server 10.

In response to receiving a request to send catalog information, the distribution control server 10 sends the catalog information defined by the information distribution business operator to the transaction server 40.

The transaction server 40 selects catalog information related to the partner service provider and sends it to the data utilization server 30. For example, in the above example, the transaction server 40 selects catalog information related to the pharmaceutical company's business and sends it to the data utilization business. The data utilization business views the received catalog information and identifies the catalog information necessary for its own business.

<Data distribution through provision>
Data utilization businesses that wish to obtain data accumulated by service providers can obtain that data by "provision."

Here, we will explain the case where pharmaceutical company D obtains a user's disease name, test results, and activity level through "provision." Hospital A and Hospital B hold user data regarding the user's disease name and test results, and fitness club C holds user data regarding activity level.

Employees of the data recipient (pharmaceutical company D) refer to the publicly available catalog information and create a data provision request. A data provision request is an application to obtain at least one or more pieces of user data that meet certain requirements.

For example, an employee or other person inputs a data provision application as shown in Figure 10 into the data utilization server 30. The input date of the data provision application is January 1, 2021.

The data provision application includes general information about the data provision, requirements for the data to be provided, and a proposal for compensation for the data.

The data provision summary information is information regarding the outline of the data provision applied for by the data recipient (pharmaceutical company D). The data provision summary information includes information about the business requesting the data provision, the purpose of the data provision application, the target period (the period during which the data was accumulated), the budget, the deadline, etc.

Information about the business entity requesting the provision of data (data utilization business entity, for example, Pharmaceutical Company D) includes the name of the business entity, business code, data recipient (address to which the data will be sent), etc.

The requirements for provided data are those related to the data provided to data utilization businesses through data provision. The requirements for provided data include information on the target individuals, the number of target individuals required, and information on the required data (type of data, minimum and maximum limits indicating the amount of data required), etc.

The provision consideration proposal is detailed information regarding the consideration to be paid by the data utilization business operator for data provision. The provision consideration proposal includes the consideration to be paid by the data recipient for each data type.

With reference to Figure 11 etc., the operation of the information distribution system when providing data will be explained.

First, the data utilization server 30 sends a data provision application to the trading server 40 (step S21).

Upon receiving the data provision application, the trading server 40 assigns a provision application ID to the data provision application and stores the received data provision application. The trading server 40 then transmits a "provision request" including the provision application ID, the data provision application, and the account holder list to the distribution control server 10 (step S22).

The transaction server 40 notifies the data utilization server 30 of the data provision application ID assigned to the data provision application. The data utilization server 30 associates the notified data provision application ID with the data provision application sent to the transaction server 40 and stores them.

In response to receiving a request for provision, the distribution control server 10 notifies the user of potential data providers (data accumulators) and obtains the user's consent regarding data provision.

<Identification of data providers and subjects>
The distribution control server 10 identifies a data provider (service provider) that holds user data that meets the requirements for the data to be provided described in the data provision application. Specifically, the distribution control server 10 refers to the user information database and the location information database to identify a data provider that holds data of a user (target person) that meets the requirements described in the data provision application.

In the example of Figure 10, the distribution control server 10 refers to the user information database and identifies users aged 20 to 65 who are listed on the account holder list.

The distribution control server 10 references the location information database and identifies, from among the identified users, subjects who further meet the requirements of the provided data. In the example of Figure 10, the distribution control server 10 identifies users who have registered a disease name, test results from tests performed at least once a year, and activity levels at least three times a month during the target period (January 1, 2019 to December 31, 2020).

The distribution control server 10 refers to the location information database and identifies the service provider that holds the target data (provided data) for the identified user. In the above example, Hospital A and Hospital B, which hold the disease name and test results, and Fitness Club C, which holds the activity level, are identified.

The distribution control server 10 stores the identified user, the data ID of the data to be provided, the identified service provider, and the provision application ID in association with each other.

The distribution control server 10 notifies the trading server 40 of information regarding the identified data provider. Specifically, the distribution control server 10 sends a "provider notification" to the trading server 40, which includes the application ID, the name of the identified data provider, contact information (the address of the service server 20), the type of data stored by the data provider, etc. (Step S23). In the above example, the trading server 40 is notified that Hospital A and Hospital B are storing disease names and test results, and that Fitness Club C is storing activity levels.

<Negotiations regarding data provision agreements>
When the transaction server 40 receives the provider notification, it requests the service provider identified by the distribution control server 10 to conclude a contract for a data provision application with the data utilizing business.

First, the trading server 40 separates the data provision application for each data provider notified by the provider notification. Specifically, the trading server 40 generates individual data provision contracts (draft data provision contracts) between the data recipient and each data provider.

In the above example, the trading server 40 generates the data provision contract shown in Figure 12A as a data provision contract for Hospital A, which stores user data related to disease names and test results. Similarly, the trading server 40 generates the data provision contract shown in Figure 12B as a data provision contract for Hospital B, which stores user data related to disease names and test results. The trading server 40 generates the data provision contract shown in Figure 12C as a data provision contract for Fitness Club C, which stores user data related to activity levels.

As shown in Figures 12A to 12C, the data provision contract includes information on the data recipient, information on the data provider, the type of data to be provided, and the price for the data. Note that the data provision contract shown in Figures 12A to 12C may be created by the trading server 40 or by an employee of the trading business.

The trading server 40 assigns a provision contract ID to each data provision contract. The trading server 40 stores the data provision contract and the provision contract ID in association with each other. The trading server 40 stores the provision application ID of the data provision application in association with the provision contract ID of the data provision contract.

The transaction server 40 sends a "provision contract conclusion request" including the provision application ID, individual provision contract ID, and data provision contract to each contact notified by the distribution control server 10 (e.g., the service servers 20 of Hospital A, Hospital B, and Fitness Club C) (step S24).

In response to receiving the request to conclude a data provision contract, the data provider negotiates with the data recipient (data utilization business) regarding the provision of data. An employee of the data provider inputs the results of their review of the data provision contract into the service server 20. The service server 20 transmits a response to the request to conclude a data provision contract to the transaction server 40 in accordance with the obtained review results (step S25).

Specifically, if the employee of the data provider agrees to the conditions set out in the data provision contract (mainly the proposed compensation for data provision), he/she enters this into the service server 20. The service server 20 then sends an affirmative response to the transaction server 40 indicating that the employee agrees to the data provision contract (concludes the data provision contract).

If the data provider's staff member does not agree to the conditions set forth in the data provision contract, he/she will input this fact into the service server 20. The service server 20 will then send a negative response to the transaction server 40 indicating that the data provision application will not be accepted (that the data provision contract will not be concluded).

If a positive response is received (if the data provision contract has been concluded), the trading server 40 stores the fact that the data provision contract has been concluded. The trading server 40 notifies the distribution control server 10 and the data utilization server 30 that the data provision contract has been concluded. Specifically, the trading server 40 sends an "individual contract conclusion notification" including the provision application ID, the individual provision contract ID, and the data provision contract to the distribution control server 10 and the data utilization server 30 (step S26).

If a negative response is received (if the data provision contract is not concluded), the transaction server 40 notifies the data utilization server 30 that the data provision contract has not been concluded. The transaction server 40 sends a "Notice of Individual Contract Not Established" to the data utilization server 30, which includes the provision application ID, the individual provision contract ID, and the data provision contract (not shown in Figure 11).

If the data provision contract is not concluded, the data utilization business operator's staff will consider whether to withdraw the data provision contract or raise the conditions and apply for the data provision contract again.

When withdrawing a data provision contract, an employee of the data utilization business operator inputs this information into the data utilization server 30. The data utilization server 30 sends an "individual contract withdrawal notice" including the data provision application ID and the individual data provision contract ID to the trading server 40 (not shown in Figure 11). The trading server 40 forwards the received individual contract withdrawal notice to the distribution control server 10.

When renegotiating the data provision contract, an employee of the data utilization business operator inputs a data provision contract with new conditions into the data utilization server 30. The data utilization server 30 transmits the new data provision contract to the transaction server 40.

The transaction server 40 sends a request to conclude a data provision contract, including a new data provision contract, to the service server 20. The data provider reviews the presented new conditions and notifies the data recipient of the review results via the transaction server 40. The data provider and data recipient repeat the price negotiations described above.

The following explanation will cover the case where a data provision contract is concluded between Hospital A and the data provider (pharmaceutical company D), no contract is concluded between Hospital B and the data provider, and a contract is concluded between Fitness Club C and the data provider.

The distribution control server 10, data utilization server 30, and transaction server 40 manage data provision contracts that have been concluded and data provision contracts that have not been concluded using the provision contract ID and provision application ID.

<Acquisition of user consent>
When the distribution control server 10 identifies the data distribution target person, it obtains the target person's consent to the data distribution.

The distribution control server 10 sends an inquiry regarding data provision to the user's contact information (an email address that can be received by the terminal 50) identified using a user information database, location information database, etc. (step S27 of Figure 11).

The distribution control server 10 is a data provider that holds user data and has concluded a data provision contract with the data recipient, and makes an inquiry about data provision to the identified user. In the above example, a data provision inquiry is sent regarding the user data stored at Hospital A and Fitness Club C.

A data request includes information about the source of the data request (pharmaceutical company D in the above example), the source of the data (hospital A, fitness club C), and the type of data requested (e.g., disease name, test results, activity level).

When the terminal 50 receives an inquiry about data provision, it displays a GUI to obtain the user's intention regarding data provision. The terminal 50 uses the GUI to obtain the user's intention (agreement or disagreement to data provision).

The terminal 50 sends a response to the data provision inquiry (agreement to data provision or refusal to provide data) to the distribution control server 10 (step S28).

When a user agrees to the data provision, the distribution control server 10 stores this fact. At that time, the distribution control server 10 generates identification information to identify the user who agreed to the data provision. More specifically, the distribution control server 10 generates a different target ID (an ID that identifies the individual who agreed to the data provision) for each data provision application. The distribution control server 10 associates the provision application ID, target ID, and user ID and stores them in the consent management database. Details of the consent management database will be described later.

The distribution control server 10 will periodically or at predetermined times send the data provision inquiry to the target user's terminal 50 until consent is obtained from at least the required number of people specified in the data provision application. For example, the distribution control server 10 will make a data provision inquiry to users who have refused data provision after a predetermined number of days have passed.

In this way, the trading server 40 sends a request for data provision, including an application for data provision, to the distribution control server 10. The distribution control server 10 sends a data provision inquiry to the terminal 50 held by the user corresponding to the data that meets the specified requirements. By sending the data provision inquiry to the terminal 50, the distribution control server 10 obtains consent (consent to data provision) from the user who contributed to the generation of the user data that the data utilization business operator wishes to provide.

When a user agrees to the provision of data, the distribution control server 10 calculates the amount of data to be provided with the user's consent. The distribution control server 10 refers to the location information database to determine the amount of data to be provided with the user's consent.

For example, when one user agrees to provide data, data will be provided for each data type, such as one disease name, 10 test results, and 100 activity levels.

Each time the user's consent is obtained, the distribution control server 10 notifies the trading server 40 of the calculated data volume. The distribution control server 10 sends a "Provided Data Volume Notification" including the provision application ID and the calculated data volume to the trading server 40 (step S31 in Figure 13).

The trading server 40 generates "data provision status information" that indicates the status of data provision. The trading server 40 generates data provision status information for each data provision application. Using the data provision status information, the trading server 40 manages the amount of data for each data type provided to the data recipient, and the consideration (total consideration) that the data recipient will pay if data provision is successful.

For example, upon receiving a notification of the amount of data provided, the trading server 40 calculates and graphs the amount of data (accumulation amount) for each data type. Similarly, the trading server 40 graphs the fee paid by the data recipient. For example, the trading server 40 creates a time series graph such as that shown in Figure 14 as data provision status information.

The trading server 40 transmits the generated data provision status information (for example, a graph such as that shown in Figure 14) to the data utilization server 30 periodically or at a specified timing (not shown in Figure 13).

In this way, when the user agrees to the data provision, the distribution control server 10 notifies the trading server 40 of the amount of data that can be provided from the service server 20 to the data utilization server 30, resulting from the user's consent. The trading server 40 generates data provision status information indicating the status of the data provision application based on the amount of data that can be provided from the service server 20 to the data utilization server 30, received from the distribution control server 10. The trading server 40 transmits the generated data provision status information to the data utilization server 30.

<Cancellation of data provision application>
The data utilizing business can cancel the data provision application (all data provision contracts derived from the data provision application). The staff of the data utilizing business can decide whether to cancel or continue the data provision application while checking the data provision status information obtained from the transaction server 40. That is, the data utilizing business can refer to the time series graph (data provision status information) as shown in Figure 14 and decide whether to continue or cancel the data provision contract.

However, data utilization businesses cannot cancel data provision applications unconditionally. Data utilization businesses cannot cancel data provision applications if the requirements for the data provided in the data provision application to be canceled are met.

Specifically, if some of the target data does not meet the minimum required data volume, the data recipient can cancel the data provision application regardless of the deadline for the data provision contract. In other words, the data utilization business (data recipient) can cancel the data provision application at any time, regardless of the deadline for data provision, as long as at least one of the data specified in the requirements for the provided data is not present.

On the other hand, if all of the target data meets the minimum required data volume, the data recipient cannot cancel the data provision application regardless of the application deadline. In other words, if the requirements for the data provided that the data utilization business applied for are met, the data utilization business cannot cancel the data provision application regardless of the application deadline.

As a result of this approach, data recipients will no longer be required to pay compensation even if they are unable to obtain the necessary data. As a result, data recipients will be protected. Furthermore, data recipients will not have their data provision contracts canceled once they have secured the necessary data. As a result, data recipients will be protected.

A data utilization business operator wishing to cancel a data provision application inputs this into the data utilization server 30. When the data utilization server 30 receives the request to cancel the data provision application, it notifies the trading server 40 of this. The data utilization server 30 sends a "provision application cancellation request" including the data provision application ID to the trading server 40 (step S32 in Figure 13).

Upon receiving the request to cancel the data provision application, the trading server 40 checks the status of the data provision application and determines whether the data provision application can be canceled. The trading server 40 sends a response to the data utilization server 30 according to the determination result (step S33).

If the status of the data provision application is such that cancellation is permitted, the trading server 40 sends a positive response to the data utilization server 30 indicating that the cancellation of the data provision application is accepted.If the status of the data provision application is such that cancellation is not permitted, the trading server 40 sends a negative response to the data utilization server 30 indicating that the cancellation of the data provision application is not accepted.

When a cancellation of a data provision application is accepted, the trading server 40 notifies the distribution control server 10 of this (not shown in Figure 13). The distribution control server 10 discards information related to the data provision application for which the cancellation has been notified.

In this way, the transaction server 40 rejects a request to cancel a data provision application when data that meets predetermined requirements (requirements for provided data) becomes available to be provided from the service server 20 to the data utilization server 30. The predetermined requirements include the data type and lower limit of the required data volume for each type of provided data provided from the service server 20 to the data utilization server 30. The transaction server 40 rejects a request to cancel a data provision application when the volume of data that can be provided from the service server 20 to the data utilization server 30 for each data type of provided data exceeds the lower limit of the required data volume.

<Data provision>
The trading server 40 executes the data provision when predetermined conditions are met. When predetermined conditions are met, the trading server 40 instructs the distribution control server 10 to execute the data provision. When predetermined conditions are not met, the trading server 40 may discard the data provision application.

For example, the trading server 40 will provide the data if the deadline stated in the data provision application has arrived and the requirements for the data to be provided stated in the data provision application have been met.

When the deadline for data provision applications arrives and the amount of data that can be provided from the service server 20 to the data utilization server 30 for each data type of provided data exceeds the lower limit of the required data amount, the transaction server 40 instructs the execution of data provision.

In other words, the data provision requirements are determined to be met when data equal to or greater than the minimum required data volume can be provided for all of the target data described in the data provision application. In the example of Figure 10, the data provision requirements are determined to be met when data on five or more disease names, 20 or more test results, and 1,000 or more activity levels can be provided.

In this case, the trading server 40 sends a "data provision execution instruction" including the provision application ID to the distribution control server 10 (see Figure 15).

Upon receiving the data provision execution instruction, the distribution control server 10 sends a provision instruction to the data provider for users who have consented to the data provision (step S29 of Figure 11).

At that time, the distribution control server 10 sends a provision instruction including the subject ID stored in the consent management database to the data provider. The distribution control server 10 instructs the service server 20 to replace the personal identification ID managed independently by each data provider with the subject ID and provide the data.

For example, if consent has been obtained from 10 users, the distribution control server 10 sends a provision instruction to the service server 20 regarding the data for those 10 people. For example, the distribution control server 10 sends a provision instruction to the service server 20 of Hospital A for the disease names and test results for 10 people. Similarly, the distribution control server 10 sends a provision instruction to the service server 20 of Fitness Club C for the activity levels for 10 people.

In this way, when data that meets specified requirements (data to be provided) is stored in multiple service servers 20, the distribution control server 10 sends a provision instruction including the same target ID to each of the multiple service servers 20.

Upon receiving the provision instruction, the service server 20 refers to the customer information database and sends the user data of the consenting user to the specified data destination (step S30).

At that time, the service server 20, which is the data provider, transmits the target ID notified by the distribution control server 10 along with the user data to the data recipient. The service server 20 replaces the personal identification ID of the data distribution target with the target ID specified by the distribution control server 10 and provides the data.

The data utilization server 30 of the data provider (data utilization business operator) matches the user data received from each service server 20 based on the target person ID received from that service server 20. The data utilization server 30 matches the user data using the target person ID.

In this way, the transaction server 40 transmits a data provision application to the distribution control server 10. The distribution control server 10 transmits a provision instruction to the service server 20, which includes information specifying data that meets specified requirements (e.g., a data ID) and a target ID, which is the user's ID and was generated in response to the data provision application. The service server 20 transmits the specified data and target ID to the data utilization server 30.

If the deadline stated in the data provision application arrives but the requirements for the data to be provided as stated in the data provision application are not met, the transaction server 40 will cancel the data provision contract. In this case, the transaction server 40 will notify the distribution control server 10 and the data utilization server 30 of this fact.

Alternatively, the trading server 40 may provide data based on the budget of the data provision request.

The transaction server 40 will provide the data if the total amount of consideration paid by the data utilization business to the service business exceeds the budget and the requirements for the data to be provided as stated in the data provision application are met.

Specifically, the trading server 40 will instruct the data provider to provide the data if the user's consent to the data provision results in the price to be paid by the data provider exceeding the budget set forth in the data provision application, and if the requirements for the data to be provided set forth in the data provision application are met.

In contrast, the trading server 40 will discard the data provision application if the price paid by the data recipient exceeds the budget stated in the data provision application but the requirements for the data to be provided stated in the data provision application are not met.

Alternatively, the trading server 40 may provide data if at least one of the target data exceeds the upper limit of the required data volume and the requirements for the provided data set forth in the data provision application are met. In other words, the trading server 40 provides data if, for at least one data type of provided data, the amount of data that can be provided from the service server 20 to the data utilization server 30 exceeds the upper limit of the required data volume and the requirements for the provided data are met.

In contrast, the trading server 40 may discard the data provision request if at least one of the target data exceeds the upper limit of the required data volume but the requirements for the data to be provided as set forth in the data provision request are not met.

In this way, the transaction server 40 decides whether to provide or discard the data when the deadline arrives, when the fee paid by the data recipient exceeds the budget, or when at least one of the target data exceeds the upper limit of the number of required data items.

Next, we will explain in detail each device included in the information distribution system related to the first embodiment.

[Distribution control server]
16 is a diagram showing an example of the processing configuration (processing module) of the distribution control server 10 according to the first embodiment. Referring to Fig. 16, the distribution control server 10 includes a communication control unit 201, a user registration unit 202, an ID linking unit 203, a location information management unit 204, a data distribution control unit 205, a catalog information management unit 206, and a storage unit 207.

The communication control unit 201 is a means for controlling communication with other devices. For example, the communication control unit 201 receives data (packets) from the service server 20. The communication control unit 201 also transmits data to the service server 20. The communication control unit 201 passes data received from other devices to other processing modules. The communication control unit 201 transmits data obtained from other processing modules to other devices. In this way, other processing modules send and receive data to other devices via the communication control unit 201. The communication control unit 201 has a function as a receiving unit that receives data from other devices and a function as a transmitting unit that transmits data to other devices.

The user registration unit 202 is a means for realizing the above-mentioned user registration (user system registration). The user registration unit 202 acquires personal information (name, date of birth, contact information, account information, etc.) from the user's terminal 50.

When the user registration unit 202 acquires the personal information, it generates a user ID to identify the user. For example, the user registration unit 202 assigns a unique value each time a user registers with the system, and uses the assigned value as the user ID.

The user registration unit 202 stores the user ID and personal information in a user information database (see Figure 17). As shown in Figure 17, the user information database stores the user ID, personal information, and personal identification ID for each service provider in association with each other. The user information database shown in Figure 17 is an example and is not intended to limit the items to be stored. For example, the date and time of user registration may also be registered in the user information database.

The user registration unit 202 sends the generated user ID to the terminal 50.

The ID linking unit 203 is a means for realizing the above-mentioned ID linking. The ID linking unit 203 receives an "ID linking request" from a service provider's terminal (e.g., hospital terminal 60) or the service server 20. The ID linking request includes personal identification information, a personal identification ID, and a business code of the user who wishes to link IDs (register with a service provider).

The ID linking unit 203 searches the user information database using personal identification information (such as the user's name or a combination of the name and date of birth) as a key to identify the corresponding user. The ID linking unit 203 sets the personal identification ID included in the ID linking request in the field corresponding to the business code in the personal identification ID field of the identified user. In other words, the ID linking unit 203 identifies the user registered in the system account from the personal identification information and associates the service provider with the personal identification ID in the identified user's account.

The location information management unit 204 is a means for managing location information obtained from service providers. The location information management unit 204 controls data accumulation for registering user data generated by service providers when they provide services to users in the information distribution system as data that can be provided to third parties.

The location information management unit 204 stores the location information obtained from each service server 20 in a location information database (see Figure 18). As shown in Figure 18, the location information database stores personal identification IDs, business codes, data IDs, data types, data accumulation dates, etc. in association with each other.

Note that the location information database shown in Figure 18 is an example and is not intended to limit the items stored. Also, in Figure 18 and other drawings, for ease of understanding, the business code is represented using the name of the service business.

The data distribution control unit 205 is a means for controlling data distribution through "sharing" or "provision."

First, we will explain data distribution related to "sharing."

The data distribution control unit 205 receives a sharing request from the service server 20. The sharing request includes the personal identification ID of the user from whom data is to be acquired, the business code of the sender of the sharing request, and the type of data desired to be acquired. In the example of Figure 7, the sharing request includes the personal identification ID generated for the user by EC business B (service server 20-2), the business code of EC business B, and the data type "disease name."

The data distribution control unit 205 identifies the target person for data distribution based on the personal identification ID and business code included in the sharing request. Specifically, the data distribution control unit 205 refers to the user information database shown in Figure 17 to identify the target person. In the above example, when a sharing request including the personal identification ID "EC01" is received from EC business B, the data distribution control unit 205 determines from the entry in the first row shown in Figure 17 that user U1 is the target person for data distribution.

Then, the data distribution control unit 205 identifies the service provider that stores the required data using the identified user's personal identification ID and the data type included in the sharing request. Specifically, the data distribution control unit 205 refers to the location information database shown in FIG. 18 and identifies the service provider that stores data corresponding to the data type included in the sharing request. In the above example, Hospital A is identified based on user U1's personal identification ID "HL01" and the data type "disease name" included in the sharing request.

If the combination of the user's personal identification ID and the data type included in the sharing request is not stored in the location information database, the data distribution control unit 205 sends a negative response to the sender of the sharing request indicating that the data cannot be shared. In the above example, if the combination of user U1's personal identification ID "HL01" and the data type "disease name" is not registered in the location information database, a negative response is sent to EC operator B (service server 20-2).

Once the target of data distribution and the accumulator of the data to be distributed have been identified, the data distribution control unit 205 inquires about data sharing from the target of data distribution. Specifically, the data distribution control unit 205 sends an inquiry about data sharing to the contact information of the target of data distribution. In the above example, the inquiry is sent to the terminal 50 owned by user U1.

The data sharing inquiry includes information such as the requester of the data sharing, the data accumulator, and the type of data to be shared. In the above example, EC business operator B is set as the requester of the data sharing, hospital A as the data accumulator, and "disease name" as the type of data to be shared.

The data distribution control unit 205 receives a response to the data sharing inquiry from the terminal 50.

If the user refuses data sharing, the data distribution control unit 205 notifies the source of the data sharing request that data sharing is not possible. In the above example, the data distribution control unit 205 sends a negative response to the sharing request to EC operator B's service server 20-2.

If the user agrees to data sharing, the data distribution control unit 205 sends a sharing instruction to the data accumulator. In the above example, the sharing instruction is sent to the service server 20-1 of Hospital A, the data accumulator.

The sharing instruction includes the personal identification ID generated by the data accumulator, information about the data sharing destination, and the type of data to be shared. In the above example, a sharing instruction including user U1's personal identification ID "HL01", the address of EC business operator B's service server 20-2, and the data type "disease name" is sent to Hospital A's service server 20-1.

In this way, the data distribution control unit 205 sends a sharing instruction that includes the personal identification ID of the user (target person) who has agreed to data sharing, which is a personal identification ID generated by the data accumulator.

Next, we will explain data distribution related to "provision."

The data distribution control unit 205 receives a "provision request" from the trading server 40. The provision request includes a provision application ID, a data provision application, and a list of account holders.

The data distribution control unit 205 identifies a data provider (service operator) that holds user data that meets the requirements for the data to be provided described in the data provision application.The data distribution control unit 205 refers to the user information database and location information database to identify a data provider that holds data for users (target individuals) that meets the requirements described in the data provision application.

In the example of Figure 10, the data distribution control unit 205 refers to the user information database and identifies users aged 20 to 65 who are listed on the account holder list.

Then, the data distribution control unit 205 refers to the location information database and identifies, from among the identified users, subjects who further meet the requirements of the provided data. In the example of Figure 10, the data distribution control unit 205 identifies users who have registered a disease name, test results from tests performed at least once a year, and activity levels at least three times a month during the target period (January 1, 2019 to December 31, 2020).

The data distribution control unit 205 refers to the location information database and identifies the service provider that holds the target data (provided data) for the identified user.

In the example of Figure 18, if user U1 with personal identification ID "HL01" corresponds to the above-identified user, the data distribution control unit 205 identifies Hospital A, which holds the disease name and test results.

Furthermore, if user U1 visits Hospital B and the disease name and test results are registered in the location information database as data to be provided, the data distribution control unit 205 will identify Hospital B, which holds the disease name and test results.

Similarly, if the user with personal identification ID "FC01" is user U1 and corresponds to the above-identified user, the data distribution control unit 205 identifies fitness club C that holds the activity amount.

The data distribution control unit 205 stores the user ID of the identified user, the data ID of the target data for each identified user, the business code of the identified service provider, and the provision application ID in association with each other.

The data distribution control unit 205 notifies the trading server 40 of information regarding the identified data provider. Specifically, the distribution control server 10 sends the trading server 40 a "provider notification" including the supply application ID, the name of the identified data provider, contact information (the address of the service server 20), the type of data stored by the data provider, etc.

The data distribution control unit 205 refers to table information that stores and associates the business code, name, contact information, etc. of the data provider that have been previously input into the distribution control server 10 by staff of the information distribution business, and obtains information about the data provider.

The data distribution control unit 205 receives an "individual contract establishment notification" or an "individual contract withdrawal notification" from the transaction server 40. The data distribution control unit 205 manages the establishment or non-establishment of individual data provision contracts (contracts for each data provision recipient) based on the provision contract ID contained in these notifications.

Once a data provision contract is concluded, the data distribution control unit 205 performs control to obtain the subject's consent to the data provision. The data distribution control unit 205 sends an inquiry regarding the data provision to the user's contact information (an email address that can be received by the terminal 50) identified using a user information database, location information database, etc.

Specifically, the data distribution control unit 205 makes a data provision inquiry to the identified user regarding the data provider with whom a data provision contract has been concluded. In the above example, a data provision contract has been concluded between Hospital A and Pharmaceutical Company D, and a data provision contract has been concluded between Fitness Club C and Pharmaceutical Company D. Therefore, the data distribution control unit 205 sends a data provision inquiry regarding user data held by Hospital A and Fitness Club C to the terminal 50 of the data distribution target.

A data request includes information about the source of the data request (pharmaceutical company D in the above example), the source of the data (hospital A, fitness club C), and the type of data requested (e.g., disease name, test results, etc.).

The data distribution control unit 205 receives a response to the data provision inquiry from the terminal 50. If the user does not agree to the data provision, the data distribution control unit 205 does not take any special action.

When a user agrees to the data provision, the data distribution control unit 205 generates a target ID for each data provision application to identify the user who agreed to the data provision. For example, the data distribution control unit 205 calculates a concatenated value between the provision application ID of the data provision application and the user ID of the user who agreed to the data provision. The data distribution control unit 205 generates a hash value of the calculated concatenated value as the target ID.

The data distribution control unit 205 associates the provision application ID, the target ID of the user who agreed to the data provision, and the user ID and stores them in the consent management database (see Figure 19). Note that the consent management database shown in Figure 19 is an example and is not intended to limit the items to be stored.

Referring to Figure 19, two users have agreed to the data provision application for "PID01." Furthermore, a user with user ID "ID11" has agreed to two data provision applications for "PID01" and "PID02." These users have been assigned different target IDs.

Also, when the user agrees to the data provision, the data distribution control unit 205 calculates the amount of data provided with the user's consent.

If the user agrees to the provision of user data held by Hospital A, the amount of data accumulated during the period covered by the data provision application is calculated, such as one disease name and three test results. Specifically, the data distribution control unit 205 refers to the location information database and counts the amount of user data (disease name, test results) accumulated by the data provider for the above user during the period covered.

Each time the user's consent is obtained, the data distribution control unit 205 notifies the trading server 40 of the calculated data volume. The distribution control server 10 sends a "provided data volume notification" to the trading server 40, which includes the provision application ID and the calculated data volume (volume of data for each data type).

In addition, the data distribution control unit 205 will send the above-mentioned data provision inquiry to the target person's terminal 50 periodically or at a predetermined timing until consent is obtained from the required number of people stated in the data provision application.

The data distribution control unit 205 receives a "data provision execution instruction" from the trading server 40.

Upon receiving the data provision execution instruction, the data distribution control unit 205 sends a provision instruction to each data provider for users who have given consent to the data provision. For example, if consent to the data provision has been given from 10 users, the data distribution control unit 205 sends a provision instruction to each service server 20 for those 10 users.

The provision instruction includes the personal identification ID of the user who has agreed to the data provision, the target ID, information regarding the data recipient (e.g., business name, business code, address of data utilization server 30), and information for identifying (designating) the provided data. The information for identifying the provided data may be a data ID or a combination of the period for which the provided data was accumulated and the data type.

Note that a target ID is generated for each data provision application. Therefore, even if the provision instructions are sent to different service servers 20, the same target ID will be included in provision instructions resulting from the same data provision application. In the above example, the provision instructions sent to Hospital A and Fitness Club C (provision instructions related to the same user) will include the same target ID.

The data distribution control unit 205 obtains consent from the user to data provision from a service provider that has concluded a data provision contract with the data utilization business. The data distribution control unit 205 sends a provision instruction to the service server 20 of a service provider that has concluded a data provision contract with the data utilization business and with which the user has agreed to data provision.

The catalog information management unit 206 is a means for managing catalog information. The catalog information management unit 206 stores the catalog information created by the system administrator in the storage unit 207.

The catalog information management unit 206 receives a "catalog information transmission request" from the transaction server 40. In response to receiving the request, the catalog information management unit 206 transmits the catalog information stored in the memory unit 207 to the transaction server 40.

The memory unit 207 stores information necessary for the operation of the distribution control server 10. A user information database, etc. is constructed in the memory unit 207.

[Service Server]
20 is a diagram showing an example of a processing configuration (processing modules) of the service server 20 according to the first embodiment. Referring to FIG. 20 , the service server 20 includes a communication control unit 301, an ID linkage control unit 302, a data distribution request unit 303, a data storage control unit 304, a data distribution unit 305, a contract conclusion control unit 306, and a storage unit 307.

The communication control unit 301 is a means for controlling communication with other devices. For example, the communication control unit 301 receives data (packets) from the distribution control server 10. The communication control unit 301 also transmits data to the distribution control server 10. The communication control unit 301 passes data received from other devices to other processing modules. The communication control unit 301 transmits data obtained from other processing modules to other devices. In this way, other processing modules send and receive data to other devices via the communication control unit 301. The communication control unit 301 has a function as a receiving unit that receives data from other devices and a function as a transmitting unit that transmits data to other devices.

The ID linkage control unit 302 is a means for controlling ID linkage of users. The ID linkage control unit 302 acquires a request for ID linkage from a user who is logged in to an account using a GUI (Graphical User Interface) or the like. In response to the user's request, the ID linkage control unit 302 sends an "ID linkage request" to the distribution control server 10, which includes personal identification information (such as the name of the logged-in user), a personal identification ID (such as the user's membership number), and a business code.

The user's personal identification ID, personal specification information, user data, etc. are managed using a customer information database (see Figure 21). As shown in Figure 21, the customer information database holds information (flag) indicating whether or not ID federation for the user has been completed. When ID federation is completed, the ID federation control unit 302 sets a flag in the ID federation status field for the corresponding user (a circle is set in Figure 21).

The data distribution request unit 303 is a means for requesting data distribution (data sharing) of user data from an information distribution business operator. The data distribution request unit 303 sends a sharing request to the distribution control server 10 in response to operations by a service provider's staff member or the like. Specifically, the data distribution request unit 303 sends a sharing request to the distribution control server 10 that includes the personal identification ID of the user from whom data is to be acquired, the business code of the user's own device, and the type of data desired to be acquired.

The data storage control unit 304 is a means for controlling the storage of user data generated as a result of providing services to users. The data storage control unit 304 associates the user's personal identification ID with the user's user data (data generated as a result of providing services to the user or data necessary for the services to be provided to the user) and stores them in a customer information database.

As shown in Figure 21, the data storage control unit 304 stores user data in a field corresponding to the type of data generated (storing the specific data content). At that time, the data storage control unit 304 generates a data ID to identify the user data and stores it in association with the user data and the data storage date. Note that Figure 21 shows an example of a customer information database constructed in Hospital A's service server 20.

Here, for users for whom ID linking has been completed, the data storage control unit 304 sends location information to the distribution control server 10 each time user data is stored in the customer information database. For example, consider a case where a service is provided to a user with personal identification ID "HL01" and disease name data is generated as a result of a medical examination. In this case, location information including the personal identification ID "HL01", business code "Hospital A", data ID "HLD01", and data type "Disease Name" is sent to the distribution control server 10.

The data distribution unit 305 is a means for realizing data distribution through "sharing" or "provision." The data distribution unit 305 processes "sharing instructions" or "provision instructions" received from the distribution control server 10.

When a sharing instruction is received, the data distribution unit 305 refers to the customer information database and identifies the entry corresponding to the personal identification ID and data type included in the sharing instruction. For example, when a sharing instruction including the personal identification ID "HL01" and the data type "disease name" is received, the data distribution unit 305 identifies the entry shown in the top row of Figure 21.

The data distribution unit 305 sends the user data described in the corresponding data type field of the identified entry to the data sharing destination specified in the sharing instruction. In the examples of Figures 7 and 21, "stomach cancer" is sent to EC operator B's service server 20-2.

When a provision instruction is received, the data distribution unit 305 identifies the target data for data provision based on the data ID included in the provision instruction. The data distribution unit 305 transmits the user data described in the corresponding data type field of the identified entry to the data destination specified in the provision instruction.

At that time, the data distribution unit 305 transmits the target person ID included in the provision instruction together with the user data to the data destination specified in the provision instruction.

Alternatively, the data distribution unit 305 may transmit user data determined by the personal identification ID, data accumulation period, and data type included in the provision instruction to the data destination specified by the provision instruction.

When transmitting shared data based on a sharing instruction, the data distribution unit 305 may also transmit the user's personal identification information (such as name) to the destination service server 20. The data distribution unit 305 may also assign an ID to the provided data so that the business operator receiving the provided data can associate it with the acquired data. For example, the data distribution unit 305 may calculate a hash value of the user's personal identification information and transmit the hash value as the user's ID to the data distribution destination.

The contract conclusion control unit 306 is a means for controlling the data provision contract. The contract conclusion control unit 306 processes the provision contract conclusion request received from the transaction server 40. Upon receiving the request, the contract conclusion control unit 306 presents the contents of the request to the service provider's staff, etc.

Employees review the data provision contract as shown in Figures 12A to 12C and decide whether or not to enter into the data provision contract. The contract conclusion control unit 306 obtains the decision made by the employee (whether to enter into or reject the data provision contract) using a GUI or the like.

If a data provision contract is concluded, the contract conclusion control unit 306 sends a positive response to the trading server 40 indicating that a data provision contract will be concluded.

If the data provision contract is rejected, the contract conclusion control unit 306 sends a negative response to the trading server 40 indicating that the data provision contract will not be concluded.

The memory unit 307 stores information necessary for the operation of the service server 20.

[Data Utilization Server]
The data utilization server 30 presents information to users (such as staff of the data utilization business operator) and accepts operations from the users. Specifically, the data distribution request unit 303 displays a list of catalog information acquired from the transaction server 40, and transmits a data provision application entered by the user to the transaction server 40.

The data utilization server 30 processes various notifications received from the transaction server 40. Specifically, when the data utilization server 30 is notified that the data provision contract has not been concluded, it notifies the staff of the data utilization business operator of this fact. In this case, the data utilization server 30 receives instructions from the staff to enter into a new data provision contract or to cancel the data provision application. The data utilization server 30 transmits the new data provision contract or a notice of withdrawal of the individual contract to the transaction server 40.

In addition, if the data utilization business operator indicates an intention to cancel the data provision application, the data utilization server 30 sends a request to cancel the provision application to the transaction server 40.

When utilizing user data acquired through data provision, the data utilization server 30 associates the user data received from each service server 20 based on the target person ID received from each service server 20. The data utilization server 30 uses the target person ID to match the user data.

[Trade Server]
22 is a diagram showing an example of a processing configuration (processing module) of the trading server 40 according to the first embodiment. Referring to FIG. 22, the trading server 40 includes a communication control unit 401, an account opening unit 402, a catalog information request unit 403, a supply contract control unit 404, and a storage unit 405.

The communication control unit 401 is a means for controlling communication with other devices. For example, the communication control unit 401 receives data (packets) from the distribution control server 10. The communication control unit 401 also transmits data to the distribution control server 10. The communication control unit 401 passes data received from other devices to other processing modules. The communication control unit 401 transmits data obtained from other processing modules to other devices. In this way, other processing modules send and receive data to other devices via the communication control unit 401. The communication control unit 401 has a function as a receiving unit that receives data from other devices and a function as a transmitting unit that transmits data to other devices.

The account opening unit 402 is a means for opening an account for a user who wishes to distribute data through provision. The account opening unit 402 acquires a user ID from the user's terminal 50. The account opening unit 402 adds the acquired user ID to the account holder list (see Figure 23).

The catalog information request unit 403 is a means for sending a "catalog information transmission request" to the distribution control server 10.

When the catalog information request unit 403 receives a "catalog information presentation request" from the data utilization server 30, it sends a "catalog information transmission request" to the distribution control server 10.

In response to sending the request, the catalog information requesting unit 403 obtains catalog information stored in the distribution control server 10. The catalog information requesting unit 403 selects catalog information related to the service provider with which the device is affiliated, and sends it to the data utilization business (data utilization server 30). The catalog information requesting unit 403 selects catalog information related to the affiliated service provider based on the business code of the affiliated service provider and the business code included in the catalog information.

The provision contract control unit 404 is a means for controlling the data provision contract. The provision contract control unit 404 processes data provision applications received from the data utilization server 30.

When a data provision application is received, the data provision contract control unit 404 assigns a data provision application ID to the received data provision application. The data provision contract control unit 404 manages the data provision application using the data provision application ID.

The provision contract control unit 404 sends a "provision request" including the provision application ID, data provision application, and account holder list to the distribution control server 10.

The provision contract control unit 404 receives a provider notification from the distribution control server 10. The provider notification includes the provision application ID, the name of the data provider that stores the data to be provided, contact information (the address of the service server 20), data type, etc.

Upon receiving the provider notification, the data provision contract control unit 404 separates the data provision application into individual contracts (individual contract proposals) for each data provider. Specifically, the data provision contract control unit 404 generates one data provision contract for data providers that share the notified data type.

In the above example, the disease name and test results are held by Hospital A and Hospital B, respectively, so the data provision contract control unit 404 generates a data provision contract for Hospital A and a data provision contract for Hospital B. Also, the activity amount is held by Fitness Club C, so the data provision contract control unit 404 generates a data provision contract for Fitness Club C.

Alternatively, individual data provision contracts may be generated by employees of the trading business. The data provision contract control unit 404 presents the contents of the provider notification to the employee. The data provision contract control unit 404 acquires the data provision contract generated by the employee using a GUI or the like.

The data provision contract control unit 404 assigns a data provision contract ID to the generated data provision contract. The trading server 40 stores the data provision application ID, data provision contract ID, and data provision contract in association with each other.

Once an individual contract for each data provider (data accumulator) has been generated, the data provision contract control unit 404 requests each data provider to conclude a data provision contract. Specifically, the data provision contract control unit 404 sends a "data provision contract conclusion request" including the data provision application ID, individual data provision contract ID, and data provision contract to each contact point (service server 20) notified by the distribution control server 10.

The provision contract control unit 404 receives a response to the provision contract conclusion request from the service server 20.

If a positive response (a response indicating that the data provider agrees to the data provision contract) is received, the provision contract control unit 404 stores the provision contract ID of the established data provision contract. Furthermore, the provision contract control unit 404 notifies the distribution control server 10 and the data utilization server 30 that the data provision contract has been established. The provision contract control unit 404 sends an "individual contract establishment notification" including the provision application ID, provision contract ID, and data provision contract to the distribution control server 10 and the data utilization server 30.

If a negative response (a response indicating that the data provider does not agree to the data provision contract) is received, the provision contract control unit 404 notifies the data utilization server 30 that the data provision contract has not been concluded. Specifically, the provision contract control unit 404 sends an individual contract non-conclusion notification to the data utilization server 30, including the provision application ID, provision contract ID, and data provision contract.

In this case, the provision contract control unit 404 receives a new data provision contract (a data provision contract with revised conditions) or a notification of withdrawal of the individual contract from the data utilization server 30.

When a new data provision contract is received, the provision contract control unit 404 sends a provision contract conclusion request including the new data provision contract to the service server 20 that is the data provider.

When an individual contract withdrawal notice is received, the provision contract control unit 404 forwards the received individual contract withdrawal notice to the distribution control server 10.

The provision contract control unit 404 controls the cancellation of data provision applications from data utilization businesses.

The provision contract control unit 404 receives a "provision application cancellation request" including the provision application ID from the data utilization server 30.

When a request to cancel a data provision application is received, the data provision contract control unit 404 checks the status of the data provision contract and determines whether the data provision application can be canceled.

If the requirements for the data to be provided in the data provision application are met, the provision contract control unit 404 determines that the data provision application cannot be canceled.If the requirements for the data to be provided in the data provision application are not met, the provision contract control unit 404 determines that the data provision application can be canceled.

Specifically, if the data volume of some of the target data does not exceed the minimum required data volume, the data provision application is deemed to be cancelable regardless of the deadline for the data provision application. Conversely, if the data volume of all of the target data exceeds the minimum required data volume, the data provision application is deemed to be non-cancellable regardless of the deadline for the data provision contract.

If the data provision status is such that cancellation is possible, the provision contract control unit 404 sends a positive response to the data utilization server 30 indicating that the cancellation of the data provision application will be accepted.If the data provision status is such that cancellation is not possible, the provision contract control unit 404 sends a negative response to the data utilization server 30 indicating that the cancellation of the data provision application will not be accepted.

In addition, if a cancellation of a data provision application is accepted, the provision contract control unit 404 notifies the distribution control server 10 of this fact.

The data provision contract control unit 404 controls the execution of data provision. The data provision contract control unit 404 executes data provision when specified conditions are met. The data provision contract control unit 404 has an automatic closure function that automatically closes the data provision contract when specified conditions are met.

Specifically, the provision contract control unit 404 instructs the distribution control server 10 to carry out the data provision when the deadline stated in the data provision application arrives and the requirements for the data to be provided stated in the data provision application are met.

Alternatively, the data provision contract control unit 404 may execute the data provision based on the budget of the data provision application. Specifically, the data provision contract control unit 404 executes the data provision application if the consideration paid by the data recipient when the user agrees to the data provision exceeds the budget stated in the data provision application, and if the requirements for the data to be provided stated in the data provision application are met.

Alternatively, the data provision contract control unit 404 may execute data provision if at least one of the target data exceeds the upper limit of the required data volume and the requirements for the data to be provided as described in the data provision application are met.

When executing data provision, the provision contract control unit 404 sends a "data provision execution instruction" including the provision application ID to the distribution control server 10.

The provision contract control unit 404 manages the status of data provision applications. The provision contract control unit 404 processes the "provision data volume notification" received from the distribution control server 10.

The provision contract control unit 404 identifies the data provision application for which the distribution control server 10 has obtained the user's consent based on the provision application ID included in the provision data amount notification. The provision contract control unit 404 reflects the data amount notified in the provision data amount notification in the data amount of the provided data being managed. The provision contract control unit 404 adds the data amount notified in the provision data amount notification to the parameter that manages the amount of data that can be provided for each type of provided data.

The data provision contract control unit 404 calculates the consideration to be paid by the data recipient based on the consideration stated in the data provision contract (the consideration agreed upon by the parties) and the type of data and amount of data to be provided agreed upon by the user.

For example, in the example of Figure 12A, if the user agrees to the provision of one disease name and three test results, the fee to be paid by the data recipient in response to that consent is calculated as 10 yen + 6 (2 x 3) yen = 16 yen. The provision contract control unit 404 calculates the total fee to be paid by the data recipient by adding the fee arising from the user's consent to the fee already calculated.

In response to receiving the notification of the amount of data provided, the data provision contract control unit 404 generates "data provision status information" that includes the amount of data (accumulated amount) of the provided data for each data type and the total amount of consideration paid by the data recipient. Alternatively, the data provision status information may be a graph that visualizes the data amount and total payment amount.

The provision contract control unit 404 transmits the generated data provision status information (for example, a graph such as that shown in Figure 14) to the data utilization server 30 periodically or at a specified time.

The memory unit 405 stores information necessary for the operation of the transaction server 40. The memory unit 405 stores the business code of the affiliated service provider.

[Device]
24 is a diagram showing an example of a processing configuration (processing module) of the terminal 50 according to the first embodiment. Referring to FIG. 24, the terminal 50 includes a communication control unit 501, a personal information input unit 502, an inquiry processing unit 503, and a storage unit 504.

The communication control unit 501 is a means for controlling communication with other devices. For example, the communication control unit 501 receives data (packets) from the distribution control server 10. The communication control unit 501 also transmits data to the distribution control server 10. The communication control unit 501 passes data received from other devices to other processing modules. The communication control unit 501 transmits data obtained from other processing modules to other devices. In this way, other processing modules send and receive data to other devices via the communication control unit 501. The communication control unit 501 has a function as a receiving unit that receives data from other devices and a function as a transmitting unit that transmits data to other devices.

The personal information input unit 502 is a means for inputting personal information into the distribution control server 10 when registering a user. The personal information input unit 502 uses any means to input personal information (name, date of birth, contact information, account information, etc.) into the distribution control server 10. For example, the personal information input unit 502 acquires the above personal information from the user using a GUI and transmits the acquired personal information to the distribution control server 10.

The personal information input unit 502 stores the user ID issued by the distribution control server 10 in the memory unit 504.

The inquiry processing unit 503 is a means for processing inquiries about data sharing or data provision. The inquiry processing unit 503 obtains the user's intention (agreement, disagreement) using a GUI that matches the content of the inquiry (data sharing, data provision). The inquiry processing unit 503 sends a response including the user's intention to the distribution control server 10.

The memory unit 504 stores information necessary for the operation of the terminal 50.

[Hospital terminal]
Examples of the hospital terminal 60 include mobile terminal devices such as smartphones and tablets, and computers (personal computers, laptop computers). The hospital terminal 60 can be any equipment or device that can accept operations from hospital staff and communicate with the distribution control server 10, etc. The configuration of the hospital terminal 60 is clear to those skilled in the art, so a detailed description will be omitted.

The hospital terminal 60 may send an ID federation request to the distribution control server 10 in response to an operation by a hospital staff member. The hospital terminal 60 also sends the ID federation request to its own service server 20. The service server 20 (ID federation control unit 302) sets a flag in the ID federation status field of the user entry (entry in the customer information database) corresponding to the personal identification ID included in the ID federation request.

[System Operation]
Next, the operation of the information distribution system according to the first embodiment will be described. Fig. 25 is a sequence diagram showing an example of the operation of the information distribution system according to the first embodiment. The operation of the system when providing data will be described with reference to Fig. 25. The distribution control server 10 obtains consent for data provision from the target of the data provision (step S41).

Once the user's consent is obtained, the distribution control server 10 generates a target ID that identifies the user and is different for each data provision application (step S42).

When instructed by the transaction server 40 to provide data, the distribution control server 10 sends a provision instruction to each service server 20, including a data ID specifying the data to be provided and the target ID of the user who contributed to the generation of the target data (step S43).

Each service server 20 transmits the user data (stored data) and target person ID specified by the provision instruction to the data utilization server 30 (step S44).

The data utilization server 30 associates user data based on the target ID obtained from each service server 20 (step S45).

As described above, in the information distribution system according to the first embodiment, once a user's consent to data provision is obtained, the distribution control server 10 generates a target ID to identify the user involved in the generation of the target data. The distribution control server 10 generates a different target ID for each data provision request. When executing data provision, the distribution control server 10 transmits a provision instruction including the target ID to the service server 20. In response to receiving the provision instruction, the service server 20 transmits the user data and the target ID to the data utilization server 30. The data utilization server 30 associates the received user data based on the target ID received from each service server 20. This configuration prevents data utilization businesses from improperly associating user data obtained from multiple data provision requests. In other words, because the target ID is different for each data provision request, data utilization businesses cannot associate data obtained from different data provision requests. Furthermore, the target ID transmitted and received between the service server 20 and the data utilization server 30 is not notified to the user. Therefore, the target ID is not leaked by the user. From this perspective, data utilization businesses cannot associate user data, and as a result, individual privacy is protected.

The personal identification ID used by a data provider to manage users is different for each data provider. If each data provider sends user data to a data destination without taking into account the differences in the personal identification ID, the data destination will be unable to ensure data consistency. As a result, the data destination will be unable to effectively utilize the acquired data. Therefore, in the information distribution system disclosed in the present application, the distribution control server 10 sends a target person ID to each data provider and instructs them to rewrite (replace) the target person ID with the personal identification ID and then send the user data to the data destination.

Next, we will explain the hardware of each device that makes up the information distribution system. Figure 26 is a diagram showing an example of the hardware configuration of the trading server 40.

The trading server 40 can be configured as an information processing device (so-called a computer) and has the configuration shown in Figure 26. For example, the trading server 40 includes a processor 311, memory 312, an input/output interface 313, and a communication interface 314. The components such as the processor 311 are connected by an internal bus or the like and are configured to be able to communicate with each other.

However, the configuration shown in FIG. 26 is not intended to limit the hardware configuration of the trading server 40. The trading server 40 may include hardware not shown, and may not have an input/output interface 313 if necessary. Furthermore, the number of processors 311, etc. included in the trading server 40 is not intended to be limited to the example shown in FIG. 26; for example, the trading server 40 may include multiple processors 311.

Processor 311 is a programmable device such as a CPU (Central Processing Unit), MPU (Micro Processing Unit), or DSP (Digital Signal Processor). Alternatively, processor 311 may be a device such as an FPGA (Field Programmable Gate Array) or ASIC (Application Specific Integrated Circuit). Processor 311 executes various programs including an operating system (OS).

Memory 312 is RAM (Random Access Memory), ROM (Read Only Memory), HDD (Hard Disk Drive), SSD (Solid State Drive), etc. Memory 312 stores the OS program, application programs, and various data.

The input/output interface 313 is an interface for a display device and an input device (not shown). The display device is, for example, an LCD display. The input device is, for example, a device that accepts user operations such as a keyboard or mouse.

The communication interface 314 is a circuit, module, etc. that communicates with other devices. For example, the communication interface 314 includes a NIC (Network Interface Card), etc.

The functions of the trading server 40 are realized by various processing modules. The processing modules are realized, for example, by the processor 311 executing a program stored in the memory 312. The program can be recorded on a computer-readable storage medium. The storage medium can be a non-transitory medium such as a semiconductor memory, a hard disk, a magnetic recording medium, or an optical recording medium. In other words, the present invention can also be embodied as a computer program product. The program can be downloaded via a network or updated using a storage medium that stores the program. Furthermore, the processing modules can be realized by a semiconductor chip.

In addition, the distribution control server 10, service server 20, etc. can also be configured using information processing devices, just like the trading server 40, and their basic hardware configuration is no different from that of the trading server 40, so explanation will be omitted.

The trading server 40, which is an information processing device, is equipped with a computer, and the functions of the trading server 40 can be realized by having the computer execute a program. In addition, the trading server 40 executes the control method of the trading server 40 using the program.

[Modification]
The configuration, operation, etc. of the information distribution system described in the above embodiment are merely examples, and are not intended to limit the configuration, etc. of the system.

In the above embodiment, the explanation was given on the assumption that the information distribution business and the trading business are different businesses. However, a single business may also carry out both the information distribution business and the trading business. In this case, a single server device may have the functions of both the distribution control server 10 and the trading server 40.

The data provision status information described in the above embodiment (e.g., the time series graph shown in Figure 14) is an example, and the trading server 40 can generate data provision status information of various contents. For example, the trading server 40 may generate a time series graph that includes a lower limit value for the required data amount for each data. In this case, the trading server 40 may generate a time series graph that describes the latest status regarding cancellations (whether cancellations are currently possible) and situations in which cancellations are not possible. Alternatively, the trading server 40 may generate a time series graph that describes the timing (approximate) for when data will be automatically provided.

If a digital signature is attached to the data (original data) to be provided, so-called sanitized signature technology may be applied. By using this sanitized signature technology, signature verification becomes possible even if the ID is changed from a personal identification ID to a target ID.

In the above embodiment, a case has been described in which the user's consent is obtained after the data provision contract has been concluded. However, the data provision contract may be concluded after the user's consent has been obtained. Alternatively, the user's consent may be obtained and the data provision contract may be concluded in parallel.

The data distribution system according to the above embodiment may be equipped with a mechanism for extending the deadline for data provision applications. Specifically, the data utilization business operator checks the status of data provision and, if it determines that an extension of the deadline is necessary, inputs this information into the data utilization server 30. The data utilization server 30 then requests an extension of the deadline to the trading server 40. The trading server 40 then updates the deadline for the corresponding data provision application to the notified deadline.

The data distribution system according to the above embodiment may also include a mechanism for the data recipient to set an additional budget. Specifically, the data utilization business operator checks the status of data provision, and if it determines that an additional budget is necessary, inputs this information into the data utilization server 30. The data utilization server 30 notifies the trading server 40 of the additional budget. The trading server 40 updates the budget of the corresponding data provision application to the notified budget.

The data distribution system according to the above embodiment may be configured to allow the closing date to be set manually. Specifically, the data utilization business operator checks the status of data provision, and if it determines that the necessary data has been collected, inputs to the data utilization server 30 that the data provision application is to be completed. The data utilization server 30 then requests the trading server 40 to terminate the data provision application. The trading server 40 then terminates the corresponding data provision application and instructs the distribution control server 10 to provide the data.

In the above embodiment, a case has been described in which the deadline for data provision and the execution of data provision occur at substantially the same time. However, the deadline for data provision and the execution of data provision may occur at different times. For example, the data recipient inputs a "planned execution date" in the data provision application. The trading server 40 may execute (execute) the data provision when the planned execution date arrives.

In the above embodiment, a case has been described in which a user information database is configured within the distribution control server 10, but the database may also be constructed on an external database server, etc. In other words, some of the functions of the distribution control server 10 may be implemented on another server. More specifically, the above-described "data distribution control unit (data distribution control means)" etc. may be implemented on any of the devices included in the system.

There are no particular limitations on the form of data transmission and reception between each device (distribution control server 10, service server 20, etc.), but data transmitted and received between these devices may be encrypted. Users' personal information, etc. is transmitted and received between these devices, and in order to properly protect this information, it is desirable to transmit and receive encrypted data.

In the flow charts (flowcharts, sequence diagrams) used in the above explanation, multiple steps (processes) are listed in order, but the order in which the steps are executed in the embodiments is not limited to the order listed. In the embodiments, the order of the steps shown in the diagrams can be changed to the extent that it does not interfere with the content, for example, by executing each process in parallel.

The above embodiments have been described in detail to facilitate understanding of the present disclosure, and it is not intended that all of the configurations described above are required. Furthermore, when multiple embodiments are described, each embodiment may be used alone or in combination. For example, it is possible to replace part of the configuration of one embodiment with the configuration of another embodiment, or to add the configuration of another embodiment to the configuration of one embodiment. Furthermore, it is possible to add, delete, or replace part of the configuration of one embodiment with another configuration.

The above explanation makes clear the industrial applicability of the present invention, and the present invention is particularly applicable to information distribution systems that distribute stored data related to services provided to users.

Some or all of the above embodiments can be described as, but are not limited to, the following supplementary notes.
[Appendix 1]
a trading server;
a service server operated by a service provider, which stores at least one user data item generated by providing a service to a user;
a data utilization server operated by a data utilization business operator, which transmits a data provision application including the predetermined requirements to the transaction server, the data provision application being an application for acquiring data that satisfies predetermined requirements from among the at least one or more pieces of user data through data provision;
a distribution control server that controls the provision of the data;
Including,
The transaction server transmits the data provision application to the distribution control server,
the distribution control server transmits to the service server a provision instruction including information specifying data that satisfies the predetermined requirements and a target ID that is the user's ID and is generated in response to the data provision application;
The service server transmits the specified data and the target person ID to the data utilization server.
[Appendix 2]
The system described in Appendix 1, wherein, when data that meets the specified requirements is stored in multiple service servers, the distribution control server sends the provision instruction including the same target ID to each of the multiple service servers.
[Appendix 3]
The system described in Appendix 2, wherein the data utilization server associates data received from the multiple service servers based on the target person ID.
[Appendix 4]
The system described in Appendix 3, wherein the distribution control server generates the target ID so that it is different for each data provision application.
[Appendix 5]
The system described in Appendix 4, wherein the distribution control server sends a data provision inquiry to a terminal held by a user corresponding to data that meets the specified requirements.
[Appendix 6]
The distribution control server receives a response to the application for data provision,
The system described in Appendix 5, wherein when the user agrees to the data provision, the user ID of the user who agreed to the data provision, the target ID, and the data provision application ID of the data provision application are associated and stored in a consent management database.
[Appendix 7]
The system described in any one of appendix 1 to 6, wherein the transaction server is operated by a transaction business that mediates data distribution transactions between the service business and the data utilization business.
[Appendix 8]
The system described in Appendix 7, wherein the transaction server controls the data provision contract between the service provider and the data utilization business.
[Appendix 9]
The system described in Appendix 8, wherein the distribution control server transmits the provision instruction to the service server of the service provider with which the data utilization business has concluded the data provision contract.
[Supplementary Note 10]
a trading server;
a service server operated by a service provider, which stores at least one user data item generated by providing a service to a user;
a data utilization server operated by a data utilization business operator, which transmits a data provision application including the predetermined requirements to the transaction server, the data provision application being an application for acquiring data that satisfies predetermined requirements from among the at least one or more pieces of user data through data provision;
a distribution control server that controls the provision of the data;
In a system including
The transaction server transmits the data provision application to the distribution control server,
the distribution control server transmits to the service server a provision instruction including information specifying data that satisfies the predetermined requirements and a target ID that is the user's ID and is generated in response to the data provision application;
The service server transmits the specified data and the target person ID to the data utilization server.

The disclosures of the above cited prior art documents are incorporated herein by reference. While embodiments of the present invention have been described above, the present invention is not limited to these embodiments. Those skilled in the art will understand that these embodiments are merely illustrative and that various modifications are possible without departing from the scope and spirit of the present invention. In other words, the present invention naturally includes various modifications and alterations that may be made by those skilled in the art in accordance with the entire disclosure, including the scope of the claims, and the technical concepts.

10 Distribution control server 20 Service server 20-1 Service server 20-2 Service server 30 Data utilization server 40 Transaction server 50 Terminal 60 Hospital terminal 101 Transaction server 102 Service server 103 Data utilization server 104 Distribution control server 201 Communication control unit 202 User registration unit 203 ID linkage unit 204 Location information management unit 205 Data distribution control unit 206 Catalog information management unit 207 Storage unit 301 Communication control unit 302 ID linkage control unit 303 Data distribution request unit 304 Data accumulation control unit 305 Data distribution unit 306 Contract conclusion control unit 307 Storage unit 311 Processor 312 Memory 313 Input/output interface 314 Communication interface 401 Communication control unit 402 Account opening unit 403 Catalog information request unit 404 Provision contract control unit 405 Storage unit 501 Communication control unit 502 Personal information input unit 503 Inquiry processing unit 504 Storage unit

Claims (9)

a trading server;
a service server operated by a service provider, which stores at least one user data item generated by providing a service to a user;
a data utilization server operated by a data utilization business operator, which transmits a data provision application including the predetermined requirements to the transaction server, the data provision application being an application for acquiring data that satisfies predetermined requirements from among the at least one or more pieces of user data through data provision;
a distribution control server that controls the provision of the data;
Including,
The transaction server transmits the data provision application to the distribution control server,
the distribution control server transmits to the service server a provision instruction including information specifying data that satisfies the predetermined requirements and a target ID that is the user's ID and is generated in response to the data provision application;
The service server transmits the specified data and the target person ID to the data utilization server ,
The distribution control server generates the target ID so that it is different for each data provision application . The system described in claim 1, wherein, if data that meets the specified requirements is stored in multiple service servers, the distribution control server transmits the provision instruction, including the same target person ID, to each of the multiple service servers. The system described in claim 2, wherein the data utilization server associates data received from the multiple service servers based on the target person ID. 4. The system according to claim 3 , wherein said distribution control server transmits a data provision inquiry to a terminal carried by a user corresponding to data that satisfies said predetermined requirements. The distribution control server receives a response to the application for data provision,
The system described in claim 4, wherein when the user agrees to the data provision, the user ID of the user who agreed to the data provision, the target ID, and the data provision application ID of the data provision application are associated and stored in a consent management database. The system according to claim 1 , wherein the transaction server is operated by a transaction company that mediates data distribution transactions between the service company and the data utilization company. The system according to claim 6 , wherein the transaction server controls a data provision contract between the service provider and the data utilizing business. The system according to claim 7 , wherein the distribution control server transmits the provision instruction to the service server of the service provider with which the data utilization business has concluded the data provision contract. a trading server;
a service server operated by a service provider, which stores at least one user data item generated by providing a service to a user;
a data utilization server operated by a data utilization business operator, which transmits a data provision application including the predetermined requirements to the transaction server, the data provision application being an application for acquiring data that satisfies predetermined requirements from among the at least one or more pieces of user data through data provision;
a distribution control server that controls the provision of the data;
In a system including
The transaction server transmits the data provision application to the distribution control server,
the distribution control server transmits to the service server a provision instruction including information specifying data that satisfies the predetermined requirements and a target ID that is the user's ID and is generated in response to the data provision application;
The service server transmits the specified data and the target person ID to the data utilization server ,
The distribution control server generates the target ID so that it is different for each data provision application .