Dana approves cohort-level plays, never patient actions. Each play is consent-checked and channel-compliant before it can be released to the authorized execution layer.
On approval, the play crosses into the authorized execution layer (hub · nurse · specialty pharmacy). Only that layer ever sees an identifiable patient — under its own consent and BAA. The brand receives aggregated outcomes back, never identities.