To overcome the real-time limitations of traditional checkups, DKABio has integrated an advanced health risk analysis model and digital twin technology into its "HA! Health" smart management app. By inputting just eight physiological indicators and completing a brief six-question survey, users leverage a database of over 100 million Han Chinese health records to generate a personalized digital health twin. This twin evaluates current health status, forecasts ten-year risks for over ten chronic diseases, and dynamically simulates 24 key physiological indicators to detect sub-health conditions early.
Based on these insights, the system delivers expert-backed, personalized management plans across exercise, diet, nutrition, and wellness education. Structured as daily task reminders, these plans establish a continuous PDCA (Plan-Do-Check-Act) cycle to foster long-term self-management habits. Furthermore, the app tracks daily data to simulate crucial metrics—such as HbA1c, T-Chol, and Alb—on a weekly basis, automatically alerting users to abnormalities and advising professional medical consultations when necessary.
Aligning with the "Healthy Taiwan 2030" policy blueprint, "HA! Health" actively drives health promotion, smart healthcare, and digital transformation. By supporting national chronic disease prevention and workplace wellness, it establishes a new model for universal health where prevention truly outperforms cure.
Taipei City Health Bureau Medical Device Manufacturing No. MD6101000537 Medical Devices Manufacturer License
Healthcare Sector: In collaboration with Kaohsiung Veterans General Hospital, we obtained IRB approval and real-world data validation, establishing strong clinical credibility. Our solution has been successfully deployed at institutions including Kaohsiung Veterans General Hospital, Yonghe Cardinal Tien Hospital, and Anfa Clinic, with plans to expand our medical network continuously.
Corporate Sector: We partner with major enterprises (such as MetaAge) to implement Enterprise Health Management (EHM), actively helping corporations advance their ESG initiatives and sustainability goals.
Incoming Quality Control (IQC)
Questionnaires & Physiological Data: Requires a signed eConsent from the user.
Third-Party Models & Packages: Must comply with the Apache 2.0 license standard.
In-Process Quality Control (IPQC)
Model Validation: Requires 5-fold cross-validation with a Mean Absolute Error (MAE) or average error of ≤ 15%.
Outgoing Quality Control (OQC)
Performance & Scalability: Single-process analysis executes within 3–5 seconds per record. Multi-processing supports horizontal scaling with elastic core allocation to enable rapid, large-scale batch processing.
Post-Market Surveillance (PMS)
System Availability Monitoring: Focuses on operational execution integrity rather than clinical accuracy. Automated daily audits ensure all generated reports complete successfully.
Instant Exception Alerting: System failures trigger immediate Discord notifications and log updates to DevOps, ensuring rapid troubleshooting and high availability.
International Standards Alignment & QA Specifications
Our corporate management procedures strictly align with the following international standards:
ISO 27001: Governs internal auditing, including access control, supply chain security, and log retention.
GMLP: Mandates the creation of Model Cards and Data Cards.
GDPR: Ensures the absolute protection of user privacy and personal data.
Audit Trail: All version histories and configuration changes must be securely retained for ≥5 years.
Process Management
■Requires an IDC SLA of ≥ 99.9%. Network architecture must include robust firewalls, DDoS protection, and VLAN segmentation, verified via annual audits.
■Employs a strict PDCA (Plan-Do-Check-Act) framework. System defects, API latency, and user complaints are formally reviewed every six months to drive optimizations.
Risk Analysis and Mitigation
■Primary Risk Management
・Model misalignment/data drift → Locked to a stable version, the model blocks abnormal inputs via front-end range checks and triggers manual reviews based on user reports and complaints.
・Personal information/privacy risks → TLS 1.3 + HMAC-SHA256; AES-256 key in secure module; logs kept ≥2 years.
・Third-party component risks:
Ⅰ. Centralized code management; all changes and new dependencies require code reviews before merging.
Ⅱ. Frozen versions prevent auto-update risks. Major upgrades require manual CVE and compliance checks.
■Personal Information Protection Measures
・Scope of Personal Information: name, email, phone, ID, health/account data, device ID.
・Access protection: minimum access principle, access records.
・Personnel management: new employee training, annual internal audit, regular password updates.
・Area management: 24/7 video recording, stored for ≥1 year.
・Accident response: notification process and reports (cause & improvements).
・Appeal processing: completed within 10 days and archived.
・Post-termination procedures: personal data destroyed post-project; proof kept ≥5 years.
Data Governance
Pinned exclusively to the MJ Benchmark Dataset v1.0 with no routine updates, reducing risks of duplication and label contamination.
System & MLOps
Locked to a single, rigorously validated commercial-grade model. Standard version control protocols are implemented to ensure full traceability of all code repositories and model weights.
Isolated test/prod environments; all updates must be verified before rollout.
Continuously monitor availability, outlier interception, and user reports.
Privacy, Legal, and Ethical Compliance
Mandates strict de-identification and anonymization of all customer data.
As a SaMD, the system complies with TFDA, FDA, and EMA review and submission standards.
AI Ethics: Adheres to core ethical principles: transparency, fairness, and accountability.
Cybersecurity Framework
FindSecBugs (white-box); OWASP ZAP (black-box); and lintr scanning.
APT/DDoS protection, VLAN segmentation (DMZ/Trust/API), SSL VPN, and USB control.
Mandates regularly updated endpoint/host protection and 3-year audit log retention.
Daily code updates, weekly GitLab images, and tiered data backups prioritized by asset criticality.
Security team, training, social engineering drills, and BYOD ban.
Incident & Crisis Management
Abnormal events are handled according to a classification system from SEV-1 to SEV-3.
Trigger internal alerts, client notices, and backup plans.
All incidents require RCA+CAPA, with reports completed within 14 days.
No.112129091 Disease Risk Localization Module and Method
No.112303920 Graphical User Interface for Display Screen
The 16th, 17th, 18th, and 19th National Innovation Awards
