How it works

mynachat proves one thing from your own Myna Portal data: that you meet a group's criteria. Your records themselves never reach the group or the operators. Here is how, step by step.

What the verifier sees

The same reply, as you see it and as the verifier does. The example is the diagnosis list planned for 2027; with prescriptions, only a single drug name is revealed.

Sample, format illustrative

POST /api/my/healthinfo/get-six-medical-info HTTP/1.1
Host: myna.go.jp
Cookie: SESSION=9f2c1e7a4bd03e58a1c6

{"commonHeader":{"screenId":"hm_mc_________"},"reqBody":{"cipCategory":"SBM"}}

HTTP/1.1 200 OK
{"resultCode":"0000","resBody":{"diseaseList":[
  {"name":"潰瘍性大腸炎","icd10":"K51.9",
   "startDate":"2024-05-13","institution":"みなと総合病院"},
  {"name":"うつ病","icd10":"F32.9",
   "startDate":"2025-11-02","institution":"さくら心療内科"},
  {"name":"本態性高血圧症","icd10":"I10",
   "startDate":"2023-02-20","institution":"こうち内科"}]}}

Your diagnosis list from Myna Portal. The full response only ever exists in your browser.

What is stored where

Where	What
Your device	The full Myna Portal response (in the extension's memory, gone when the browser closes) and your passkey's private key.
The group's verifier	The revealed parts (the path and one drug name) and an audit record.
mynachat's server	Username, World ID number, passkey public key, your groups and display names, a short verdict record (e.g. "prescribed ビラノア"), and posts.
World ID	That a proof was made for mynachat. It is never told which condition groups you join.

Audit reports

Every proof has an audit report. It lines up the response your extension saw against the bytes the verifier received, and checks items one by one: the cookie was not revealed, every unrevealed byte is zero on the verifier's side, the certificate is for myna.go.jp, and so on.

Technology

TLSNotary (tlsn v0.1.0-alpha.15): a WASM prover in the extension and a Rust verifier
World ID 4.0 (IDKit): one account per person and secret ballots
Passkeys (WebAuthn): passwordless login
ICD-10 (2013): Japanese titles from e-Stat, English titles from CMS
Next.js, SQLite, Fly.io

We're just as clear about what it can't do yet.

Read the limitations