# RMP-PREV-006 Dental and skin self-check photo log: the crewmember's own self-check, consented standard skin photos, handheld mouth photos (nothing robotic in or near the mouth), and dental symptoms routed to RMP-ENT-002 # Version 0.2 (Draft). CONCEPTUAL. NOT FOR CLINICAL USE. # Space Medicine Foundation robot-readable protocol library. Format: https://spacemedicinefoundation.org/robotic-medicine/protocols/schema/ # Every threshold marked must be set by the named owner (see the schema) before any use. schema_version: '0.3' version: '0.2' status: draft conceptual: true not_for_clinical_use: true max_autonomy: 2 missions: - leo - commercial - moon - mars updated: '2026-10-21' review: state: reviewed-ai-assisted requested: '2026-10-21' reviewed: '2026-10-21' human_clinician_review: false text: >- AI-assisted clinical and source review by the Medical Research Assistant, Oct 21, 2026 (batch 13 review: 11 required corrections, R1 to R11; 8 optional suggestions not applied in this version); all required corrections that apply to this protocol are applied in this version (see Corrections). No named human clinician has reviewed it. Not for clinical use. fixed_rules: flight_surgeon_is_medical_authority: true cmo_acts_under_delegated_care: true human_starts_and_restarts_robot: true robot_never_diagnoses: true no_drug_or_fluid_advice_by_robot: true safe_state_on_fault_or_no_response: true lost_link_pause_then_cmo_decides: true robot_lockouts: diagnosis: true drug_or_fluid_advice: true starting_stopping_or_adjusting_oxygen_or_any_medicine: true self_start_or_self_restart: true changing_own_protocol_thresholds_or_limits: true handing_over_a_mismatched_item_as_verified: true id: RMP-PREV-006 slug: rmp-prev-006 title: >- Dental and skin self-check photo log: the crewmember's own self-check, consented standard skin photos, handheld mouth photos (nothing robotic in or near the mouth), and dental symptoms routed to RMP-ENT-002 category: prev tier: 3 rung_note: >- Max rung 2 for the scheduled prompt, showing the self-check checklist, moving the camera to a standard skin view the crewmember chose at the set distance and without contact, holding the display for handheld mouth photos, and labelling, storing and sending photos, as in RMP-SKIN-003 and RMP-SKIN-004. Nothing robotic goes in or near the mouth, and the robot never judges a photo. result_language: use: - photo recorded - photo not obtained - as stated by the crewmember - flagged for human review - sent to flight surgeon never: - normal - no problem found - all clear - negative - any diagnosis or cause - healthy - no change - changed - better - worse - benign - harmless - cancer - melanoma - mole looks fine - cavity - gum disease - infected - not infected - safe - mild - minor scope: summary: >- At the times the flight surgeon schedules (or on the crewmember's command), the robot shows a prompt; the self-check starts only when the crewmember accepts. It shows the self-check checklist the flight surgeon set for the mouth and skin, asks symptom questions first, and logs what the crewmember states. With consent before the camera moves, it takes standard photos of each skin area the crewmember names, as in RMP-SKIN-003 and RMP-SKIN-004: an establishing view with a margin of surrounding skin, a close-up with a scale, and the same close-up without it. Nothing robotic goes in or near the mouth: mouth photos are taken only by the crewmember (or the CMO) with the handheld intraoral camera or a mirror, and the robot only holds the display at the set display distance. Any tooth pain, a broken tooth or a lost filling or crown moves to RMP-ENT-002; any rash to RMP-SKIN-004. Photos go to the flight surgeon (and a ground dentist the flight surgeon names), who judge every finding. Photos of the face, lips, ears or neck are taken only with the handheld camera by the crewmember or the CMO; the robot camera never comes within the head keep-out distance (L7). why: >- Pre-mission exams include photo documentation of the skin (OCHMO-TB-033), and skin rashes were the most reported clinical event in long-duration ISS crew among the categories studied (Crucian 2016). Lost fillings and crowns and incapacitating dental pain have been reported in flight, and a dental abscess was the condition most likely to end in an evacuation from the ISS in NASA's model (Menon 2012), so dental symptoms go straight to RMP-ENT-002. On Earth, a changing pigmented skin lesion is checked against a 7-point checklist, and a mouth ulcer lasting more than 3 weeks, a lump on the lip or in the mouth, or a red or red-and-white patch is referred for assessment (NICE NG12); on board the robot never scores a lesion, and these are flags for the flight surgeon. A rash or skin change can be harder to see on brown, black or tanned skin (NICE NG240). The photo rules follow RMP-SKIN-003 (IMI 2019). A self-check schedule and the robot's role are design judgment. Open question for review: how often self-check photos should be taken, and whether the ground dentist should see every mouth photo or only flagged ones. covers: - Scheduled or on-command mouth and skin self-checks by the crewmember - >- Consented standard skin photos and handheld mouth photos, for the flight surgeon and a ground dentist - >- Tooth pain, a broken tooth, a lost filling or crown: RMP-ENT-002; rashes: RMP-SKIN-004; wounds: RMP-SKIN-003 locked_out: - Diagnosis or naming a cause - Any medicine, fluid or oxygen advice; starting, stopping or adjusting oxygen - Touching the crewmember - >- Handing over any medicine outside RMP-PHARM-001, or after a MISMATCH or CANNOT VERIFY (the item stays quarantined; only the CMO can ask for it, through the RMP-PHARM-001 logged two-step override) - Any robot part, camera or gripper in or near the mouth - Touching the skin, or pressing on a spot or a rash - Judging, scoring or measuring a photo, a mole, a spot or the mouth, or comparing photos - Photographing anything outside the area the crewmember named, or any photo without consent - Using the robot camera for the genital, breast or buttock area unless the crewmember chooses it - >- Showing a photo on a shared display, or using photos for robot or AI training, research or outreach without separate written consent - Any dental care, cream, ointment or medicine advice - Reporting or counting a declined photo or an unaccepted prompt related: - RMP-ENT-002 - RMP-SKIN-003 - RMP-SKIN-004 - RMP-RESP-003 - RMP-INF-001 - RMP-PREV-002 - RMP-PHARM-001 roles: medical_authority: Flight surgeon (ground). Holds medical authority for every run. onboard_lead: >- Crew medical officer (CMO), acting under delegated care; uses the pre-approved onboard checklist when there is no link. others: - 'Second trained CMO: receives every alert and takes over if the CMO is the patient' - 'Vehicle commander: leads any cabin emergency procedure' - 'Other crew: help as the CMO or commander directs' - 'Ground dentist (named by the flight surgeon): reviews mouth photos the flight surgeon shares' robot_may: - Show one prompt at a scheduled self-check - Show the self-check checklist and ask symptom questions first - Move the camera to a standard skin view the crewmember chose, at the set distance, without contact - Hold the display for handheld mouth photos at the set display distance - Label, store and send photos robot_may_not: - Put any part in or near the mouth - Touch the crewmember - Say what a photo shows or whether anything changed - Photograph without consent - >- Bring the robot camera within the head keep-out distance (L7): photos of the face, lips, ears or neck are taken only with the handheld camera by the crewmember or the CMO commercial: >- On commercial flights, 'flight surgeon' and 'CMO' mean the operator's designated medical authority and trained onboard responder. If no trained responder is aboard, this protocol is not used. (NASA-STD-3001 requires two CMOs per vehicle for NASA programs [V1 3006]; FAA rules set no medical standards for spaceflight participants.) preconditions: - id: PRE-1 text: >- The self-check starts only when the crewmember (or the CMO) accepts the on-screen prompt; a loaded schedule alone never starts it. An unaccepted prompt is logged privately as "not accepted"; it is never reported to the CMO, never counted, and never in the package. A crewmember or the CMO can also start it by command. check: human_start == true refs: - V2 10174 - id: PRE-2 text: Robot self-test passed; kit stowage locations known. refs: - V2 10161 - V2 7059 - id: PRE-3 text: Robot and supplies restrained when not moving. refs: - V2 7046 - id: PRE-4 text: Link status known. The crew never wait for the robot before acting. check: link_state in [live, delayed, down] consent: standard: >- The crewmember agrees to the photos before the camera moves; each skin view is named on screen before it is taken, and photos frame only the area the crewmember named, with a margin of surrounding skin. For the genital, breast or buttock area, the robot camera is used only if the crewmember chooses it; otherwise the crewmember or the CMO takes the photos with a handheld camera and adds them to the log. Photos go to the flight surgeon and the people the flight surgeon names (such as a ground dentist). The CMO sees them only with the crewmember's agreement, or when the flight surgeon asks the CMO to act on a red flag. emergency: There is no emergency use of the camera in this protocol; a red flag sends an alert. withdrawal: >- The crewmember can stop a photo or the whole self-check at any time; withdrawal stops future photos, and the flight surgeon decides on photos already taken. inputs: - id: IN-1 name: Self-check schedule and checklist for the mouth and skin, set by the flight surgeon source: Flight surgeon required: true if_missing: The robot shows "checklist not loaded" and runs only on the crewmember's command. - id: IN-2 name: >- Symptoms and findings in the crewmember's words: tooth or gum pain, bleeding gums, a broken tooth, a lost filling or crown, a mouth ulcer or patch and how long it has been there, a new or changing mole or spot, a rash, itching, swelling or breathing trouble source: Crewmember required: true if_missing: Log "no response"; D2 applies. - id: IN-3 name: The skin areas to photograph, named by the crewmember (or the CMO) source: Crewmember / CMO required: false if_missing: No skin photo is taken. - id: IN-4 name: Handheld mouth photos taken by the crewmember or the CMO source: Handheld intraoral camera required: false if_missing: Log "not taken". - id: IN-5 name: Link status and delay source: Communications system required: true if_missing: Treat as link down; photos are queued. steps: - id: S1 actor: robot rung: 2 action: >- At the scheduled time, show one on-screen prompt that a self-check is due, to the crewmember only. Once the crewmember accepts, log that the self-check has started (sent to the flight surgeon with the package; URGENT at once if any red flag is stated). The self-check starts only when the crewmember (or the CMO) accepts the on-screen prompt; a loaded schedule alone never starts it. An unaccepted prompt is logged privately as "not accepted"; it is never reported to the CMO, never counted, and never in the package. A crewmember or the CMO can also start it by command. Show the symptom prompt first (breathing trouble, or swelling of the face, lips, tongue, throat or under the jaw, is asked first) and log answers word for word. Every URGENT alert goes to the CMO and the flight surgeon at the same time (queued for the flight surgeon if the link is down). If the CMO is the patient, is busy treating, or does not answer, the alert goes to the second trained CMO, or the crewmember named before flight [V1 3006]. An URGENT alert that is not acknowledged within seconds is repeated and sent to the next named crewmember. success: Prompt accepted or "not accepted" logged; answers logged, or "no response". refs: - V2 10174 - V1 3006 - id: S2 actor: robot rung: 2 action: >- Show the self-check checklist the flight surgeon set for the mouth and skin on the crewmember's own screen. The self-check checklist says: "check all over the body and the conjunctivae (the inside of the eyelids); a rash or a skin change may be difficult to see on brown, black or tanned skin". Log what the crewmember states, marked "as stated by the crewmember". A rash that fades when pressed with a glass never ends an alert and is never logged as reassuring. success: Checklist shown; findings logged. refs: - V1 3003 - V2 7016 - id: S3 actor: crew action: >- The crewmember checks their own mouth with a mirror and light, and takes any mouth photos with the handheld intraoral camera (or the CMO does). The crewmember checks their skin as the checklist states and names any area to photograph. For the genital, breast or buttock area, the robot camera is used only if the crewmember chooses it; otherwise the crewmember or the CMO takes the photos with a handheld camera and adds them to the log. success: Self-check done; areas named, or none. refs: - V2 7016 - V2 7017 - id: S4 actor: robot rung: 2 action: >- Hold the display for the handheld mouth camera where the crewmember can see it, no closer than the set display distance, which is never less than the head keep-out distance (L7). Nothing robotic goes in or near the mouth: mouth photos are taken only by the crewmember (or the CMO) with the handheld intraoral camera or a mirror, and the robot only holds the display at the set display distance. Label each mouth photo with the area the crewmember names, the date and clock time, marked "for human review". success: Mouth photos labelled, or "not taken". limit: refs: - V1 7001 - id: S5 actor: robot rung: 2 action: >- Only after the crewmember agrees (D3), move the camera to the standard view for each skin area the crewmember named (about 90 degrees, the same distance, light and plain background each time), no closer than the set camera distance, and take the standard set: an establishing view with a margin of surrounding skin (the area the CMO set), a close-up with the scale, and the same close-up without the scale. Label each with the area, view, date and clock time, and mark it "for human review". Photos of the face, lips, ears or neck are taken only with the handheld camera by the crewmember or the CMO; the robot camera never comes within the head keep-out distance (L7). A photo with anything outside the area the crewmember named in frame is held unsent and flagged to the flight surgeon, who decides whether to keep it. success: Photos taken and labelled, or "photo not obtained". limit: refs: - V1 7001 - id: S6 actor: robot rung: 2 action: >- On the crewmember's request, show earlier photos of the same area side by side to the crewmember. The CMO sees them only with the crewmember's agreement in that session, and never photos of the genital, breast or buttock area unless the crewmember chooses. The robot never says what has changed. success: Photos shown on request. refs: - V1 7001 - id: S7 actor: crew action: The crew clean the camera, the scale, the handheld camera and any shared surface under RMP-INF-002. success: Cleaning recorded as stated. refs: - V2 7046 - id: S8 actor: robot rung: 2 action: >- After any URGENT alert: After an URGENT alert the robot does not leave on its own: it stays at its rest position in the module, with its screen and voice link available, until a human has taken over or tells it to go. It never follows, blocks or touches anyone. It keeps time-stamping what humans say they did, and repeats the alert if it is not acknowledged. success: Robot at rest in the module until a human releases it; alert acknowledged or escalated. refs: - V2 10173 - V1 3006 - id: S9 actor: ground action: >- The flight surgeon, with a ground dentist the flight surgeon names for mouth photos (or the CMO under the onboard checklist when there is no link), reviews the answers and photos and decides on care, follow-up photos and any medicine through RMP-PHARM-001. success: Decision logged. refs: - V1 3004 - id: S10 actor: robot rung: 2 action: >- Only after the CMO or flight surgeon has placed an order, run RMP-PHARM-001 for the ordered item (fetch, barcode match to every order field, recipient check). This protocol adds nothing to that check, never suggests an order, and never hands anything over outside RMP-PHARM-001. success: RMP-PHARM-001 run logged with its result, or none ordered. refs: - V2 7059 - id: S11 actor: robot rung: 2 action: >- Send the flight surgeon one package: answers and findings as stated, labelled photos, alerts and decisions. Photos are stored only in the crewmember's medical record, encrypted in storage and in transit as the program requires; access is limited to the flight surgeon and people the flight surgeon names; the CMO sees them only with the crewmember's agreement, or when the flight surgeon asks the CMO to act on a red flag. They are never shown on a shared display and never used for robot or AI training, research or outreach without separate written consent. success: Package delivered or queued. refs: - V1 6003 - V1 7003 decisions: - id: D1 after: S1 decided_by: robot question: >- Checked after every answer and at any point in the run (even mid-question or mid-step): does any answer, reading or observation meet a red flag? branches: - if: 'Yes' then: >- Stop the current question or step at once and apply the action listed for each matching red flag (URGENT alert, flag, or stop), with the answer or reading itself, never a cause. Every URGENT alert goes to the CMO and the flight surgeon at the same time (queued for the flight surgeon if the link is down). If the CMO is the patient, is busy treating, or does not answer, the alert goes to the second trained CMO, or the crewmember named before flight [V1 3006]. An URGENT alert that is not acknowledged within seconds is repeated and sent to the next named crewmember. - if: 'No' then: Continue. - id: D2 after: S1 decided_by: robot question: Did the crewmember answer the symptom prompt, or say they want to skip it? branches: - if: 'Yes' then: Continue. - if: Declined explicitly (the crewmember says no to a question) then: Log "declined" for that question only; the alert already sent stands. - if: No response, or the answer does not make sense then: >- URGENT: log "no response" (never "declined"); the CMO, or the second trained CMO if the CMO is the patient, checks the crewmember in person at once. - id: D3 after: S4 decided_by: robot question: >- Before the camera moves: did the crewmember agree to this session's photos (each view is named on screen before it is taken)? branches: - if: 'Yes' then: Continue to S5; the crewmember can say stop before or during any view. - if: No, or no answer then: >- The camera does not move and no photo is taken; log "photo not taken – no consent" privately; it is never reported to the CMO, never counted and never in the package. - id: D4 after: S2 decided_by: robot question: >- Did the crewmember state tooth or jaw pain, a broken tooth, or a filling or crown that is loose or has come out? branches: - if: 'Yes' then: >- Start RMP-ENT-002 for the dental problem (its red flags apply); this self-check continues only for the skin, if the crewmember wants. - if: 'No' then: Continue. - id: D5 after: S9 decided_by: ground question: What is the plan (care, follow-up photos, any medicine)? branches: - if: Link live then: Flight surgeon decides; robot logs. - if: Link down or delay too long then: >- The CMO decides under the pre-approved onboard checklist; the flight surgeon reviews the log at the next contact. - id: D6 after: S10 decided_by: robot question: What did RMP-PHARM-001 show for the ordered item? branches: - if: MATCH TO ORDER then: >- RMP-PHARM-001 completes its own recipient check and hand-over; this protocol only logs "MATCH TO ORDER. Not a dose, interaction or allergy review." and the clock time. - if: MISMATCH or CANNOT VERIFY on any field, or a failed scan or recipient check then: >- MISMATCH or CANNOT VERIFY shown with the fields named. No hand-over under this protocol: the item stays sealed in the NOT VERIFIED bag in quarantine (the RMP-PHARM-001 default), and the robot never hands it over unprompted or to anyone but the CMO. The robot does not offer or suggest an override. Only if the CMO explicitly makes the two-step override request inside RMP-PHARM-001 can the item go to the CMO, logged there as an override with the reason and the mismatched fields, and flagged to the flight surgeon. handoff: none stop_rules: - id: X1 trigger: The patient (or the crewmember being examined) says stop, or withdraws consent action: >- Robot stops all motion at once, backs away to its rest position and tells the CMO. Recording stops unless the patient agrees to keep it running. level: stop refs: - V2 10165 - id: X2 trigger: Any crewmember presses stop or takes over control action: Protective stop; robot holds its stopped position; only a human may restart it. level: safe-state refs: - V2 10165 - V2 10168 - V2 10174 - id: X3 trigger: Robot fault, sensor fault, or a force, speed or reach limit is reached action: Protective stop and hand control to the CMO; log the fault. level: safe-state refs: - V2 10172 - V2 10168 - id: X4 trigger: CMO is asked to take over and does not respond (for example, the CMO is the patient) action: Robot stays stopped; the next named crewmember is called. level: safe-state refs: - V2 10173 - V2 7045 - id: X5 trigger: Loss of link, or delay longer than the limit for live guidance action: >- Only the robot pauses: before it holds, it moves to a position clear of a hatch route or a crewmember's route (it never pauses in one), and tells the CMO. This pauses robot movement only: crew care already under way and all other care continue under the onboard checklist and never wait for the link or the robot. The CMO decides whether the robot continues offline under the pre-approved onboard checklist; it resumes only on the CMO's confirmation. level: pause refs: - V2 10172 - V2 10173 - id: X6 trigger: An URGENT alert is not acknowledged within the set time action: >- Robot repeats the alert and sends it to the next named crewmember (the second trained CMO first if the CMO is the patient), and keeps repeating at the set interval. It stays where it is: it does not leave on its own. level: urgent refs: - V1 3006 - V2 10173 - id: X7 trigger: The crewmember stops responding, or seems confused or drowsy, at any point action: >- URGENT alert at once, even mid-question or mid-step; the robot stops its current task, stays at its rest position and does not continue the run; a crewmember checks in person. level: urgent - id: X8 trigger: A crewmember asks the robot what is wrong, or for medicine, fluid or treatment advice action: >- Robot declines, says it cannot assess or advise, and routes the question to the CMO or flight surgeon. level: stop - id: X9 trigger: >- The crewmember or CMO asks to stop photos, or anything outside the area the crewmember named is in frame action: >- Robot stops the camera at once and logs it; any photo with something outside the named area in frame is held unsent and flagged to the flight surgeon, who decides whether to keep it. level: stop - id: X10 trigger: The crewmember moves the handheld camera or their face toward the robot action: Robot moves its display back to the set display distance at once without contact and holds. level: safe-state refs: - V2 10172 - id: X11 trigger: Someone needs the space or route the robot is in action: Robot moves clear at once without contact and holds; it never pauses in a hatch route. level: safe-state refs: - V2 10172 red_flags: - id: RF1 sign: Breathing trouble, wheeze, or swelling of the lips, tongue or throat, as stated threshold: any action: URGENT alert; start RMP-RESP-003 now source: rcuk - id: RF2 sign: >- Swelling of the face, jaw or neck, or under the tongue or jaw, that is spreading, or trouble swallowing or opening the mouth, as stated threshold: any action: URGENT alert to the CMO and flight surgeon; the CMO checks in person now; see RMP-ENT-002 source: sdcepinf - id: RF3 sign: Fever or feeling generally unwell with tooth pain, mouth swelling or a rash threshold: >- degrees (shared parameter FEVER_ALERT_C: body temperature in degrees Celsius, the same value in RMP-GI-003, RMP-ENT-002, RMP-SKIN-002 and RMP-RENAL-004) or higher, or any shaking chills action: URGENT alert; see RMP-INF-001 source: ng253 - id: RF4 sign: Coughing, choking or breathlessness after a crown, filling or piece of tooth came loose, as stated threshold: any action: URGENT alert; the CMO checks in person now; see RMP-ENT-002 and RMP-RESP-002 source: sdceprest - id: RF5 sign: A knocked-out adult tooth, as stated threshold: any action: URGENT alert to the CMO and flight surgeon; see RMP-ENT-002 source: sdcepinj - id: RF6 sign: >- A rash that does not fade when pressed with a glass, or a rash that is spreading quickly, as stated, or the crewmember or CMO is not sure threshold: any action: URGENT alert to the CMO and flight surgeon; see RMP-SKIN-004 and RMP-INF-001 source: ng240 - id: RF7 sign: Painful skin, blisters, peeling skin, or sores of the eyes, mouth or genitals, as stated threshold: any action: URGENT alert to the CMO and flight surgeon source: dermnetsjs - id: RF8 sign: >- A mole or spot that is changing in size, shape or colour, or that oozes or feels different (NG12 7-point checklist features), or that is new or bleeding (new, or bleeding: design judgment), as stated threshold: any action: Flag to the flight surgeon; photos as above; the robot never scores the spot source: ng12 - id: RF9 sign: >- A mouth ulcer that has lasted more than 3 weeks, a lump on the lip or in the mouth, or a red or red-and-white patch in the mouth, as stated threshold: any action: Flag to the flight surgeon, who decides whether to ask the ground dentist source: ng12 - id: RF10 sign: Tooth or gum pain, bleeding gums, a broken tooth, or a lost filling or crown, as stated threshold: any action: Flag to the flight surgeon; start RMP-ENT-002 source: menon - id: RF11 sign: Unresponsive, or not breathing normally threshold: any action: URGENT alert; start RMP-CARD-001 now source: aha2025bls safety_limits: - id: L1 name: Contact with the crewmember value: not allowed enforced: Keep-out zone in the robot controller refs: - V2 10172 - id: L2 name: Camera distance from the crewmember value: enforced: Hard limit in the controller; never less than the head keep-out distance (L7) refs: - V2 10172 - id: L3 name: >- Photo shown on a shared display, or used for robot or AI training, research or outreach without separate written consent value: not allowed enforced: >- Photos are stored only in the crewmember's medical record, encrypted in storage and in transit as the program requires; access is limited to the flight surgeon and people the flight surgeon names; the CMO sees them only with the crewmember's agreement, or when the flight surgeon asks the CMO to act on a red flag. refs: - V1 7003 - id: L4 name: Any robot part within the head keep-out distance (L7) of the face or mouth value: not allowed enforced: Keep-out zone around the head in the robot controller refs: - V2 10172 - id: L5 name: Automatic measurement, scoring or comparison of photos value: not allowed enforced: No such function is loaded - id: L6 name: Robot speed near the crewmember value: enforced: Hard limit in the controller refs: - V2 10172 - id: L7 name: >- Head keep-out distance (the display distance in S4 and the camera distance in L2 are never less than it) value: enforced: Keep-out zone around the head in the robot controller refs: - V2 10172 logs: - id: LOG-1 text: Every input, robot action, decision (with who made it) and hand-off, time-stamped to the second. refs: - V2 10163 - V2 10164 - id: LOG-2 text: Mode changes and safety-limit events are announced to the operator as they happen and logged. refs: - V2 10162 - V2 10172 - id: LOG-3 text: >- Records are stored and sent as private medical data, encrypted, with access limited to the medical team. refs: - V1 6003 - V1 7003 - id: LOG-4 text: Results are kept in a permanent, retrievable format so the flight surgeon can see trends. refs: - V1 7001 - id: LOG-5 text: >- Prompt and acceptance (a declined photo or an unaccepted prompt is logged privately and never reported or counted); answers and findings as stated with times; consent before each session; each photo with area, view, date and time; mouth photos taken with the handheld camera; photos held unsent and the flight surgeon's decision; RMP-ENT-002 or RMP-SKIN-004 started; who viewed the photos. - id: LOG-6 text: >- Each URGENT alert, who received it, the time it was acknowledged (or the escalation to the next named crewmember), and the time a human released the robot. refs: - V2 10163 - id: LOG-8 text: >- Each RMP-PHARM-001 run started from this protocol: order ID, result (MATCH TO ORDER, MISMATCH or CANNOT VERIFY with the fields), quarantine, and any CMO override logged by RMP-PHARM-001 (reason and mismatched fields), at clock time. No running counter of doses. refs: - V2 7059 requirements: - id: V1 3003 use: In-mission preventive health care; the flight surgeon sets the self-check schedule and checklist. - id: V1 3004 use: >- In-mission medical care capabilities, including inventory monitoring and the flight surgeon's decisions on care. - id: V1 3006 use: >- Two trained CMOs per vehicle for NASA programs; the second trained CMO receives alerts when the CMO is the patient (see the commercial-flight note). - id: V1 6003 use: Logs and alerts sent to the ground are private medical communications. - id: V1 7001 use: Records kept so the flight surgeon can see trends. - id: V1 7003 use: Secure handling of medical records. - id: V2 7016 use: Oral hygiene provisions for each crewmember. - id: V2 7017 use: >- Privacy during personal hygiene activities; intimate areas are photographed only as the crewmember chooses. - id: V2 7045 use: Usable by non-physician crew, including when the CMO is the patient. - id: V2 7046 use: Patient, caregiver and supplies restrained. - id: V2 7059 use: Kit inventory and seal status are tracked. - id: V2 10161 use: Robot shows its status and health. - id: V2 10162 use: Mode changes are announced to the operator. - id: V2 10163 use: Robot records and shares its data. - id: V2 10164 use: Shows whether the human or the robot is expected to act. - id: V2 10165 use: Human can override and shut down the robot. - id: V2 10168 use: Human can take over. - id: V2 10172 use: Protective stop when a limit is exceeded. - id: V2 10173 use: Robot stays stopped if no one takes over. - id: V2 10174 use: Only a human starts or restarts the robot. validation: - stage: simulation what: >- Scripted self-checks with facial swelling stated, a lost crown, a changing mole, a missed consent, something outside the named area in frame, a face moved toward the robot, CMO as patient, lost link. pass: >- Every red flag raised before any photo; zero photos without consent; zero declines or unaccepted prompts reported or counted; zero robot parts within the head keep-out distance; zero contact. - stage: training model what: Photo drill on skin models with different skin tones, and handheld mouth photos on a dental model. pass: Photos comparable (same view, light and scale); every photo labelled. - stage: parabolic or station demonstration what: Camera and display positioning in weightlessness. pass: Camera and head keep-out distances held. - stage: flight use under flight surgeon supervision what: First scheduled self-checks. pass: No safety or privacy events. signoff: protocol: - Clinical lead for the specialty (sets every clinical threshold marked ) - Flight surgeon, as medical authority - Robotics and medical-device safety board - Program approval for the mission restart_after_stop: >- Human only. After any emergency or protective stop, a crewmember must restart the robot; the robot never restarts itself. each_run: >- Started by the crewmember, or by an accepted prompt. The crewmember does the self-check; the flight surgeon and a ground dentist judge every finding. change_control: - Every change gets a new version number and a written reason; earlier versions are kept. - >- Any change to steps, thresholds, limits or software that touches the patient repeats validation from the simulation stage before use. - >- Software and learned-skill updates follow a pre-agreed change plan (what may change, how it is tested, how to roll back), modeled on the FDA predetermined change control plan approach. - >- If a new version misbehaves, the robot rolls back to the last validated version and the event is reviewed by the flight surgeon and safety board. - The robot never changes its own protocol, thresholds or limits. comms: live: 'Low Earth orbit: the flight surgeon receives answers and photos when the link allows.' loss_of_signal: - >- Only the robot pauses non-essential motion, at a position clear of hatch routes and crew routes, and tells the CMO; it resumes offline only on the CMO's confirmation. - >- Crew care already under way and all other care continue under the onboard checklist and never wait for the link or the robot. - Photos are queued; any red flag goes to the CMO at once. mars_delay: - 'Mars: photos arrive with delay; the CMO decides under the onboard checklist.' sources: - key: tb033 text: NASA OCHMO. Spaceflight Experience and Medical Care. Technical Brief OCHMO-TB-033 (2023). url: https://www.nasa.gov/wp-content/uploads/2023/12/ochmo-tb-033-spaceflight-experience-medical-care.pdf supports: >- Headaches are more common in spaceflight, with elevated CO2, fluid shifts and pressure changes among contributing factors; pre-mission exams include ECG, eye exams and photo documentation of skin. - key: crucian text: >- Crucian B, Babiak-Vazquez A, Johnston S, et al. Incidence of clinical symptoms during long-duration orbital spaceflight. Int J Gen Med. 2016;9:383-391. url: https://doi.org/10.2147/IJGM.S114188 doi: 10.2147/IJGM.S114188 pmid: '27843335' supports: >- Among 46 long-duration ISS crewmembers, skin rashes were the most reported clinical event in the categories studied (infections, allergies, rashes and hypersensitivities), at 1.12 per flight year. Wounds were not studied. - key: menon text: >- Menon A. Review of Spaceflight Dental Emergencies. NASA/TM-2012-217368 (NASA Johnson Space Center, September 2012). url: https://ntrs.nasa.gov/api/citations/20120002807/downloads/20120002807.pdf supports: >- No written record of an in-flight dental emergency in US astronauts, but a NASA dentist described an in-flight crown displacement temporarily repaired by the crewmember with onboard supplies; cosmonauts reported lost fillings and crowns in flight, thought to be dislodged by launch vibration, and incapacitating dental pain on a 96-day flight; repair must weigh the risk of aspiration (inhaling) of a loose crown; Integrated Medical Model estimates (events per person-year) include dental abscess 0.0230, exposed pulp 0.0201, crown replacement 0.00518 and filling replacement 0.00511, and a dental abscess was the condition most likely to end in evacuation from the ISS in that model; fillings can be linked with tooth pain on pressure change (barodontalgia). - key: ng12 text: >- National Institute for Health and Care Excellence. Suspected cancer: recognition and referral. NICE guideline NG12 (2015, last updated 2026). url: https://www.nice.org.uk/guidance/ng12/chapter/Recommendations-organised-by-site-of-cancer supports: >- 1.7.1: refer a suspicious pigmented skin lesion with a weighted 7-point checklist score of 3 or more (major features: change in size, irregular shape, irregular colour; minor: largest diameter 7 mm or more, inflammation, oozing, change in sensation). 1.8.2: consider referral for unexplained ulceration in the mouth lasting more than 3 weeks, or a persistent unexplained lump in the neck. 1.8.3: consider urgent assessment by a dentist for a lump on the lip or in the mouth, or a red or red and white patch in the mouth. Earth primary-care context; on board, the flight surgeon decides. Read Oct 21, 2026 (saved copy in src/b13). - key: ng240 text: >- National Institute for Health and Care Excellence. Meningitis (bacterial) and meningococcal disease: recognition, diagnosis and management. NICE guideline NG240 (2024). url: https://www.nice.org.uk/guidance/ng240 supports: >- Strongly suspect meningococcal disease with a haemorrhagic, non-blanching rash with lesions larger than 2 mm, or a rapidly progressive or spreading non-blanching rash; check the whole body, including the conjunctivae; a rash can be harder to see on brown, black or tanned skin and can change from blanching to non-blanching; transfer as an emergency. Read Oct 21, 2026 (saved copy in src/b11). - key: imi2019 text: 'Institute of Medical Illustrators. IMI National Guidelines: Wound Management Photography (2019).' url: https://www.imi.org.uk/wp-content/uploads/2019/04/2019_Apr_IMINatGuidelines_Wound-Management.pdf supports: >- Standardise equipment, lighting, background, viewpoint and magnification so serial photographs can be compared; use the same light source each time where possible; hold a measurement scale on the same plane as the wound and photograph from 90 degrees; acute wounds are photographed at each dressing change, and any significant change is photographed; written guidance on consent for clinical photography. Earth hospital context. Saved copy read Oct 21, 2026 (a 2025 version 2.0 exists). - key: sdcepinf text: >- Scottish Dental Clinical Effectiveness Programme (SDCEP). Management of Acute Dental Problems, 2nd edition (March 2026): Management of spreading or systemic infection; Timescales for treatment; Pain pathway (guidance website, read Oct 20, 2026). url: >- https://www.acutedentalproblems.sdcep.org.uk/guidance/overarching-principles/management-of-spreading-or-systemic-infection/ supports: >- Check for the cardinal signs of spreading infection (cellulitis, lymph node involvement, swelling, trismus [trouble opening the mouth]) and systemic infection (fever and malaise); cervicofacial infection such as Ludwig's angina is associated with acute illness and death; be alert to signs of sepsis; a dental problem with severe or life-threatening symptoms (for example severe dehydration, signs of airway compromise or sepsis) or secondary to a significant facial injury needs emergency medical care; pain in the jaw can on rare occasions be a heart attack; patients with toothache often self-medicate and might have exceeded the recommended dose of pain medicine. The condition-level pages (for example lost or displaced restorations) load by script and were not read. - key: sdceprest text: >- Scottish Dental Clinical Effectiveness Programme (SDCEP). Management of Acute Dental Problems, 2nd edition (2026): Cracked, fractured, loose or displaced tooth fragments and restorations (guidance website, read Oct 20, 2026). url: >- https://www.acutedentalproblems.sdcep.org.uk/guidance/management-of-oral-conditions/common-oral-conditions/cracked-fractured-loose-or-displaced-tooth-fragments-and-restorations/ supports: >- If it is known or suspected that the patient has inhaled a piece of tooth, filling or restoration, send the patient immediately to emergency care; for an open cavity, provide a temporary dressing if available, or advise an emergency temporary repair kit. - key: sdcepinj text: >- Scottish Dental Clinical Effectiveness Programme (SDCEP). Management of Acute Dental Problems, 2nd edition (2026): Injuries to the mouth, face and jaws (guidance website, read Oct 20, 2026). url: >- https://www.acutedentalproblems.sdcep.org.uk/guidance/management-of-oral-conditions/less-common-oral-conditions/injuries-to-the-mouth-face-and-jaws/ supports: >- Emergency medical attention is needed for, for example, severe bleeding that will not stop within 15-30 minutes, significant facial trauma, a head injury or loss of consciousness, inhalation of a tooth or tooth fragment, or airway obstruction; an avulsed (knocked-out) permanent tooth with no other complications is a dental emergency but not a medical emergency; advise immediate reimplantation of the tooth, if feasible, otherwise place it in milk, saliva or saline for transport to the dentist. - key: dermnetsjs text: DermNet. Stevens-Johnson syndrome/toxic epidermal necrolysis (2016). url: https://dermnetnz.org/topics/stevens-johnson-syndrome-toxic-epidermal-necrolysis supports: >- Usually starts within the first week of a new antibiotic; a prodrome of fever above 39 °C, sore throat and sore red eyes; then an abrupt, tender or painful red rash spreading over hours to days, flaccid blisters, and sores of at least two mucosal surfaces (eyes, lips and mouth, genitals). Read Oct 21, 2026 (saved copy in src/b11). - key: rcuk text: >- Resuscitation Council UK. Emergency treatment of anaphylaxis: guidelines for healthcare providers (May 2021; printed review date May 2026, which has passed. The RCUK guideline page, as fetched on Oct 20, 2026, still lists May 2021 as the most recent version; a newer version was not found). url: >- https://www.resus.org.uk/sites/default/files/2021-05/Emergency%20Treatment%20of%20Anaphylaxis%20May%202021_0.pdf supports: >- Anaphylaxis is characterised by sudden onset and rapid progression of symptoms, Airway and/or Breathing and/or Circulation problems, and usually skin or mucosal changes; airway problems include throat or tongue swelling, hoarse voice and stridor; breathing problems include wheeze, persistent cough, increased work of breathing, tiredness and hypoxaemia (SpO2 below 94%); circulation problems include pale clammy skin, fast heart rate, low blood pressure, dizziness, decreased conscious level and collapse; skin or mucosal changes alone are not a sign of anaphylaxis and may be absent in up to 20% of reactions; in up to 30% of cases there may be no obvious trigger; gastrointestinal symptoms without airway, breathing or circulation problems do not usually indicate anaphylaxis; call for help early; biphasic reactions occur in around 5% of patients, also after milder reactions, with a median time of around 12 hours, and observation for 6-12 hours may miss over half of them; adrenaline is the first-line treatment, given intramuscularly, and is repeated after 5 minutes if airway, breathing or circulation problems persist; medication accounts for 39% of anaphylaxis-related deaths (Table 1), and allergens given by a parenteral route (for example an IV drug or intramuscular injection) cause a more rapid onset; patients must not walk or stand during acute reactions. - key: ng253 text: >- National Institute for Health and Care Excellence. Suspected sepsis in people aged 16 or over: recognition, assessment and early management. NICE guideline NG253 (2025, last updated Sept 23, 2026). url: https://www.nice.org.uk/guidance/ng253/chapter/Face-to-face-assessment supports: >- People with sepsis may feel very unwell and may not have a high temperature; do not rely on fever alone; a rise in temperature can be a physiological response; assess temperature, heart rate, breathing rate, blood pressure, level of consciousness and oxygen saturation; look for mottled or ashen skin, blue skin, lips or tongue, a non-blanching rash, and breaks in the skin; ask how often the person passed urine in the past 18 hours and about fever or shaking chills (rigors); pay attention to new changes in behavior and to concerns raised by others. - key: aha2025bls text: >- Kleinman ME, Buick JE, Huber N, et al. Part 7: Adult Basic Life Support: 2025 American Heart Association Guidelines for Cardiopulmonary Resuscitation and Emergency Cardiovascular Care. Circulation. 2025;152(16_suppl_2):S448-S478. url: https://doi.org/10.1161/CIR.0000000000001369 doi: 10.1161/CIR.0000000000001369 pmid: '41122888' supports: >- Adult basic life support: initial recognition of cardiac arrest, activation of the emergency response, high-quality CPR and use of an automated external defibrillator; also respiratory arrest and foreign-body airway obstruction. Earth guidance; the onboard checklist leads. Abstract read via PubMed Oct 21, 2026; full text not read. - key: v1 text: 'NASA. NASA-STD-3001, Space Flight Human-System Standard, Volume 1: Crew Health, Revision C (2023).' url: https://www.nasa.gov/wp-content/uploads/2023/11/nasa-std-3001-vol-1-rev-c-with-signature.pdf supports: 'NASA-STD-3001 Vol 1 Rev C: V1 3003, V1 3004, V1 3006, V1 6003, V1 7001, V1 7003.' - key: v2 text: >- NASA. NASA-STD-3001, Volume 2: Human Factors, Habitability, and Environmental Health (Rev F, 2026), including Section 10.6 Automated and Robotic Systems. url: https://standards.nasa.gov/standard/NASA/NASA-STD-3001_VOL_2 supports: >- NASA-STD-3001 Vol 2 Rev F: V2 7016, V2 7017, V2 7046, V2 7059, and Section 10.6 automated and robotic systems. - key: tb044 text: NASA OCHMO. Medical Operations. Technical Brief OCHMO-TB-044 (2025). url: https://www.nasa.gov/wp-content/uploads/2025/08/ochmo-tb-044-medical-operations.pdf supports: >- The crew surgeon keeps medical authority when care is delegated; crew medical officers train on the JSC 48522 medical checklist. - key: marsdelay text: >- NASA. Mars communications disruption and delay (fact sheet, 2023 Moon to Mars Architecture Concept Review). url: https://www.nasa.gov/wp-content/uploads/2024/01/mars-communications-disruption-and-delay.pdf supports: >- One-way Earth-Mars delay up to about 21-23 minutes, plus blackouts of about 2-3 weeks near solar conjunction. - key: pccp text: >- U.S. Food and Drug Administration. Marketing submission recommendations for a predetermined change control plan for artificial intelligence-enabled device software functions (guidance). url: >- https://www.fda.gov/regulatory-information/search-fda-guidance-documents/marketing-submission-recommendations-predetermined-change-control-plan-artificial-intelligence supports: A model for planning, validating and rolling back software updates. - key: faa460 text: 'U.S. Code of Federal Regulations, Title 14, Part 460: Human space flight requirements.' url: https://www.ecfr.gov/current/title-14/chapter-III/subchapter-C/part-460 supports: >- Federal rules for crew and spaceflight participants on licensed commercial flights; they set no medical standards for spaceflight participants. corrections: - date: '2026-10-21' version: '0.2' source: Batch 13 clinical review (AI-assisted), Oct 21, 2026 items: - >- R7: photos of the face, lips, ears or neck are taken only with the handheld camera by the crewmember or the CMO; the robot camera never comes within the head keep-out distance. Added to S5, the summary and what the robot may not do. Sources: RMP-ENT-002 rule (nothing robotic in or near the mouth); design judgment. - >- R8: new limit L7, head keep-out distance ; the S4 display distance and the L2 camera distance are never less than it, and L4 refers to it. Design judgment. - >- R9: a declined photo or an unaccepted prompt is logged privately, never reported to the CMO, never counted and never in the package (as RMP-MSK-005 R15). The scheduled prompt goes to the crewmember only. Sources: RMP-MSK-005 R15; IMI 2019 (consent); V2 7017 (privacy, by analogy). - >- R10: photos go to the flight surgeon and the people the flight surgeon names. The CMO sees them only with the crewmember's agreement, or when the flight surgeon asks the CMO to act on a red flag. S6 shows earlier photos to the CMO only with the crewmember's agreement in that session, and never for the genital, breast or buttock area unless the crewmember chooses. Sources: IMI 2019; V1 7003; design judgment. - >- R11: RF8 now lists the NG12 7-point checklist features (change in size, shape or colour; oozing; change in sensation); "new" and "bleeding" are labelled design judgment. Source: NICE NG12 1.7.1.