Arrange these privacy-design actions for a digital healthcare platform in a sensible sequence from defining the service to reviewing patient information rights.

### The order 1. **Define the healthcare purpose and identify the information necessary to deliver it.** Purpose and necessity determine what the system should collect. 2. **Explain collection and use, and obtain appropriate consent.** People need information about the practice before agreeing to it. 3. **Restrict access, log employee activity, and secure information in storage and transmission.** Operational controls protect information during use and transfer. 4. **Set retention and vendor or storage arrangements, and support patient access or correction requests.** These ongoing governance choices define how long data remains, who handles it, and how patients can exercise information rights. ### The concept Privacy should be considered across the system's life, from defining the purpose through operation and patient requests. The sequence is a practical design aid, not a claim that safeguards can only be addressed at one stage. Security and privacy requirements should be integrated into both design and operation. ### Terms - **Retention**: How long an organization keeps information. - **Encryption**: Transforming information so it cannot readily be read without the appropriate key. ### Remember Set the purpose first, then make collection, access, storage, and patient rights fit that purpose.