diff --git a/docs/BYOC_CONNECTOR.md b/docs/BYOC_CONNECTOR.md
index c4af427f..5e042e8f 100644
--- a/docs/BYOC_CONNECTOR.md
+++ b/docs/BYOC_CONNECTOR.md
@@ -67,7 +67,7 @@ Cloud token creation is authenticated and organization-scoped in the dashboard.
   bundle binding.
 * **Up (to the control plane):** PHI-free status/metrics + a storage *path* into
   the customer's own store. **Never** the report body, screenshots, OCR text, or
-  a patient identifier.
+  a record identifier.
 * **The bundle and report bytes** are read from / written to the **customer's own
   storage** (`--storage-root`, a local encrypted volume). Our control plane holds
   no URL to them and signs no access.
diff --git a/docs/DECISION_DELIVERY.md b/docs/DECISION_DELIVERY.md
index 61177d20..de23f661 100644
--- a/docs/DECISION_DELIVERY.md
+++ b/docs/DECISION_DELIVERY.md
@@ -48,8 +48,8 @@ evidence.
 a vocabulary the engine already owns — `Rung`, `ActionKind`, the console's halt
 categories, the ARIA/UIA role names, `RecheckKind` — or is a bounded integer or
 a boolean. A relay that stores this object is *structurally incapable* of
-representing a patient name, an MRN, an observed value, a path, or a workflow
-label.
+representing a person name, a record identifier, an observed value, a path, or
+a workflow label.
 
 That is the same kind of guarantee `HumanDecisionTaskV1` already gives, and it
 is checkable the same way: by reading a schema, not by trusting a detector. The
diff --git a/docs/ECOSYSTEM_INTEGRATION.md b/docs/ECOSYSTEM_INTEGRATION.md
index 0d03f56f..83ddab80 100644
--- a/docs/ECOSYSTEM_INTEGRATION.md
+++ b/docs/ECOSYSTEM_INTEGRATION.md
@@ -121,7 +121,7 @@ The string values are byte-identical, so a flow `Step` could emit/ingest an
 - `Resolution` — which ladder rung resolved the target (`template/…/grounder`), point,
   confidence, `elapsed_ms`.
 - `IdentityCheck` — the pre-click same-entity verdict (`verified/mismatch/abstain/
-  unreadable` × `structured/pixel/vlm/context/param`). This is the wrong-patient safety
+  unreadable` × `structured/pixel/vlm/context/param`). This is the wrong-entity safety
   core.
 - `HealEvent`, `StepResult`, `RunReport`, `UnarmedStep` — audit/telemetry.
 - `risk∈{reversible,irreversible}`, `identity_armed` — the halt-on-uncertainty gates.