The remote control is connected to the external unit, from which it receives power and data, by twin core cable. It can display the following data:

• Heating mode
• DHW mode
• Outside air temp
• 'Inside' air temp (measured on the remote controller itself)
• Compressor on/off
• Pump on/off
• Fans on/off
• Date/Time (RTC on the remote control itself)
• Circulating water return temperature
• Compressor frequency
• Refrigerant discharge temperature
• Power consumption
• Fan speed
• Defrost temperature
• Water pump speed
• Refrigerant suction temperature
• Circulating water discharge temperature

Not too bad! (but more variables to decode...)

DC voltage on the cable is ~12V, and the manual indicates that there is no specific polarity required for the remote.

Internally, the remote includes an R8C/L3AC MCU (which has many IO ports, A/D and D/A converters, and an LCD driver), a T6B70BFG (Toshiba, communications IC), a 5V regulator, and a full bridge rectifier IC.

The T6B70BFG reads/imposes a 250kHz 'sine-ish' wave over the DC supply:

Sigrok Analogue 'input' to the T6B70BFG

Sigrok digital 'output' from the T6B70BFG

Having my circuit read the analogue side would be less invasive, but may be more difficult.