The patient-mediatedresearch-data platformfor chronic disease.
Patients connect their health records, choose which studies may use them, and are paid when approved research actually does. Built for twenty-eight chronic conditions with sources worldwide, every access on a tamper-proof log — and nothing is ever sold.
No spam. One email when we launch — and nothing else. Or write to [email protected].
FHIR R4 · US Core 6.1.0 · k ≥ 5 by construction · audited end to end
The whole platform, in one diagram.
Follow the record left to right · the fee comes home on the dashed loop · schematic on synthetic data
Design targets, by the numbers
Fig. 1 · design targets — the platform is pre-launch · see the whitepaper's limitations
conditions
Architected for, urology to oncology — one consent and audit spine.
source connectors
Built and catalogued for launch — jurisdiction-aware by design.
legal regimes
Designed against: HIPAA · GDPR · UK GDPR · EHDS · WA MHMD.
privacy floor
A hard rule, not a setting.
year audit retention
Every consent, query, grant, and fee event — kept six years minimum, append-only the whole time.
records ever sold
Research pays for consented access — and the patient is paid on every approved use. The record itself is never the product.
Twenty-eight chronic conditions tracked on one consent and audit spine: Interstitial Cystitis / Bladder Pain Syndrome, Endometriosis, Inflammatory bowel disease, Irritable bowel syndrome, Fibromyalgia, Long COVID, Systemic lupus erythematosus, Rheumatoid arthritis, Multiple Sclerosis, Parkinson's Disease, Migraine, Type 2 diabetes mellitus, Polycystic Ovary Syndrome, Menopause, Hypothyroidism, Hypertension, Heart failure with preserved ejection fraction, Chronic obstructive pulmonary disease, Asthma, Psoriasis, Ehlers-Danlos Syndromes, Complex Regional Pain Syndrome, Gaucher Disease, Generalized Anxiety Disorder, Major Depressive Disorder, Post-Traumatic Stress Disorder, Breast cancer, Colorectal cancer.
One auditable spine, three promises kept by construction.
The "spine" is a single tamper-proof log that every consent, every query, and every payment is written to. Because the rules are built into that machinery, these three promises don't depend on anyone's good behavior — including ours.
Consent at the front.
Patients own their records and grant each study a revocable, scope-limited consent. We never buy or sell data.
Field note: What revocable consent really meansProvenance at the back.
Every field provenance-tracked and k-anonymized at provisioning — on an append-only, cryptographically anchored audit trail.
Field note: What a real audit trail looks likeCompensation in between.
Participants are paid a fair-market fee. Fees post only on IRB-approved research-use events.
Field note: Should patients be paid?Fig. 1a–1c are schematic apparatus on synthetic data · no real PHI
Consent at the front. Provenance at the back. Compensation in between.
In plain terms: you say yes to a specific study, the machinery enforces the privacy rules on every request, and you are paid when your records are actually used. Here is each step up close.
Patients consent, condition by condition.
Each study presents a plain-language summary and a formal authorization — two documents, one decision. Consent is study-specific, scope-limited, and revocable at any time.
Field note: Two documents, one decisionResearchers ask in plain language.
Cohorts are built in English over a worldwide consented catalog — never raw SQL. Locally hosted AI assists discovery; deterministic engines decide. Below k = 5, the cohort cannot be released.
Field note: k-anonymity, explainedPatients are paid on every approved use.
Participation fees post to the patient’s wallet only on IRB-approved research-use events — recorded on the same audit spine as the consent that allowed them.
Field note: What an IRB actually doesFigures are schematic apparatus on synthetic data · no real PHI
Six capabilities behind one gateway.
Under the hood, six systems share one source of truth: a FHIR R4 / US Core clinical store, a dynamic consent engine, a participation-fee ledger, a deterministic phenotyping and federation layer, an OMOP warehouse, and a tamper-evident audit log.
One spine, one source of truth — proven on interstitial cystitis, our flagship cohort, and architected, unchanged, for all twenty-eight conditions.
Locally hosted AI assists · deterministic engines decide
L0 · GATEWAY
One door in, one door out
Every request enters and leaves through the gateway — authenticated, scoped, and logged.
L1 · CLINICAL SPINE
FHIR R4 / US Core store · consent engine · fee ledger
The system of record: patient-connected data, dynamic consent, and the participation-fee ledger.
L2 · RESEARCH PLANE
Deterministic phenotyping · federated queries · OMOP views
Plain-language cohort builds. Locally hosted AI assists discovery; deterministic engines decide.
L3 · AUDIT
Append-only, cryptographically anchored, six-year
Every consent, query, grant, and fee event lands on one tamper-evident trail.
t+000 REQ 7C2F · cohort query · scope: study-014
t+004 L0 GATEWAY · authn OK · scope verified
t+011 L1 CONSENT · 1,284 active grants matched
t+023 L2 PHENOTYPE · deterministic engine · k = 37 ✓
t+031 L2 FEDERATION · in-region · aggregates built
t+038 L3 AUDIT · entry anchored · hash 9A41…
t+042 → RESPONSE · aggregates only · fees queued
k ≥ 5 enforced · raw records never leave the spine
One spine, unchanged across all 28 conditions · full diagram set available under NDA · trace is schematic, synthetic data
Consented data, wherever your cohort lives.
Residency drives the rules. The same cohort logic runs everywhere — only the lawful basis changes. Federated queries run in-region and return aggregates, so records never leave their jurisdiction.
- 01United StatesHIPAA authorization · §164.508
- 02European UnionGDPR Art. 9(2)(a) consent
- 03United KingdomUK GDPR + DPA 2018
- 04Washington StateMy Health My Data Act
- 05EU secondary useEHDS-ready
illustrative coverage · not legal advice
source connectors
legal regimes
auditable spine
From the journal: Why health data can't just cross borders · The EHDS, explained · Federated analytics
Four doors into one platform.
For patients
Own your records. Choose your studies. Be paid fairly.
Connect the data you choose, decide which studies may use it, and revoke at any time. Participation fees post to your wallet on IRB-approved use.
Field note: Your records are an assetFor pharma & sponsors
Reach a consented, phenotyped cohort in days, not quarters.
Plain-language cohort builds over a worldwide consented catalog — k-anonymized, IRB-gated, and audit-ready for your counsel.
Field note: The recruitment problemFor academia & researchers
From research question to IRB-approved warehouse view in days.
OMOP CDM views, deterministic phenotyping, and federated queries that return aggregates — never raw records.
Field note: What is the OMOP CDM?For governments & providers
Registry infrastructure without building it.
Stand up national or program-level registries on one auditable spine — and open research and trials to your patients.
Field note: Patient registries, explainedPrivacy is apparatus, not policy.
Most platforms promise privacy in a document. Here it is machinery — rules the software physically cannot break, no matter who asks or how important the study is.
Three hostile requests — release a cohort of four, edit an audit entry, and query without consent on file — each travel toward the invariants block, hit the wall, and are refused: the k-anonymity floor is structural, the audit log is append-only, and no consent grant means no query. Every refusal is itself written to the append-only audit log.
Designed for HIPAA, GDPR, UK GDPR, EHDS, and Washington My Health My Data — compliant by design, with per-jurisdiction lawful bases. These invariants are not configurable: the k-anonymity gate cannot be lowered, the audit log cannot be edited, and consent cannot be assumed.
Anything illustrative is labelled inline · partners are named only once agreements are signed — never before
From the journal: Privacy as apparatus, not policy · Why we never sell data · What 'de-identified' actually means
Field notes, fifty and counting.
Plain-language pieces on who owns health data, how the privacy machinery works, what the standards and laws permit, and how chronic-disease research gets faster when patients hold the keys.
All fifty field notes · hover to pause · every title is a link
Fig. 6 · the principle
Patients own their records.Research earns access.The sun is rising on chronic-disease research.
Proven on interstitial cystitis — our flagship cohort, built with a ~30-year patient community — and architected, unchanged, for all twenty-eight.
Join the launch list
Launch is coming.The list is open now.
One email when we launch — and nothing else. Researchers, sponsors, programs, and patients all start here.
No spam. One email when we launch — and nothing else. Or write to [email protected].
[email protected] · patent-pending platform technology