Roadmap
Built in the open, dated to what we can defend.
Shipped, in build, planned, exploring. No back-dated badges. No dates we cannot meet.
Already live
8
Production features we can point to today.
In build
8
Work with a named release window or beta boundary.
Not promised yet
14
Planned and exploratory items stay separate from commitments.
Patient surface.
Daily reflection, validated scales on schedule, crisis surface, opt-in passive signals, data portability.
Daily reflection (write or speak)
Ninety-second prompt. Voice transcribed locally on iOS / Android.
Production
Three checkpoints on the 14-day arc
PHQ-9 day 1, PHQ-9 + GAD-7 days 7 and 14. Validated wording and order.
Production
Item-9 escalation surface
988 / 911 in plain text the moment item 9 is non-zero. Clinician notified on next sign-in.
Production
HealthKit + Health Connect ingestion
Opt-in per metric: sleep, steps, HRV. On-device aggregation, audit-logged.
Fall 2026
JSON export of every reflection and scale entry
Patient-initiated download in a documented schema. Portable to a new clinic.
Fall 2026
Validated translations (Spanish first)
Published PHQ-9 / GAD-7 translations, not LLM-translated text. More as clinics need them.
Q2 2027
Carer / family consent surface
Patient-invited, read-only summary. Off by default, off unless the patient turns it on.
2027
Clinician surface.
The evidence map, the audit chain, the simulator. What a clinician walks into the next visit with.
Evidence map for the pre-visit summary
Source-backed claims, scale trajectories, audit refs. The primary read surface today.
Production
One-time invite codes for new patients
One code per patient. No public signup; codes are the only way in.
Production
Treatment plan simulation v2.5
Forecast / rehearse / compare against a graph-grounded surrogate. Clinician-only commit.
Fall 2026
Risk queue across roster
Triage queue from item-9 events plus scale-movement bands, for multi-clinician clinics.
Q1 2027
PDF pre-visit summary export
One-tap evidence-map export for clinicians who paste into an EHR by hand.
Q1 2027
FHIR R4 write-back to the EHR
Push the summary as a FHIR DocumentReference. Epic, Cerner, Athenahealth in that order.
2027
Multi-clinic federated audit
On patient transfer, the audit chain follows. Cryptographic continuity, no central registry.
2027+
Agent SDK.
Read the graph, draft in a sandbox, run a simulation. A clinician commits; the agent never does.
Evidence-map read API
GET /v1/patients/:id/evidence-map. JSON-LD with sources, confidence bands, audit_ref per claim.
Beta
OAuth 2.1 + DPoP authentication
Per-clinic agent identity. DPoP-bound, nonce TTL 120s, no long-lived bearer tokens.
Beta
Sandbox tier with synthetic patients
No real PHI reachable from a sandbox token.
Beta
health_signals.read function call
Aggregated HealthKit / Health Connect signals as sources. Opt-in per patient per metric.
Beta+1
simulation.run write surface
POST /v1/simulations, modes forecast | rehearse | compare. Sandbox-only until commit-boundary tests pass.
Beta+1
draft.create with clinician-commit boundary
Agents propose; clinicians commit. Enforced at the auth layer, not the prompt.
Beta+1
Webhooks for audit events
Subscribe to commit / draft / escalation events for real-time outbound.
2027
Compliance + trust.
What we ship today, what is in the assessment, what we will not back-date. Full breakdown on the security page.
PHI blocked in dev (CI gate)
Every commit scans the client bundle for PHI-shaped strings. CI fails on any match.
Production
Append-only audit chain with hash continuity
Every state change appends a row with SHA-256 of the prior entry. Server refuses to start if any link breaks.
Production
Row-level security across every table
Anon-key reads return zero rows; the service-role key never reaches the client. Default-deny per row, per clinic.
Production
HIPAA risk assessment
Documented per Security Rule §164.308(a)(1)(ii)(A). Gating artifact for the first production clinic.
Q4 2026
HIPAA BAA template
Drafted with counsel, in review with pilot clinics. Sent before contract, not at contract.
Q4 2026
SOC 2 Type I report
Controls mapped to AICPA Trust Services Criteria. Window opens at control sign-off.
Q1 2027
SOC 2 Type II report
Twelve months after the Type I window opens. Published when the auditor letter is in hand.
Q1 2028
Third-party penetration test
Scoped after SOC 2 Type I. Summary letter published; full report under NDA.
Q2 2027
HITRUST certification
Distinct from SOC 2 and HIPAA. Not pursuing for v1. We revisit if a v2 clinic requires it.
Not yet
Explicit refusals.
Diagnosis on the patient surface.
Decision support is for the clinician. The patient never sees an app-generated diagnostic label.
Real-time monitoring without a human.
The app is not the crisis line. 988 and 911 are, reachable from every screen.
Training models on patient text.
Reflections are not training data. Not ours, not anyone's, not ever.
Selling, sharing, or repurposing patient data.
The clinic owns the record. The patient owns the export. No third party.
Dated detail in the changelog. Compliance posture on the security page. Agent surface in the agent SDK docs.