Health
In plain words: App: Health (medical records)
Health helps one consenting adult turn medical documents into a reviewed, correctable clinical history, discuss one health question, and carry diagnostic or treatment proposals to a qualified human.
- 1Models may summarize and propose but never diagnose, prescribe or order tests.
- 2A red flag stops consultation and returns an emergency handoff; Health does not call emergency services.
- 3Clinical data stays local and purpose-limited; it never follows shopping or fitness requests.
Designed Accepted design; no delivered implementation.
Words on this page, decoded click one for its card
In this section 3 pages
A folder of photographed reports, remembered symptoms, prescriptions, and laboratory results is not yet a clinical history. Health helps one consenting adult turn that material into an attributable, corrigible profile, discuss one bounded health question, and carry a proposed diagnostic or treatment plan to the right human decision. Unreadable evidence can remain unreadable; uncertainty is a result, not a gap for a model to fill.
This Native Reference CompositionApp has the stable identity health.clinical, revision 1.
Its records and proposals support the bounded human decisions described below.
Enter through the case
| Reader journey | Pinned PatternWorkflow | Primary records |
|---|---|---|
| Assimilate records into a reviewed profile | health.assimilate_record@1 |
ClinicalSource@1, ExtractedClinicalClaim@1, HealthProfile@1 |
| Consult the evidence and plan diagnostic work | health.review_case@1 |
HealthCase@1, DiagnosticProposal@1 |
| Review treatment options and follow up | health.plan_care@1, health.follow_up@1 |
CareProposal@1, HealthFollowUp@1 |
Each PatternWorkflow is independently invocable. AnA InvocationJob Request ends with a committed record or reviewed proposal, an emergency or qualified-professional handoff, an exact blocker, refusal, partial result, cancellation, interruption, or explicitly unresolved evidence or external effect. A longitudinal profile does not turn consultation into an endless RunJob Record.
Contract
Health owns admitted clinical sources and their revisions; extracted claims and corrections; profile revisions; case questions; patient-reported symptoms; clinician-authored assertions; measurements and test results; competing explanations; diagnostic and care proposals; consent, review, sharing, export, deletion, and follow-up receipts. It keeps source observation separate from extraction, model interpretation, human confirmation, and externally established clinical fact.
A Mind may summarize evidence, expose contradictions, ask discriminating questions, and propose diagnostic or treatment options. It may not convert OCR into truth, silently reconcile conflicting records, declare a diagnosis final, prescribe, order a test, administer treatment, or present absence of a warning as proof of safety. Deterministic policy checks units, identity, source coverage, duplicate intake, interactions represented in the admitted knowledge set, approval bindings, and typed handoffs; passing those checks does not establish medical correctness.
Revision one supports personal clinical decision support for a consenting adult. Emergency care, autonomous triage, pediatric care, pregnancy and perinatal care, psychiatric crisis response, controlled substances, surgery, and unsupervised medication changes are outside its supported treatment path. A red flag stops ordinary consultation and returns an emergency handoff; Health does not monitor the person or contact emergency services.
Authority and privacy
The patient, caregiver, clinician, prescriber, laboratory, and record custodian are distinct principals. Consent to store a photograph is not consent to infer from it, disclose it, accept an extracted claim, approve a plan, or perform a clinical effect. Human approval cannot create competence, licensure, a prescription, or provider acceptance. HitL binds one exact eligible proposal; the applicable clinical and effect owner still rechecks authority at execution time.
Clinical material is local and purpose-limited by default. Imports, remote inference, lookup, retained media, sharing, research, export, and deletion have separate revocable permissions and retention rules. The minimum necessary typed result may cross a boundary. A complete record, credential, identifier, image, diagnosis, medication list, or genetic result never follows a shopping, fitness, or household request merely because it might be useful.
Wellbeing keeps ordinary eating, movement, and reflective check-ins. It may receive an explicitly approved constraint such as a prohibited ingredient or movement limit, without receiving its diagnosis or record history. Health may admit an exact patient-reported observation from Wellbeing only with purpose-specific consent; neither owner rewrites the other. Settled external clinician, laboratory, pharmacy, or health-record results enter as attributed references. Live coordination with them would require a separately accepted SuiteApp Bundle or integration contract, not ambient access from this CompositionApp.
Recovery and falsification
Retain profile, case, source, policy, and PatternWorkflow revisions with every accepted fact and proposal. Corrections must preserve earlier claims and invalidate dependent pending proposals; these references identify the affected work. On restart, resume only exact compatible work without duplicating an import or approval. A request or missing acknowledgement cannot establish that a test was ordered, medicine dispensed, a dose taken, or treatment completed. Settle pending external effects through receipts, reconciliation, or qualified handoff.
The smallest falsifying fixture uses a wholly synthetic adult and fabricated photographs: a two-page discharge note, a duplicated laboratory report, one illegible medication line, and a typed new symptom. It must preserve page regions and extraction gaps, refuse a conflicting patient identity, keep OCR separate from accepted facts, surface contradictory dates and units, stop on a red flag, and produce a diagnostic proposal without declaring a diagnosis. A care proposal must park for an exact authorized verdict, become stale after a relevant profile correction, survive restart without duplicate approval, and support bounded export and deletion without erasing a retention blocker. No real patient, provider, live health account, prescription, emergency call, test order, purchase, or treatment enters the proof.