How we would build it

The AI approach

This is the part that either works or the product is a diary with charts. Here is exactly what the model is, why it is that and not something fancier, and what stops it saying something confident and wrong.

The prototype is running a real fit

The insight screens in the member app are not mock-ups. The browser fits an ordinary-least-squares model with lagged predictors to 90 days of data at page load and reports the coefficients it recovers, with genuine confidence intervals. Open the app and look at the Insights tab — one factor is deliberately withheld because its interval crosses zero.

The pipeline

Capture

BP readingsCheck-in answersWearable streams

↓ nightly

Features

Daily feature vectorRolling means 3d / 7d Lag expansion 0–3 d

↓

Fit

Hierarchical Bayesian · per-user slopes Population prior GBM challenger (shadow)

↓

Gate

Interval excludes zeron ≥ threshold Safety rules

↓

Deliver

Ranked driversTemplated phrasing Recommendation from reviewed library

Features, and when each one acts

Sodium and alcohol act within a day; sleep debt and stress accumulate. Modelling everything at lag zero would blur all of it together, which is why each feature is expanded across lags 0–3 and the model is allowed to pick.

Feature	Source	Transform	Expected lag
Sleep duration	Wearable, confirmed by member	max(0, 7 − hours)	Same night
Sleep midpoint	Wearable	hours from 02:00	Same night
Alcohol units	Check-in	max(0, units − 1)	Next morning
Perceived stress	Check-in, 0–10	max(0, score − 5)	Next morning, and 3-day mean
Sodium proxy	Check-in food-type items	score − 5	Next morning
Step count	Wearable	(steps − 5000) / 1000	Next morning
Work strain	Check-in	ordinal 0–3	Next morning
Caffeine	Check-in	cups	Same day, evening reading
Hydration	Check-in	litres	Same day
Medication adherence	Check-in	binary	Next morning
Day of week	Derived	weekend flag	—

Why a hierarchical Bayesian model and not a neural network

Requirement	Hierarchical Bayesian	Gradient-boosted trees	Deep model
Works at n ≈ 30 observations	Yes — pooled toward a population prior	Marginal	No
Calibrated uncertainty	Native — posterior intervals	Needs conformal wrapping	Poorly calibrated
Coefficient is the insight copy	Yes — mmHg per unit, directly	SHAP approximation	Opaque
Captures non-linear interaction	Limited	Yes	Yes
Cheap nightly refit for 8,000 members	Yes	Yes	No
Defensible to a regulator	Yes	Partly	Hard

The GBM runs in shadow from day one and takes over per-feature once a member has enough history for it to beat the linear fit on held-out error. The point is not that trees are worse — it is that a product whose entire value is a trustworthy sentence about causation should default to the model whose parameters are that sentence.

Confidence gating — the part that earns trust

An insight ships only when all four hold

1 The 95% credible interval excludes zero

2 At least 12 days where the feature actually varied

3 The effect exceeds a clinically meaningful floor (2 mmHg)

4 No safety rule blocks it

About a third of candidate insights never reach a member. That is the feature, not the overhead — and it is monitored, because the number falling without a model change would mean the gate had stopped working.

What a member sees when it fails

Not silence — an honest statement. The prototype shows this for movement, whose interval genuinely crosses zero on the sample data:

Movement — still learning

Possible effect of −0.9 mmHg, but the range still crosses zero (−1.9 to 0.1). We won’t call it until we’re sure.

Saying “we don’t know yet” is what makes the confident statements worth anything.

Cold start

A new member has no data, and an empty app for three weeks is an uninstall. The model starts from a population prior built from published effect sizes and public cohort data, and each member's own slopes are pooled toward it — heavily at first, then progressively less as their own observations accumulate.

Everything shown before the personal fit clears the gate is labelled as population guidance, not as a personal finding. The prototype's first-week state shows this exactly: general targets, plus a visible “4 of 7 readings” counter.

Safety guardrails

Hard rules

Crisis readings (>180/>120) bypass the model entirely — deterministic threshold, immediate interstitial, no insight, no dismissal
No medication advice is ever generated, in any form
Recommendations come from a clinician-reviewed library with evidence tags; nothing unpublished can reach a member
The language model only phrases structured model output through a constrained template — it never authors clinical content
Outlier coefficients (>3σ from cohort) route to a human review queue rather than to the member
No insight is generated on fewer than 14 days of readings, regardless of interval width

Where the regulated line sits

Phase 1 ships as a wellness product. It records, analyses and educates. It does not diagnose, does not treat, and does not recommend medication.

Crossing any of these would make it software as a medical device:

Stating or implying a diagnosis of hypertension
Recommending starting, stopping or changing a medication
Titrating a dose, even with a clinician in the loop
Deriving blood pressure from a sensor rather than recording a validated cuff

Phase 3 on the roadmap is where that pathway is costed — SAHPRA registration and CE marking, with the clinical validation work that implies.