No server that can
read your record
Both apps run on the same peer-to-peer network. Records move directly between the devices that need them, over connections their owner granted. When a device is offline, the update waits in a mailbox as a sealed envelope. We could not hand over a database of patient histories if we wanted to, because we do not have one.
Four layers,
no centre
The device layer
Every participant holds their own records locally. Applications are fully functional on the device alone; the network is an addition to that, never a prerequisite for it.
The trust fabric
Devices connect only to peers the owner has verified: a family member, a carer, and later a clinic. Each link is granted deliberately and can be ended the same way.
Institutional nodes
Coming with the Clinic App: each clinic holds a key of its own, listed in a signed directory, and keeps each patient’s record sealed under a key only it holds.
The plugin fabric
Coming to the apps: a marketplace of third-party services and plugins, from lab tests to device plugins, bought in the app and paid to the provider.
Direct when it can be,
sealed when it can't
Every phone and every clinic has its own key, made on the device. Phones talk to each other directly when they can, overiroh, an open-source peer-to-peer library, with a relay for when they can’t reach each other.
When the other phone is offline, the update waits in a mailbox. The mailbox holds only sealed envelopes, and it can’t read what’s inside. When an alert is waiting, the emergency contact’s phone gets a wake-up signal that carries no content at all, not even who sent it.
What leaves a phone is decided on the phone. A family member on Range onlyreceives words like “below” or “in range” and never a number, because the number is removed before anything is sealed.
Patient phone
Holds the record. Decides what each person sees.
Family phones
Receive only the level the patient chose for them.
Sealed mailbox
Keeps envelopes for an offline phone. Cannot open them.
Relay
Helps two phones connect. Passes on traffic it cannot read.
What changes when you
remove the middle
Where records live
- Centralised platforms
- Centralised corporate servers and data lakes
- The cosys.work platform
- On the patient’s phone, and with the people and clinics they choose to share with
Dependency
- Centralised platforms
- Continuous bandwidth; degrades or fails in dead zones
- The cosys.work platform
- Offline-first throughout, syncing asynchronously when a connection appears
Risk profile
- Centralised platforms
- Systemic: one breach exposes an entire population
- The cosys.work platform
- Fragmented: compromising the network means compromising devices one at a time
Custody
- Centralised platforms
- The operator holds raw records, and answers for them
- The cosys.work platform
- No readable operator copy: anything a server holds on the way is sealed
Extension
- Centralised platforms
- A single vendor roadmap and an approval queue
- The cosys.work platform
- A marketplace inside the app, where providers offer services straight to the people who want them
One architecture that satisfies
two contradictory instincts
Patients want the right to erase their history. Clinical practice requires a durable record. Those pull against each other only while a single company holds one readable copy for everybody, so we removed that copy.
Erasure that actually erases
Ending a share can also ask the other side to erase what it received, and a clinic answers with a receipt. There is no operator archive quietly keeping a readable copy.
Clinics keep their obligations intact
Institutional nodes retain the durable clinical record their own regulators require, on their own infrastructure, without that record being pooled with anyone else’s.
Encrypted backup, kept by you
A backup is a file only the owner’s passphrase opens, kept wherever they choose. There is no cloud copy to fall back on, so the backup is the copy.
What leaves is decided on the phone
A family member on Range only receives words like “below” or “in range” and never a number, because the number is removed before anything is sealed.
A health operating system,
extended by outsiders
A person managing several overlapping conditions does not need one vendor’s idea of what matters. They need the specific modules their own health calls for, and the people best placed to build those are usually not us.
The marketplace is coming to the apps. Labs, home sample collection, clinic and physiotherapy appointments, dietitians, coaches with at-home exercise videos, and plugins for CGMs and glucometers, each offered by its provider inside the app and paid to them. Telemedicine and online appointments will come the same way, as services from third parties.
Clinics
Publish a module built for the way your own practice follows up.
Dietitians
Ship a scoring method that runs on the phone, with no connection needed.
Coaches
Build for one sport, one cohort, one very specific set of needs.
Researchers
Offer instruments people can opt into, one category at a time.
Frequently asked questions
The architecture raises reasonable questions. Here are the direct answers.
What does peer-to-peer mean in practice here?
Records move directly between the devices that need them, over encrypted connections the owner has authorised, using iroh, an open-source peer-to-peer library. A relay helps two phones find each other when they cannot connect directly. It passes on sealed traffic and cannot read it.
Is there a server at all?
Yes, three small ones, and none of them can read a record. A relay helps phones connect. A mailbox holds sealed envelopes for a phone that is offline, until it collects them. And a wake-up service tells a phone that something is waiting, with a message that carries nothing: no reading, no name, not even who sent it.
How will a clinic get my history?
With the Clinic App, now in development: you scan your clinic’s QR code and choose to share. Your history travels over the encrypted connection, and the clinic keeps what you shared, sealed under its own key.
What happens if I lose my phone?
Your record is on your phone and in any encrypted backup you made. A backup opens only with your passphrase, and restoring it on a new phone brings your record back. Keep the backup somewhere safe, because there is no cloud copy to fall back on.
How do I know a clinic is really my clinic?
Each clinic will be listed in a signed directory with its name, registration and key, so the app can check that the clinic you pair with is the one you walked into. A person is checked differently, by a short code you read aloud to each other.
Who decides what plugins are allowed?
Providers are listed in the in-app marketplace, and each purchase is between you and the provider. What a service can see of your record is your choice, as with any share. Get in touch if you would like to offer a service.
Build on the fabric
If you are a developer, a clinic or a specialist who wants to publish something into this, or you simply want to argue with the architecture, we would like to hear from you.