THE ARGUMENT

More data, less truth

Every record system in health care and finance makes the same decision at the door: it rules each arriving value true or false, stores the survivors as exact, and throws away what it knew about where the value came from. A record built that way grows more confident as it grows and no more accurate.

The decision made at the door, before anyone knows the question

A value arrives. A laboratory result, a blood pressure, a bank line, a figure read off a photographed statement. The receiving system has three things it can do with it. It can accept the value, after which every report, every alert and every analysis treats the number as exactly true. It can reject the value, after which every analysis behaves as though the observation never happened. Or, most often, the value has no field to land in at all, so it goes into a free-text note or a scanned attachment where nothing can read it.

In all three cases the system rounds a continuous quantity to zero or one. How far a datum deserves to be believed is a number between those two ends, and it depends on which laboratory ran the test, whether staff confirmed the patient had fasted, whether the device had drifted, whether the amount came off a feed or out of a phone camera. The record has that information at the moment the value arrives. It discards it, replaces it with a verdict, and keeps only the verdict. Everything downstream inherits the verdict and has no way to question it.

Other fields settled this question decades ago and went the other way. A digital radio receiver can decide each bit as a hard zero or one before decoding, or pass the decoder a confidence for each bit. The soft decision is worth about 2 dB at low signal-to-noise ratios, which is the difference between a link that works and one that does not. Record systems in medicine and money still make the hard decision, at the one point in the process where the most context is available and the least is kept.

The failure that gets worse as the system succeeds

No real record is clean. Every one of them accepts some values that are wrong: a glucose drawn after breakfast and labeled fasting, a wristband reading taken while the band sat on a nightstand, a transfer between a person's own accounts tagged as income by an aggregator, a receipt photo read as $189.90 for an $18.99 grocery charge. Those errors do not cancel. A mislabeled fasting glucose runs high, not randomly high and low, so the mistakes point the same direction and leave a fixed offset in every answer the record gives.

The arithmetic is short. If a fraction of accepted values is wrong, and a wrong value is off by some average amount, the product of the two is a bias that carries no record count in it. A million records carry the same bias as a hundred. Meanwhile the stated margin of error shrinks with every new entry, because that is what margins of error do. The two curves cross. Past the crossing, the record reports narrow, confident ranges around a point in the wrong place, and nothing inside the record signals the problem. The failure is silent, and it arrives faster the better the record does at collecting data.

The size at which a record's stated 95 percent range is more likely wrong than right scales with the inverse square of the bias. Halving the bias quadruples the size a record can reach before its conclusions stop holding. Excluding weak sources lowers the bias and moves the crossing. Fixed weights, set once by a committee, lower it and move the crossing. Neither removes it, because neither drives the bias to zero. Only weights that keep learning from outcomes do that.

What the measurement shows

Three conventional methods and the evidence-weighted record were run on the same data, estimating a quantity that one source reports with a bias. Each method can be built and run by anyone. None was told which source was biased. Measured over 240 runs at each size using the shipped model, the share of stated 95 percent ranges that actually contained the truth fell to zero for every conventional method as the record grew, while the evidence-weighted record held 99 percent, and at ten thousand records every stated range held.

The pattern matters more than any single figure. The conventional curves start high at twenty-five records, where the margin of error is still wide enough to cover the bias by accident, and collapse as the record fills. A buyer evaluating one of those systems at a pilot size sees honest numbers. The same system at production size reports the same confidence and has stopped being right.

Four ways a record goes wrong, and what each one costs

Four failure modes account for nearly everything that goes wrong inside a real record. Each was simulated separately, against a conventional record and against the shipped evidence-weighted model, with no method told what it was facing.

The fourth row is the one to read carefully, because it is the strongest evidence that the first three are honest. In that regime the errors are scattered rather than systematic, and a vote among independent sources is decided by who agrees with whom. Weighting every source by its true reliability, which no buildable system can do because true reliability is a property of the world, also gives 1.63 percent. The conventional record is already doing as well as anything could. This record matches it instead of degrading it. A record that claimed a general accuracy gain from learned weights in every regime would be overselling them, and the fourth row is where that claim would have had to break.

What this costs in a clinic and in a ledger

The abstract failure has concrete forms, and anyone who has run a practice has watched them happen. A patient tells an intake clerk she reacted badly to a drug years ago. The clerk enters it as an allergy. It was a side effect of a different drug entirely, and it is now in the chart as a hard allergy. Two referrals later, three systems carry it, each having received it from a system that received it from somewhere else, and every one of them displays it as a confirmed fact with no mark of where it started. A physician who wants to use the right drug has no way to find the chain back to the clerk, and the safest action in front of them is to prescribe something worse.

In money the same failure wears different clothes. A balance goes stale: an account feed stops updating, the ledger keeps displaying the last figure it received, and nothing on the screen distinguishes a number from this morning from a number from eleven weeks ago. A loan application is prepared from it. An aggregator tags a $6,000 deposit as income when the money came out of the family's own brokerage account, and the figure lands in a debt-to-income calculation and a tax draft. A receipt photo reads $189.90 for an $18.99 charge, and the household budget now carries a category that is wrong by a factor of ten.

In each case the record had the information needed to catch the problem at the moment the value arrived: which source produced it, how that kind of source has performed before, and whether the rest of the record agreed. In each case the record decided true or false, kept the verdict, and discarded the evidence.

THE ARGUMENT

The Evidence-Weighted Record

Every fact is stored exactly once, as a permanent entry carrying what was observed, about whom, when, from which source, and how far that source has earned trust. Nothing is overwritten, and every screen, report and research set is assembled from those entries.

What a fact carries

A value in either record is never a bare number in a column. It arrives as an event and keeps what decides its meaning:

• The source, and its class. Which laboratory, clinic, device, bank, app or person produced it, and what kind of source that is: a certified laboratory, a clinic measurement, a consumer wearable, an institution feed, a figure read by software off a document, a person's own statement.
• The method. Measured, calculated, reported, or read from a document by software.
• The times. When it was observed and when it was entered, kept apart, because the gap between them is often the whole story.
• The original. A link to the document or data stream it came from, down to the spot on the page, so any number can be checked against its source years later.
• The extraction confidence. For anything read from a document or a photograph, how sure the reader was of the characters.
• The weight. How far values from this source can be believed at this kind of fact. The event keeps the weight its source carried when the value was written, and a reader also sees that source's weight now.

Weights live apart from the facts. The weight in force is not stored at all: it is computed at read time from the evidence counts, in one place both records use, so a change in policy updates every dependent analysis and neither record can drift from the other. When a weight changes, no stored fact is edited and no closed year's books are rewritten, and every analysis records the weight version it used so any result can be reproduced.

The never-overwrite rule

A fact enters once and stays. A correction is a new event that points at the one it corrects, a retraction is an event, and a merge of two records entered in error is an event, so an unmerge separates them exactly. Views show the current value; the history shows every version, who changed it, and why. Replaying the events up to a date reproduces the record exactly as it stood then, which answers the question conventional systems handle worst: what did the record say on March 3, and why did it change. A clinician defending a decision, an auditor reconstructing a filing and a lender re-examining an underwriting file all need that, and in a record that overwrites, none of them can have it.

The archive and the working record are the same object. Each event carries a cryptographic fingerprint of itself and of the one before it, and the newest is anchored outside the database every hour, so even a consistent rewrite where every internal link agrees fails against the anchors. The event tables refuse updates, deletes and truncation at the database level. Lawful erasure removes a subject's values and recomputes the chain so that it still verifies and every proof issued earlier still holds.

The record never overwrites a laboratory with its own opinion

The record holds a position on how far a given value can be trusted and does not act on it by changing the value. A clinician reads what the laboratory posted, as the laboratory posted it, and reads beside it what the evidence says about that source: the weight it carries at this kind of fact, how that weight was earned, and what the probability of the underlying condition looks like once the whole record is counted.

A record holds a hemoglobin A1c of 5.9 percent and earlier fasting glucose readings near 105. A new result arrives reading 132, labeled fasting, against a diabetic cutpoint of 126. With staff confirmation of the fasting draw, the value's reliability given the whole record is 0.92 and the probability the true fasting glucose is at or above the cutpoint is 0.34. Labeled fasting and unconfirmed, 0.66 and 0.25. With the patient having told the guide app she ate breakfast, 0.10 and 0.05. In all three cases the chart still shows 132, and a binary record stores it as a diabetic-range fasting value with no field in which to say otherwise.

The same rule runs through the financial record. A $61,000 deposit matched to a closed statement and an invoice reads at 0.91 reliability with a 0.67 probability of being recurring income; reported by one aggregator and unmatched, 0.42 and 0.19; read off a photographed statement with no match, 0.17 and 0.06. The deposit is $61,000 in every case, and what changes is what a loan file is entitled to conclude from it.

When sources disagree, the record settles the fact and keeps the alternatives: the value most likely to be right, its confidence, every value it rejected with that value's own probability, which sources were counted as a single witness, and the confidence the answer would have carried had those sources been treated as independent. That last figure shows what the independence assumption cost. No conventional system has a place to put it.

A registry, so a new kind of data needs no database change

In a conventional system, a new test, a new wearable metric, a genome or a new kind of account means new tables or columns, a schema migration with downtime, and changes to every program that reads them. The usual response is to push the new data into free-text notes or scanned attachments, where nobody can analyze it.

Here a new kind of data enters through a registry entry and the database structure does not change. Every event has the same outer shape; the registry defines what a valid payload for each type looks like. An entry states what the type measures, its standard code, its unit and conversions, the range of plausible values so a typo or a misread photo is held for review instead of landing, the method when that changes the meaning, its starting weight by source class, and its version, so a definition can be refined later without changing what older events meant. Adding a type takes a definition and a person's approval, and intake can accept the new data that day. The health record ships with 46 approved types.

The registry also prevents the opposite failure, a database that fills with data nobody can interpret. No value lands unless its type is defined, and anything intake cannot map is held for a reviewer rather than forced into the wrong field: a downloaded bank file with the letter O typed where a zero belonged went to the holding bay rather than into the books.

Events are the only thing written. Everything a person sees is a view computed from them and kept current as they land: the patient's timeline, the clinician's chart as FHIR resources, a research store in the OMOP format, a balance sheet. A new app or report is a new view rather than a change to what is stored.

Why one design serves health and money

Holarc holds a person's health over a lifetime. Finarc holds a person's money, and the money of every household, business, trust and estate they own, with walls between entities so figures tie together and still separate for audit. They run on one engine and one trust model, so what a weight means in a loan file is what it means in a chart, and they are never joined into one store, because a single store holding a person's complete health and financial life would be the most valuable target a thief could assemble.

The mathematics does not care what the values measure. A health record that treats a home blood pressure cuff, a clinic reading and a typed entry as equally true has the same failure as a ledger that treats a bank feed, a photographed receipt and a remembered figure as equally true. Both domains carry the same five structural problems: values rounded to true or false at entry, new data types requiring a rebuild, history overwritten, provenance lost, and one table structure serving a clinician, a patient, a researcher, an auditor and a lender equally badly.

The domains differ in one way that favors building both. Independent evidence, the kind that did not come from the system's own answer, arrives in finance every month: a statement closes, a transcript arrives from a tax authority, an instrument clears. In health an outcome can take years. The financial record is the fastest place to earn calibrated weights, and because the trust model is shared, what is learned there is not learned twice.

THE ARGUMENT

How the record learns whom to trust

A weight is a track record: how often a source has turned out to be right about a particular kind of fact, faded toward the present, counted by how independent each judgment was, and held under a ceiling when the only thing agreeing with a source is the record itself.

Reliability is learned per source and per kind of fact

A hospital that sends reliable laboratory values may send unreliable medication lists. A bank feed that reports amounts to the cent may get dates wrong. One score per source averages those together and is wrong about both. The unit of learning is therefore the pair of a source and a kind of fact, and a source excellent at amounts and poor at dates carries two weights rather than one average of them.

Dividing a source that finely would normally be fatal, because most pairs have almost no data. The estimate for a thin pair is pulled toward that source's overall rate across every kind of fact, which is pulled toward the population's rate, which is pulled toward the registry's starting figure. Splitting a source into kinds of fact therefore costs nothing where there is no data to split. No prior is allowed to become a certainty, and a weight never reaches zero or one.

The population level is built and switched off by default. With it on, a source's weight can move because some other source was judged, and the record can no longer say why that weight changed from that source's own evidence. Explainability was worth more than the small statistical gain. Learning across records belongs in the evidence engine, behind the consent gate, where a new household or practice can inherit weights learned from far more outcomes than it holds.

Evidence fades

A source that was reliable two years ago and has drifted since should not keep coasting on old credit. Counts are discounted toward the present each period. At the default rate a comparison from six months ago counts about 45 percent as much as one from this week, and a pair remembers roughly 33 weeks of evidence. Without that, a source with ten thousand good observations takes years to be marked bad, which is the failure the model exists to catch. On a feed that silently broke while its registry entry still called it good, a record that counts every judgment forever still reads it at 0.570 three years later, where a fading memory has it at 0.436 and falling.

A judgment is counted by how independent it was

A judgment that moves a weight can come from three very different places, and after the fact nobody can tell them apart unless the record wrote down which it was. It writes it down, in three stored channels never merged into one count.

Because the channels are stored apart, a deployment that changes what a channel is worth recomputes every weight from the judgments rather than replaying its history. A discount alone does not solve the problem: discounting self-confirming evidence by any fixed fraction changes how fast a weight climbs and not where it ends. The fix is a ceiling, which holds a weight whose evidence is mostly self-confirming to what the independent channels support, and it is one-sided, so a source agreeing only 100 times in 400 still falls to 0.27.

Correlated sources are declared and counted once

If three clinics all pull the same figure from one regional exchange, they are not three witnesses. If two aggregator feeds draw from one bank's interface, or a feed and a statement come from the same core banking system, they are one. A product of per-source reliabilities treats them as separate, which is how a pair agreeing on the same wrong figure reads as 0.98 confident when 0.62 is warranted.

A deployment declares which sources share an upstream, and the group votes once at the weight of its most reliable member. The declaration is an asserted fact about the institutions rather than an inference from the data, because agreement alone cannot distinguish a shared upstream from two sources that are independently right. Statistical detection of copying works after roughly 48 to 220 records; declaring it is correct from the first.

Three things a conventional record has no way to attempt

Telling a biased source from a merely noisy one

A source can be bad in two ways that call for opposite responses. A noisy but honest source should carry less weight and still be used, because its errors scatter and averaging helps. A precise but biased source should be removed or corrected, because averaging it in moves the answer in one direction however many readings arrive. An agreement rate cannot tell them apart: a reading far from the truth fails the comparison either way. The sign of the errors can, and that is what the record tests, learning each source's precision from the residuals against an independent reference and taking their mean as the bias.

The test identifies the biased source and nothing else in 45 percent of runs at 100 records, 99 percent at 250, and at least 99.6 percent at every size from 500 on. Below 250 records the evidence does not yet separate a bias of 7 from noise of 9, and the test correctly stays its hand. The record's stated intervals stay honest the whole time, because the precision weights carry the protection before the removal does.

Refusing a correction that one subtraction would not fix

A source reading a constant amount high can be corrected and keeps all of its precision afterward. A source reading a fixed proportion high, or reporting in the wrong unit, cannot: one subtraction would leave it wrong at both ends of its range and right in the middle, and the fault would stop being visible. The record tests which case it faces, by the slope of the residuals as well as their mean, and refuses to correct when a constant does not explain the error. A source reading ten percent high shows a bias of 37 standard errors with a slope of 13; a source reading a constant 3 high shows 16.7 with a slope of minus 0.9, and only the second is corrected.

Counting two feeds from one upstream as one witness

A conventional record reports 0.98 confidence where 0.62 is warranted, and has no field in which to record the difference. The measurement is blunt about which tool does the work. On a correlated pair outvoting a good source, a conventional record settles 23.4 percent of contested facts wrongly; weighting every source by its true reliability, which nothing buildable can do, leaves the error exactly where it started at 23.4 percent; declaring the pair one witness takes it to 16.1 percent. Learning better weights accomplishes nothing there and the declaration accomplishes everything. Counting a family once does not recover a fact only that family witnessed: when the pair are the only witnesses and they agree, the figure stands, and what changes is that it stops reading as near-certain.

Where it buys nothing, stated plainly

Against ordinary scattered mistakes, learned weights buy almost nothing: 1.61 percent of contested facts settled wrongly against 1.63 percent for a conventional record, and weighting every source by its true reliability also gives 1.63 percent. When errors are independent and unbiased, the outcome of a vote among sources is decided by who agrees with whom, and no weighting scheme can improve on that. A deployment whose sources are all steady should expect little from the weights, and should want them anyway for the day one of those sources stops being steady.

Three further limits hold regardless. A corrupted value with no contextual signal and no conflict with the rest of the record cannot be found by any method. Weights learned without outcome data are guesses. And a weight moves only by evidence: no one sets a source's weight by hand to favor it, a manual change is a logged decision with a reason, and affiliated devices are weighed by the same rule as everyone else's.

THE ARGUMENT

What was measured

The central claim is a theorem. The gap between what a theorem makes possible and what a shipped program does was closed by measurement, against methods anyone can build, with every figure produced by the model that ships.

The theorem

For every question, every way of scoring the answer, and every prior belief, the best decisions available from an evidence-weighted record are at least as good as the best available from any binary record built from the same data, and strictly better whenever the discarded information would have changed the decision.

The proof takes three steps. The binary record is a function of the weighted one: apply the entry rule to each item and drop the rejects. Any decision rule reading the binary record therefore has a twin that reads the weighted record, computes the binary record itself, and returns the same action on every data set, at exactly the same risk. The best rule on the weighted record minimizes risk over a set containing every one of those twins, and a minimum over a larger set cannot be larger.

That is the simplest case of Blackwell's comparison of experiments from 1951: a coarsened observation is never more informative than the observation it came from, for any decision problem. In information theory it is the data processing inequality; in the philosophy of evidence, Good's principle of total evidence from 1967. There is no case in which a conventional record does better, and everything else is about how much better. The theorem applies with full force to data a binary schema never admits at all, such as a family history left in free text or cash income mentioned in conversation, where reliability was set to zero before any analysis could judge it.

Four methods, all buildable, at ten thousand records

Every comparison is against something a real system can run. Nothing was told which source was biased, and each run at a given size starts a fresh learner on a fresh history of that many records, with nothing carried over.

The third row is the method a competent team would reach for: learn each source's reliability, then use what you learned to turn the bad source's influence down. It is a real improvement over accepting everything, and it still ends 48 times further off, because turning a biased source down leaves the bias in the answer in proportion to how far down it was turned. What closes the gap is finding the source that is systematically wrong, removing it, and weighting what remains by precision. The influence-only method's stated ranges never held at any size either, so a method can be substantially more accurate than the conventional one and still report confidence that is not earned. At twenty-five records, where the margin of error is wide enough to cover a bias by accident, the three conventional methods held 65, 78 and 88 percent of their stated ranges; at a hundred, 5, 15 and 54 percent; from a thousand on, zero.

The one number above ours, and why nothing can reach it

Weight each surviving source by the inverse of its true variance and the error reaches 0.0245. Aitken proved in 1935 that this is the best any linear weighting can do, in two lines of Cauchy-Schwarz: the variance of a weighted average is minimized exactly when the weights are proportional to the inverse variances, and every include-or-exclude rule is a special case of weights set to zero and one. No binary rule built from the same readings can have lower variance.

The record reaches 0.0245. Nothing buildable can be told the true variance, because it is a property of the world rather than of any record; the bound appears as a yardstick for the weighting step, and standing on it means that step has stopped being the limiting factor. Getting there required learning the quantity the bound is stated in. Reliability and precision are different properties of a source, and a bound stated in one cannot be certified by measuring the other, so the record learns each source's precision directly, from the residuals between its readings and an independent reference. Being approximately right is cheap: the Kantorovich inequality of 1948 bounds the cost of imperfect weights, and weights off by up to a factor of about 1.4 either way cost at most 12.5 percent more variance than perfect ones, against 67 percent at any size for a binary rule that excludes weak sources carrying 40 percent of the information.

Where learning is decisive, and where the structure does the work

On a feed that was reliable and silently failed, the conventional record settles 51.5 percent of contested facts wrongly; outcome history takes that to 18.4 percent, where the best achievable by any weighting is 18.3 percent, so the record captures 99.7 percent of what was there to win. On a correlated pair outvoting a good source, the conventional record is 23.4 percent wrong, weighting every source by its true reliability leaves it at exactly 23.4 percent, and declaring the pair one witness takes it to 16.1 percent, so learning accomplishes nothing there and the declared structure accomplishes all of it. On ordinary independent mistakes, the conventional record is 1.63 percent wrong, the shipped model 1.61 percent, and weighting by true reliability 1.63 percent: nothing was available and nothing was taken.

The convergence, and the floor under it

Weights learned from outcome-linked items converge to the true values at the rate of one over the square root of the number of items that still count, which the fading memory holds to the recent past. As they converge the residual bias approaches zero, and the simulation shows the error in a learned error rate falling by roughly a factor of 3.2 for each tenfold increase in records. Underneath that sits a guarantee that bounds the downside rather than promising an upside. The family of weightings the record searches contains every binary rule, including the conventional one, and candidate weights are selected by a bounded proper scoring rule on separate validation data, which bounds how far they can fall behind the best binary rule by a margin that shrinks as validation data grow. Weights start at the conventional rule and move only as validated outcomes support the move.

What is proven and what is not

Three further limits are published rather than buried. A corrupted value with no contextual signal and no conflict with the rest of the record cannot be found by any method; weighting recovers nothing that was never observed. Weights learned without outcome data are guesses. And security has a boundary: an attacker who controls the running application can read what it reads for as long as the control lasts, and de-identified data is not anonymous.

The mathematics went out for an independent review

The mathematics was sent for independent review by a reader outside the company, instructed to attack it, and the review's findings are closed. A claim that has survived a hostile read is worth more than one that has not been read, and the reviewer's work is available to a prospective investor's own statistician.

THE ARGUMENT

One repository, licensed partitions

Every application in the suite reads from and writes to the same record, and none keeps a copy of its own. That removes a class of problem from the system, and it creates a second business: another company can license a partition of the same record and gain the storage, the integrity chain, the trust model and the security of the whole system without building any of it.

One record, and nothing to synchronize

Each record is the single source and repository of data for everything built on it. The patient app, the clinic system, the imaging platform and the evidence engine hold no records of their own: each writes the facts it produces into the record as events and reads back the views it needs. A laboratory result entered at a clinic and a symptom a patient reports to her guide land in the same log, under the same registry, with the same provenance fields.

There is no synchronization between applications because there is nothing to synchronize. Anyone who has run a practice on conventional software knows what the alternative costs. The practice management system has its own patient table, the portal has another, the imaging system a third, the billing clearinghouse a fourth, and an address change made at the front desk reaches two of them that afternoon, one overnight, and one never. The integration work in health care is largely the work of keeping copies of the same facts in agreement, and it is permanent, because the copies keep diverging.

Three rules keep it honest. Every finished clinical fact lives once, with images living once in the imaging platform and the record holding the report and a pointer. Every financial fact lives once, on the chain of the entity it belongs to. And applications never reach a store directly: they go through services that check role and consent on every call.

What a licensed partition is

The same repository is open to other companies under license. A licensee operates a partition inside the record: its own data, with its own encryption keys, its own trust settings, its own additions to the type registry and its own views. The walls are the ones the records already enforce between custody domains and between financial entities. Inside them the licensee gets the whole system:

• The append-only event log, with provenance on every value.
• The hash chain and its hourly outside anchors, so a rewrite inside the database is detectable even when every internal link agrees.
• The data type registry, so the licensee's own kinds of data are defined rather than forced into someone else's fields.
• The learned trust weights, with the basis channels behind each one.
• Lawful erasure that leaves every proof of the record's integrity valid, and the de-identified research path through the consent gate.
• Per-tenant, per-purpose encryption, so a stolen copy is unreadable.

Two rules govern the partitions, and they are the reason a cautious counterparty can sign. Data never crosses a wall on its own: if a person in a licensee's partition also holds a personal record, the two are linked only through the identity vault, only when the person authorizes it, and the link is a logged event. And a licensee's sources earn their weights from its own outcomes; nothing learned in one partition moves another's weights without consent on both sides.

Why that is a business

A company that produces health or financial data about people has a problem that has nothing to do with its product. It needs somewhere for the data to live that will satisfy a hospital's security review, a regulator's audit, a buyer's diligence and a plaintiff's lawyer, for as long as the data must be kept, which in health is decades. Building that is a program rather than a feature, none of it differentiates the company, and all of it has to be right.

The pricing assumption in the model is $250,000 a year for an average licensee, an assumption rather than a quoted price, and deliberately the least load-bearing line in the business at 1.4 percent of modeled 2031 revenue. The strategic value is larger, because every licensee is a source of independent outcomes, and those are the input the trust model cannot manufacture for itself.

Why it cannot be assembled from parts

Each component above exists somewhere as a product: an append-only ledger, a tamper-evident log, a key management service, a consent manager, a FHIR server, a de-identification tool. A competent team can buy all of them. What it cannot buy is a record in which they are the same object.

The integrity chain has to run over the same entries the applications read, or the archive drifts from the working record and the proof covers a copy rather than the data in use. The weights have to be computed from the same provenance fields the applications wrote, in one place, or two implementations disagree and neither can say which is right. Erasure has to be designed into the chain arithmetic from the start, because a chain built without it cannot later remove a subject's values and keep its earlier proofs valid. And the walls belong in the keys and the access rules rather than in application code, or a wall is a setting someone can change.

One engine owns what the two records share, down to the canonical encoding that gives every value one byte sequence however the database stores it, and a conformance suite covers the failures a record cannot detect from the inside, among them a consistent rewrite of the last entry that leaves every link and the stored head in agreement. Those decisions had to be made before the first application was written; a team assembling parts makes them after, in whatever order the parts allow.

Why the suite belongs together

A record on its own sells to nobody, for a reason specific to this design rather than a general argument about bundling. The trust model learns from independent judgments: a judgment about whether a source was right that did not come from the record's own answer. Those judgments are produced by applications, in the course of work people were doing anyway. A clinic system records what a treatment did. A patient app records how someone felt three days and fourteen days afterward. An imaging platform records what a reader found and what later proved true. A financial record records whether a statement reconciled, whether a transcript matched, whether an instrument cleared.

A record surrounded by applications has a continuous supply of those judgments. A record sold on its own has none, and its weights sit near their starting figures indefinitely, which makes it a well-built conventional record with extra fields. A source that silently breaks takes a record with no outcome history to 51.5 percent of contested facts settled wrongly; outcome history takes it to 18.4 percent.

The patient app is the clearest case. Most systems treat the patient as the last person to ask, and a patient reporting what actually happened after a treatment is the scarcest input the trust model needs.

The second reason is narrower and holds regardless of the first. One sign-in, one encryption system, one gateway to outside AI, one record engine and one set of tamper-evident logs, built once rather than six times. A company that built six products on six foundations would carry six security reviews, six key management designs and six audit stories, and would be slower at every one of them.

The economics follow the same loop. A clinic running the clinic system produces outcomes. Outcomes calibrate the weights. A record whose weights are calibrated is worth more to a research sponsor and more to a lender, which raises what each will pay, which funds more clinics. That is a claim about where evidence comes from rather than a platform story, and it is checkable: it predicts that accuracy improves with the number of independent judgments reaching the record, which the simulations measure.

THE SUITE

How the parts fit

Two lifetime records, eight applications, and one foundation under all of them. Each application is a product in its own right with its own buyer and its own price. Together they are the supply of evidence that makes the records accurate.

Why they belong together, for a reason specific to this design

Every application produces outcomes, and outcomes are what the record learns from. A clinic system records what a treatment did. A patient app records how someone felt afterward. An imaging platform records what a reader found and what later proved true. A veterinary practice records what a family saw at home a week later. A financial record learns every month whether a statement reconciled.

Those are the independent judgments the trust model needs and cannot generate for itself. A record surrounded by applications has a supply of them. A record sold on its own does not, and its weights sit near their starting figures indefinitely. The second reason is narrower and holds regardless: one sign-in, one encryption system and one record engine built once rather than ten times.

One guide, every product

One guide service runs the patient's guide, the pet parent's guide, the clinic's guide and the household's financial guide, with different tools, permissions and voices in each. Patients never see the names Holarc, NERD or Keelson. Voice is never required: every spoken interaction can be typed instead, and the typing window never covers what the guide is talking about.

The line that does not move

Across the suite, AI drafts, retrieves, checks and informs, and licensed people diagnose, prescribe and sign. My Talisman never diagnoses, never prescribes beyond over-the-counter products, and never judges a photograph of a skin spot. NERD advises and people decide. A reported laboratory value is never replaced or hidden by an estimate the record computed from it: the clinician reads what the laboratory posted, and reads beside it what the evidence says about that source.

The lifetime Evidence-Weighted Health Record

HOLARC

Holarc, the Living Health Record

Holarc keeps one record for each person, from before birth onward. Every health fact enters once, as a permanent event carrying what was observed, about whom, when, from which source and how far that source has earned trust. Nothing is overwritten and nothing is thrown away.

What a lifetime record has to survive

A person's health history is produced by institutions that never meet. A primary care office, three specialists, two hospitals, a laboratory, an imaging center, a pharmacy chain and the person themselves each hold a piece of it, in a system built to run that institution's day, keeping its own copy of the person. An address changed at the front desk reaches two of them that afternoon, one overnight, and one never. Connecting health care is largely the work of keeping copies of the same facts in agreement, and it never ends, because the copies keep diverging.

The second failure is quieter and does more damage. When a value lands in a conventional record, the system decides at that moment whether it is true and stores the winner. A clinic cuff, a wristband and a number the patient typed all become the same kind of row. The record cannot say which source it believed or what it rejected, so when a device turns out to have been drifting since January, nothing can say what it contaminated.

Holarc is built so that neither failure is possible. There is one record per person and no copies to reconcile. Every value keeps its source, its method, the time it was observed and the time it was entered, a link to the original down to the spot on the page, the confidence it was read with, and the weight its source carried at this kind of fact when the value was written. A reader also sees that source's weight now.

Events only added, views computed

Every piece of information enters as an event: this value, about this person, of this registered type, from this source, at this time, with this provenance and this weight. Events are only ever added. A correction is a new event pointing at the one it corrects, a retraction is an event, and a merge made in error is an event, so an unmerge separates the two records exactly and every view rebuilds correctly.

Everything anyone sees is a view assembled from those events: the patient's timeline, the clinician's chart as FHIR resources, a de-identified research set, a family graph, a time series for wearable readings. A view can be dropped and rebuilt from the log without touching the facts underneath, and a new application is a new view rather than a change to what is stored. Replaying the events up to a date reproduces exactly what the record said then, which answers the question conventional systems handle worst: what did the chart say on March 3, and why did it change. A clinician defending a decision, an auditor reconstructing a disclosure and a researcher barred from using later information all need that answer.

The event tables refuse updates, deletes and truncation at the database level, so an application fault or a careless administrator cannot quietly rewrite history. Working state stays out: schedules, drafts and claims in progress live in each clinic's operational store, and Holarc receives only finished facts, a signed note, a resulted laboratory test, a filled prescription.

What makes it different from a health record database

Three things, each of which a conventional record has no field in which to attempt.

The last of those keeps the first two honest. A clinician who accepts a value may have had that value's weight on the screen in front of them, so the acceptance counts for a quarter, and a weight whose evidence is mostly self-confirming is held to what the independent channels support.

What the measurements show

Four regimes were run against the shipped model, with nothing told which source was bad, against a conventional record built from the same data.

The fourth row is the strongest evidence that the first three are honest. Against scattered independent error, weighting every source by its true reliability also gives 1.63 percent. The conventional record is already doing as well as anything could, and Holarc matches it rather than degrading it. A record promising a general accuracy improvement from learned weights would be overselling them.

Who it serves, and through which door

Patients never touch Holarc directly and never see its name. Each door carries a different consent and a different view.

Why everything else in the suite writes to it

The trust model learns from independent judgments, meaning a judgment about whether a source was right that did not come from the record's own answer. Those judgments are produced by applications, in the course of work people were doing anyway: a clinic system records what a treatment did, a patient app records how someone felt three days and fourteen days afterward, an imaging platform records what a reader found and what later proved true.

A record surrounded by applications has a continuous supply of those judgments. A record sold on its own has none, and its weights sit near their starting figures indefinitely, which leaves it a well-built conventional record with extra fields. That is a claim about where evidence comes from rather than a story about bundling, and it is checkable: it predicts that accuracy improves with the number of independent judgments reaching the record, which is what the 51.5 percent against 18.4 percent result measures. The narrower reason holds regardless: one sign-in, one encryption system and one record engine, built once rather than six times.

The lifetime Evidence-Weighted Health Record

HOLARC

What the record holds

Every kind of health information about a person, across a whole life, from any source, with nothing discarded. Beside the record sits a store of graded medical knowledge that holds no patient data at all.

A whole life, starting before birth

A Holarc record can begin before the person does. During pregnancy the record is the mother's, and at birth the child's record is created already linked to hers, so the child starts life with family history in place and the link never depends on the temporary name a hospital gives a newborn. From then on the record grows with the person, and nothing is removed except by lawful erasure.

A record that spans a life is a different object from a record that spans a visit. A visit-by-visit record answers what happened at the visit. A lifetime record answers questions nobody can ask of a visit: whether this patient's creatinine has been climbing for six years or stepped up last spring, whether the knee that hurts now is the knee imaged in 2019, whether a medication started for one condition is the reason a laboratory value drifted, whether the hypertension diagnosis was ever supported by readings taken outside a clinic room. Each of those is a trend question, and a trend cannot be reconstructed from documents written one at a time by institutions that never compared notes.

What arrives

The original of every document is kept, write-once, and any value read from it links to the spot on the page it came from. Very large data with its own shape, such as years of per-second heart rate or a whole genome, is referenced from the event log and held in a store built for it.

The registry: a new kind of data without a database change

In a conventional system a new test, a new wearable metric or a genome means new tables or columns, a schema change with downtime, and edits to every program that reads them. The usual response is to push the new data into free-text notes or scanned attachments, where nobody can analyze it. A clinician who wants a number charted learns to type it into a note, and from that moment the number exists and is invisible.

Here a new kind of data enters through a registry entry and the database structure does not change. Every event has the same outer shape: who, what type, when, from where, how trusted, and a payload, and the registry defines what a valid payload for each type looks like. An entry states:

• What the type measures, in plain words.
• Its standard code where one exists: LOINC for laboratory tests, SNOMED CT for conditions, RxNorm for medications, DICOM for imaging.
• Its unit, and conversions from the other units it arrives in.
• The range of plausible values, so a typo or a misread photograph is held for review rather than landing.
• The method or device, when that changes what the number means.
• Its starting trust weight by source class.
• Its version, so a definition can be refined without changing what older events meant.

Adding a type takes a definition and a person's approval, and intake accepts the new data that day. A type with no standard code is registered locally and mapped when a standard one exists. Anything intake cannot map is kept and held for a reviewer, never dropped and never forced into the wrong field.

The types it ships with

Forty-six approved types cover what a deployment needs from its first day.

A worked entry, for a hemoglobin A1c: the type maps to LOINC 4548-4, reports in percent, converts from millimoles per mole by a stated formula, holds anything outside 3.0 to 20.0 for review, and starts a certified laboratory at a weight of 0.95 and a value the patient typed at 0.6. Those two figures are the published illustration; a deployment's tuned weights, prior strengths, decay rate and declared source families are trade secrets and appear in no published file. Still ahead: full terminologies rather than mapped subsets, sensitivity labels, and specimen-aware mapping so a urine glucose can never map to a blood glucose.

Beside the record: graded knowledge, no patient data

Medical knowledge is kept in a separate store holding no patient data: papers, drug labels, guidelines, trial listings and literature on care outside conventional medicine, each with its source and retrieval date, and summaries tied sentence by sentence to that source. Every guide in the suite reads from it, and so does the evidence engine.

It grows from what patients raise, without carrying anyone's identity. A patient's question brings in a topic. If the library holds that topic and the entry is fresh, the guide answers at once. If the entry is missing or stale, a research job searches by topic words only, with identifiers stripped, and writes what it finds; the evidence engine then scores it. The next patient with the same concern gets the answer immediately, with a reference on every statement. Three stores stay separate: the patient record, under identity and consent controls; the knowledge library, read by every guide; and the scored claims formed from the library and from population data.

What a complete record makes possible

Four things a visit-by-visit record cannot support.

The lifetime Evidence-Weighted Health Record

HOLARC

Any format in

Any record a hospital system, laboratory, imaging center, device or person produces goes into Holarc as it is. Intake works out what it is, whose it is, and where each value belongs, and records where every value came from and how sure it is of what it read. If a person could read it, intake accepts it.

Why intake is the hardest part of a health record

Health records fail at the door. The parts that get built are the satisfying ones: a schema, a chart screen, an interface specification. The part that decides whether the system is worth anything is the part that takes in what the world actually sends, which is not what the specification describes. What the world sends is a faxed printout with a coffee ring on it, a phone photograph of a discharge summary taken at an angle, a spreadsheet export whose column headers changed last quarter, a laboratory message that differs from the standard in four undocumented places, and a care summary whose medication section is empty because the sender did not populate it. Every one of those is a normal Tuesday, and every one has to end up as a coded value with a unit, attached to the right person, with an honest statement of how confident the system is.

Most records never get the data in, because the alternative looks cheaper at every decision point. Requiring the sender to convert first is cheaper than reading what they sent. Dropping a file that will not parse is cheaper than keeping it. Guessing which patient a document belongs to is cheaper than a review queue. Together those choices produce the system everyone recognizes: a well-designed structure with almost nothing in the structured fields, and the real history in a folder of scans nobody can query. Holarc takes the opposite decision at every one of those points.

What it reads

How a value becomes a fact

Every drop passes the same seven steps, and ends in a sealed report naming what landed, what waits and what failed.

1. Receive. The original is archived first, sealed, and stored under the fingerprint of its bytes, with who sent it, when, and under what authority: a business associate agreement, a patient's authorization, the patient themselves, or a device during treatment.
2. Recognize. A file is identified from its bytes rather than its name, and standard formats are parsed by fixed rules. Zipped folders are unpacked within their limits, each file handled on its own.
3. Read. Structured files are parsed field by field. PDFs, faxes and photographs are read by text recognition, tables included, and every value is tied to the region of the page it came from.
4. Map. Each value is matched to a registered type and a standard code. The first file from a new source gets a mapping a person approves once; that becomes the source's profile, and every later file from it maps on its own.
5. Identify. Each record is matched to exactly one person, under rules that refuse to guess.
6. Score. Each value gets two numbers: how sure intake is that it read the value correctly, and how far the record trusts whoever produced it for this kind of fact.
7. Route. Values that pass enter the event log. Anything that cannot be matched to a person, fits no registered type, has no unit, falls outside its plausible range or below the confidence threshold goes to the holding bay. Each file runs in its own savepoint, so one corrupt file never rolls back the rest.

The checks catch the failures that matter rather than the ones that are easy to catch. A number must fall in its type's plausible range. A declared unit converts by the registry's formula, with the original kept beside the converted value, and a value below range that would make sense in another unit is held with that suggestion attached. Diastolic must be below systolic. A value from weak evidence sitting more than two and a half times above or below the person's own median is held, which catches a height of 67 entered in centimeters and a recognized creatinine of 10.9 that should read 1.09. A fasting glucose collected within eight hours after a logged meal is flagged and kept out of fasting trends, rather than quietly becoming a diabetic-range result.

A document that arrives as a photograph

A phone photograph of a laboratory report is a normal input. Intake detects its orientation, straightens and cleans the image, reads it and keeps it, and a value read from it carries the exact region of the image it came from, so the number and its evidence stay together.

When confidence is low, the value neither enters the record nor disappears. A reviewer sees it beside the crop it was read from and confirms or corrects it with one click, and every confirmation measures reading accuracy, so error rates become known by source and format rather than assumed. In the photograph test the recognizer read "Hemoglobin A1c" as "Hemoglobin Alc"; intake matched it to the registry with a confidence penalty, and a glucose line read at 0.81 confidence waited for a reviewer, as intended.

That path also produces the measurement a record needs about its own reading. When a laboratory feed reports a hemoglobin A1c of 5.8 and a photograph of the same report reads 5.3, both are kept, the laboratory outweighs the photograph, and the disagreement counts against the photograph reader's learned weight for laboratory results. The reader's accuracy is a running measurement the record takes of itself rather than a vendor claim.

An AI document reader for handwriting and unusual layouts is built and ships switched off. It turns on after its error rate is measured against reviewer-confirmed values, and it reaches a model only through the suite's gateway, which strips identifiers, checks consent and logs the call.

The holding bay, and the human review path

Nothing that arrives is lost. Records intake cannot place wait in the holding bay with their original file, the reason they are waiting and a suggested answer, all sealed at rest. A steward clears the bay, each item is decided once under a lock, and every decision is a row in an append-only table under that steward's own token. That approval path is the difference between a record that accumulates data and one that accumulates data it can use: the first file from a new laboratory takes a person ten minutes, the ten thousandth takes nobody any time, and every value in it carries the provenance the first established.

What intake never does

• It never guesses a person's identity when the match is uncertain.
• It never changes an original file or creates a value the source did not contain.
• It never discards a file because it could not read it.
• It never accepts data without recording who sent it and under what authority.

Every original is kept unchanged, stored by its fingerprint and sealed, so any number can be checked against its source years later. An original is deleted only by lawful erasure, and only when nothing else refers to the same bytes.

The lifetime Evidence-Weighted Health Record

HOLARC

One record per person, and who may see it

Each person gets exactly one record. Two failures threaten that: a duplicate that splits one person across two records, and a false merge that puts two people into one. The design guards against the false merge first, because it puts one person's allergies and medications into another person's chart.

The identity vault

Every person receives an identifier that is a random number and means nothing outside the record. It is never a Social Security number and never built from one. Names, birth dates, addresses, phone numbers and every outside identifier live only in the identity vault, and the clinical event store sees a random token. A breach of the records exposes no names, and a breach of the vault exposes no records.

Each field in the vault is sealed on its own, bound to its row. Exact-value searches go through blind indexes, meaning keyed hashes under a separate key purpose, so the ciphertext is never searched and a copy of the database taken without the keys opens nothing.

How an incoming record finds its person

Most identity confusion comes from outside identifiers rather than names. A clinic knows a person by its medical record number, an insurer by a member number, a device by a serial number. The vault keeps a crosswalk from each of those to the one record, so once a clinic's number is linked, every later record from it matches exactly.

1. Exact match first. A record carrying an identifier already in the crosswalk goes to that person.
2. Identified at the point of care. At a device or a clinic the patient presents a code from their own application, or staff look them up and confirm, so device results never need a guess.
3. Scored match for everything else. Records with no known identifier are scored on name similarity, birth date, sex, address, postal code, phone and email, allowing for spelling variants, nicknames and moves. This is standard probabilistic matching, used in hospital patient indexes for decades.
4. Three outcomes. A high score links automatically. A low score starts a new record. Anything in between goes to a reviewer and, where possible, to the patient, whose application asks whether the visit was theirs.

Some rules no score can override, because the cost of the two errors is not symmetric. A match on name, birth date and sex alone never links automatically; a phone, email, address or postal code must also agree. A different given name, a different sex, a suffix conflict, a near birth date, or a close second candidate all send the record to review. Identifiers from sources that cannot be named are never used for matching.

Details typed into an application never link automatically however strong the match, and a steward's decision that two of them are the same person records the link and nothing else. Access to the record on file is a separate step requiring proof of control.

The cases that break matching

Because the record only adds, a merge is a recorded entry and so is an unmerge, which separates two records joined in error exactly and lets every view rebuild correctly. Only a steward may do either, and the automatic-link threshold is set so doubtful cases go to review, trading a few more duplicates for fewer false merges.

On the invented 519-person population the matcher scored 62,296 candidate pairs, linked 2,229 of the 2,257 true same-person pairs automatically, sent 14 pairs to review, and made no false merge. Matching accuracy on real records is a publication owed before sale, because an invented population is not evidence about real names.

Verified identity, and who may act for whom

The design anchors every record to an identity verified to the federal standard for assurance level 2, which the federal record-network program requires before a patient application may pull records. Today patients sign in with a one-time code sent to the contact on file, staff with a hardware security key, and proxy access runs through a proofing adapter on a simulator until a service is contracted. Proofing for every patient at sign-up is planned before real patients.

A proxy, meaning a parent for a minor child, an adult granting access, or a legal representative, is a recorded link between two records, each with its own identifier, and one person's data never moves into another's. Proxy access for a minor ends at eighteen, and records a minor may lawfully keep from a parent are withheld. Those limits differ by state and by the kind of care, so they sit in the consent engine rather than in an application.

Two custodians over one set of events

A clinic is the legal custodian of its chart. It must keep it, seven years for adults in California and at least a year past a minor's eighteenth birthday, and take all of it when it leaves. The patient owns the personal record, and a copy of each finished clinic record flows into it under the patient's federal right to direct copies to an application of their choice.

The personal domain can be erased without touching the chart. Clinical codes flow into a claim one way when it is built and are never copied back, and nothing in a clinic's accounts or books has a query path to the record, to research or to another clinic. A clinic may hold its own master key, and operator access is logged for its administrator.

What a clinic sees against what a patient sees

A clinic sees its own chart and the outside records the patient approved that clinic to see. Its staff token reaches only the people on that clinic's rosters, on every route alike, so a clinic cannot browse the deployment. A patient sees their whole record, every consent they signed, their dependents under a recorded legal basis, and a log of every read, allowed or refused, naming who looked, why, and which application they used. Refusals are logged as well as permissions, which makes that log worth showing: a patient who can see who read their record can tell whether their consent is being honored.

How a licensed partition is separated

Another company can operate a partition inside the same record: its own data, its own keys, its own trust settings and its own views. The walls are the ones already enforced between custody domains rather than new code written for the licensee, which is the only reason they can be trusted. A wall that exists as an application setting is a wall somebody can change. Data never crosses one on its own: a person in a licensee's partition who also holds a personal record has the two linked only through the identity vault, only when they authorize it, and the link is a logged event.

The lifetime Evidence-Weighted Health Record

HOLARC

Connecting to the systems that already hold the data

A lifetime record is only as complete as what reaches it, and almost everything that should reach it is already sitting in somebody else's system. Holarc owns the exchange interfaces for the whole suite: one implementation of each standard, used by every product, rather than each product writing its own.

A record that cannot connect is worth nothing

The data a person needs in one place is produced in a hundred places, and none of them will send it anywhere new. A hospital will not build a custom feed. A reference laboratory will not change its message format. A regional exchange will not add an interface for a record system with no customers. What they will all do is answer the standard interfaces they are already obliged to answer, because federal rules require certified systems to offer them.

That obligation is the whole opening. A patient can direct any certified system to release records to an application of their choice, and the information-blocking rules make that a request the system must honor. A health plan must offer a patient access interface. A record network answers a query for a person's documents. A laboratory sends results in a format defined thirty years ago that every laboratory still speaks. A record implementing all of that arrives at a new clinic already able to pull the patient's history; one that does not arrives asking the clinic to type it in, and loses.

The cost is why most records skip it. Each interface is a specification of hundreds of pages, a conformance test suite, a partner contract, and a long tail of other people's implementation quirks. It is also the part a competitor cannot route around.

What each interface is, in one sentence

The standards interface in detail

Read and search are served for patients, allergies, conditions, medication requests, observations covering laboratory results and vital signs, immunizations, procedures, encounters, document references with the original behind them, and diagnostic reports. Search parameters follow the required server behavior for each resource type. A patient resource carries the canonical record identifier even after merges, every other resource carries the identifier of the event it was made from, and corrected values are served as the correction. The interface is read-only, which is deliberate: data enters through intake, where it is identified, mapped, scored and recorded with its provenance, and a write interface would be a way around all of that.

Every resource Holarc serves carries an evidence extension with five parts: the source, that source's learned weight now, the weight it carried when the value was written, the extraction confidence, and the method. A blood pressure panel carries it on each component. That extension makes the evidence-weighted record visible to any standards-compliant client without that client knowing anything about Holarc, and it is how an outside application gets the one thing no other record can give it.

Authorization is enforced three ways at once. A scope grants read and search on a named resource type for a named subject class. A patient's token is always held to that patient's own record, so a token naming someone else grants no context rather than the wrong context. A clinic's token reaches only the people on its rosters. Every read and refusal goes to the person's access log, naming the user and the application. Bulk exports fix their population at kick-off, check consent for each person as the job runs, name anyone whose consent no longer covers the read, and seal and expire the output files.

Inbound: everything becomes a document, and a document becomes evidence

Records arriving from outside never enter directly, whatever route they came by. A summary pulled from a record network, a document sent by secure message, a faxed printout and a file a patient uploads all take the same intake path: read, mapped to registered types, matched to one person, scored, and either entered with its provenance or held for a reviewer. The sending institution becomes a source like any other, with a weight learned from outcomes rather than assumed from its size.

Nothing from secure messaging or fax enters the record until a steward files it, and each inbound document is decided once. Senders, fax numbers, subjects and attachment names are sealed, and the attachments go to the sealed archive. A network query records its result as complete, partial, no match or error, with identifiers and counts only, and one community failing never stops the others. Where a network returns more than one candidate person, nothing is pulled from that community at all.

What runs against a simulator today, stated plainly

Every outside network sits behind one adapter. The simulator is the default, and it behaves like the real network, rejections and error codes included: synthetic communities with a document to find, a registry that fails a query, and a network whose answer arrives in a different format. The real adapter for each network exists and refuses to run until the thing it waits on is in place, naming what that is. A deployment switches one network at a time, after that partner's contract and onboarding.

What that means for a reader evaluating this: the interfaces Holarc serves, meaning the standards interface, the document standard and the two exports, are built and need no partner. The interfaces Holarc consumes, meaning the record networks, secure messaging, fax and the immunization registries, are built and have never spoken to a real counterparty. The messages they produce are the real shapes, down to the envelopes and acknowledgment segments, and the simulator rejects malformed ones. That is not the same as having exchanged a record with a real institution, and the difference is a contract and a conformance test rather than more code.

Four things wait on something other than code. A consent screen for patients authorizing an outside application. A network partner, a secure messaging carrier, a fax carrier and state registry onboarding. Federal certification testing against a deployed instance, including the document validator and the conformance kit. And a certified measure engine, which cannot be substituted.

The lifetime Evidence-Weighted Health Record

HOLARC

Tamper evidence and lawful erasure

A lifetime record is relied on by people who were not there when it was written: a physician reading a laboratory history, an auditor, a court years later. It has to prove nothing in it changed after it was written, without exposing anyone else's data, and keep proving that after the law requires part of it to be deleted.

Two requirements that usually cancel each other

The ordinary way to prove a record was not altered is to make it immutable. The ordinary way to satisfy a privacy law is to delete what a person asks to have deleted. Those instructions point in opposite directions, and most systems abandon one: a record on immutable distributed storage cannot honor an erasure request, and a record built to delete freely cannot prove anything about its own history. Holarc holds both, and the decision that makes it possible is to commit to each value through a salted digest rather than the value itself. The chain links survive the removal of the content they were computed over, so a person's data can be erased while every proof issued before the erasure stays valid.

That is also the reason a blockchain is not used. A blockchain guarantees an entry was not altered after it was committed, which Holarc needs, and says nothing about whether the entry was true when it was committed, which is the question an evidence-weighted record exists to answer. Immutable distributed storage also works against the erasure state privacy laws and European law require.

How the chain works

Each event carries a cryptographic fingerprint of itself and of the event before it. The content fingerprint covers a canonical encoding of the body together with thirty-two random bytes generated fresh for that event, and the link covers the previous event's link and that fingerprint. A link can therefore be checked without the body, which lets the chain survive erasure, and any change to a past event breaks every link after it. The fingerprint covers the plaintext before the value is sealed, so rotating keys changes no fingerprint, while a ciphertext swapped between rows fails its authenticated decryption and shows as a broken link.

The random bytes are not decoration. A birth date, a postal code or a diagnosis code has few enough possible values that anyone holding a plain hash of one could test them all; with random bytes mixed in, and those bytes deleted at erasure, that test is impossible. The hash function is the one national cryptographic policy requires for long-lived data.

The head is anchored outside the database

A chain living entirely inside a database defends against a careless administrator and not a determined one. Someone with full control can rewrite an event and recompute every fingerprint after it, and the result is internally consistent. What catches that is a copy of the chain's position held where the database owner cannot reach.

Every hour the record verifies its chain locally and posts four numbers to the anchoring service: the height, the head fingerprint at that height, a Merkle root over every event fingerprint, and the tree size. The service refuses another product's credentials for this namespace, a tree smaller than the last it holds, a second root for a size it holds, and a different head at a height it holds. Each refusal is a rewrite caught at the door.

It signs each anchor twice, with a classical signature and with the standardized quantum-resistant signature, and both must hold. Anchors are chained to each other and written to an append-only ledger file on a separate volume, which the nightly encrypted backup carries off the host, and each can be timestamped by independent authorities so its date rests on no single party. Anyone holding that file and the two published keys can check every anchor offline, with no database, network or secret. Moving the signing keys inside hardware waits on hardware support for the quantum-resistant algorithm.

A consistent rewrite of the most recent event leaves every link and the stored head in agreement, so the database alone cannot catch it: the local verification passes and the anchor check fails. Both outcomes are asserted in the tests, so nobody reads a green local verification as evidence of a sound record.

Proving one record without exposing any other

An auditor, a court or an insurer asks about one record, and showing them the chain would show them everyone. A single-record proof answers without that exposure. It holds the event's fingerprint, its content fingerprint, the previous link, the Merkle audit path up to the newest anchor covering it, roughly twenty fingerprints for a record of a million events, and the signed anchor, and it can carry that record's body and random bytes decrypted so the reader checks the content as well as its position. No other record's content, identifier or fingerprint appears in it. One offline script checks a proof from either record in the suite, and both implementations produce identical bytes for the same input, which makes a proof portable rather than a thing only the issuer can read. A record since erased can still be proved to have been present and never disclosed, which answers what an auditor asks about a deleted record: whether the deletion was a deletion or a cover-up.

Lawful erasure

An erasure runs under a stated legal basis, with a reference and an actor recorded, and covers every record resolving to the same canonical person. In one transaction the system marks the person erased, blanks each of their events including values, text, units, dates of service, source and authority, deletes the random bytes, writes one chained erasure event naming the rows and the basis, clears the vault, and removes values of theirs still in the holding bay. Each blanked row keeps its sequence, identifiers, times, content fingerprint and link, so the chain still runs through it. Original documents are deleted after the transaction commits, and only those nothing else refers to. Every earlier anchor and proof stays valid, and a proof made after an erasure can show the row was there and never what it said, because the random bytes are gone and no guess about an erased value can be tested against its fingerprint.

Verification is specific about the ways an insider could try to erase quietly. A run fails on a changed value, a recomputed fingerprint, a broken link, or a head or Merkle root differing from an anchor. It fails on an erased row that is not fully blank, or that no chained erasure record written after it names, or on an erasure record listing rows written after itself or leaving a live row of its own token unmarked, so no single row can be erased on its own. The database permits the erasure update only inside a transaction that declares itself, and only one that blanks content and keeps every chain column.

What a chain proves, and what it does not

A hash chain proves that what was written has not been altered, and says nothing whatever about whether it was true. A chain will attest with perfect fidelity to a laboratory result that was wrong, a diagnosis that was mistaken and a reading from a device drifting for eight months. Integrity and accuracy are different properties, and conflating them is the standard error in how this kind of system is sold. Accuracy is what the trust model answers, which is why the two mechanisms sit side by side: the chain fixes what was written, and the weights say how far each writer has earned belief.

Four further limits, stated rather than left to be discovered:

• It proves a change happened. It does not stop someone with full control of the database from making one; it guarantees they cannot hide it once the record was anchored.
• Events written since the last anchor are protected only by the chain inside the database, a window of at most an hour.
• Erasure removes content from the live record at once. Copies already in encrypted backups stay readable to whoever holds the keys until those backups age out. Per-person keys, which would make destroying one key render every copy unreadable at the moment of erasure, are designed and not yet built, and are what closes this gap.
• Images in the imaging store are counted in an erasure result and not yet removed by it. Public health submissions and the accounting of disclosures survive an erasure, because the law requires them kept.

The lifetime Evidence-Weighted Health Record

HOLARC

The Holarc market

Holarc sells access to a platform and never sells records. Its customers are the device companies, clinics, application companies and research sponsors that pay to work on it. The figures below are published estimates and institution counts rather than a commissioned study.

Where the value moved

Retrieving a person's records used to be the hard part, and it is becoming cheap. The national exchange framework passed one billion records exchanged in June 2026 across eleven networks. The federal aligned-network program, which requires standard interfaces and verified digital identity, began going live between April and September 2026, and a patient's right to direct any certified system to release records to an application of their choice is enforced by the information-blocking rules. When retrieval is commoditized, the value moves to whoever holds original data from the source, keeps it continuous for the person, and can say how far each piece can be trusted.

Clinics are the bottleneck rather than patients: by April 2026 more than 700 companies had pledged to the federal program and fewer than 50 provider organizations had. Holarc reaches patients through clinic software and devices, the side of that gap with less competition in it.

Demand for what a record enables is not in question. ChatGPT receives about 300 million health questions a week, and Microsoft more than 50 million a day, all from people asking medical questions of a system that knows nothing about them.

Sizing, and what the published numbers are worth

Published estimates for the personal health record software market alone run from under $50 million to over $6 billion depending on where the definition is drawn, so the plan rests on none of it. The segments Holarc sells into directly are larger and better measured.

Research firms define these markets differently, so each line is a range between the low and high published estimate, several overlap, and adding them together would count some spending twice. Counts of institutions are harder to argue with than market sizes built on other market sizes.

Those counts come from Definitive Healthcare, the federal payment advisory commission's March 2026 report, DPC Frontier, and the GCC Statistical Centre.

What investors pay for one layer of this

A better guide is what buyers have paid for companies owning one piece of what Holarc combines.

None of those six owns more than one layer. The record under them is what each has to buy, build or do without.

Who pays, and for what

Holarc prices the platform and never the records. Federal privacy law treats payment in exchange for health information as a sale requiring each patient's written authorization, so there is never a per-record price. That constraint is also the strongest commercial position available: a counterparty worried about where its patients' data will end up is relying on a rule the vendor cannot profitably break.

The device license is the one with no competitor. An aggregator receives what another system chose to send, usually a summary written after the visit. A connected device writes its own settings, its completion report and each patient response where they are created, into a record already holding that patient's laboratory results, imaging, medications and history. The company ends with scored evidence across every patient it treated, produced under rules it does not control, which is worth more to a regulator than evidence it graded itself. What makes that acceptable is the rule on methods: algorithms, settings logic, treatment curves and reconstruction methods stay on the company's own servers, because the record stores the result of using a method and never the method. The company keeps its trade secret and gains a long-term outcome record without building a record system or a compliance program.

The licensed-partition business

Another company can license a partition of the same record: its own data, keys, trust settings, registry additions and views, inside the walls the record already enforces. A company producing health data about people has a problem unrelated to its product. It needs somewhere for that data to live that will satisfy a hospital's security review, a regulator's audit, a buyer's diligence and a plaintiff's lawyer, for as long as the data must be kept, which in health is decades. Building that is a program rather than a feature, none of it differentiates the company, and all of it has to be right. The model assumes $250,000 a year for an average licensee, an assumption rather than a quoted price and deliberately the least load-bearing line in the business at 1.4 percent of modeled 2031 revenue. The strategic value is larger, because every licensee is a source of the independent outcomes the trust model cannot manufacture for itself.

The research answers business

Researchers bring questions. The analysis runs inside the walls on consented, de-identified data, and the answer comes out with every result checked before release so no small group can be singled out. Records stay where they are, which keeps patients, clinics and regulators on the same side of the question and means the research business is not traded off against the privacy position. The model assumes $150,000 for an average engagement. Null results are flagged, kept and earn the same credit as positive ones, and conventional care, alternative care and the suite's own affiliated products are scored by the same rules, which protects the record's standing as an honest broker and the affiliated products from the charge that their evidence was graded on a curve.

Who else is trying, and what they do not have

The aggregators are competitors and likely suppliers at the same time: the plan buys retrieval from them and competes above it.

Among the competitors reviewed, none weighs each value by a learned reliability for its source, and none writes into the patient's record at the point of care and measures device outcomes against it. Candidate patent families cover the learned trust weight per source and kind of fact, the fading memory, declared source families, the device outcome loop and split custody in one record.

The patient's own app and guide

MY TALISMAN

My Talisman

My Talisman is the patient's own app and voice guide, and the front door to their lifetime health record. It gathers records from anywhere, tracks medications and supplements, prepares patients for visits, answers medical questions with graded evidence, and carries the whole family. It informs. It never diagnoses and never prescribes.

The patient is the most complete source in health care, and the scarcest one

A person's health history is produced by institutions that never meet. A primary care office, three specialists, two hospitals, a laboratory, an imaging center and a pharmacy chain each hold a piece of it. Only one party was present at every encounter, knows which supplements are in the cabinet, and can say whether the treatment worked. That party is the last one anybody asks.

Giving the patient a guide over a lifetime record turns that around. A record that reads any format, carries the whole family, pulls from the national networks and connects to any clinic makes the patient the most complete source in the system rather than the least reliable one. Claims data arrives late and describes billing. A clinic note describes what the clinician concluded, which is the system's own answer coming back to it. A patient check-in on day 3 and day 14 after a new medication describes what happened to the person, an independent judgment the trust model under the record cannot manufacture for itself.

What the app does

The patient talks or types to a guide that already knows their whole history and does the work of staying healthy with them.

Medication tracking covers prescriptions and supplements together, and a new diagnosis triggers research before the patient asks: a plain overview, treatments with their evidence strength, and recruiting trials filtered for that patient.

Sign-up needs no app

A clinic sends an invitation by text, email or QR code, and it opens in any browser. The patient signs in with a one-time code sent to the phone or email the clinic already has on file, and the guide walks them through demographics, insurance card photographs, intake forms, consents and signatures as they go. The account then exists against one record identity, and installing the phone app later signs into the same account with everything already in it.

That removes the step where patient engagement products lose most of their users. A front desk that can send a text message can enroll a patient, and the guide finishes it rather than the staff.

It never depends on the clinic

My Talisman requires no portal connection and no cooperation from the patient's doctors. The record is assembled from the networks, the certified patient interfaces, claims, uploads and devices whether or not a provider in it has heard of the company. Patients of practices running competing systems are served identically.

When a patient's clinic does run Arca, the clinic functions switch on inside the same app under the clinic's own logo: booking, intake forms and consents, released results, secure messages, bills, refills and video visits, plus access for a parent or caregiver after identity proofing. The clinic gets a modern portal it did not build and the patient gets one app instead of five. Arca never requires a patient to install anything, and My Talisman never requires a clinic to buy anything.

Wellness plus, and the line it does not cross

My Talisman is a wellness product with more reach than wellness products have had. It explains conditions, research and treatment options including experimental ones, tells the patient what to ask their doctor, flags interactions, and says when a symptom means going to an emergency room now. It never diagnoses, never rules a condition out, never prescribes or recommends anything beyond over-the-counter products, and never tells a patient to start, stop, skip or re-time a prescription.

The line is held by two layers rather than by a prompt. Emergency rules read what the patient said before anything else happens, and a model layer may raise the urgency and can never lower it. An answer filter then reviews every answer, spoken or typed, before the patient sees or hears it, and replaces any sentence that crosses the line. The filter reads each sentence for who it is about, whether it hands the question back to the doctor, and what a negation covers, so "don't stop taking it without asking your doctor" passes and "don't take your metformin tonight" does not.

Every feature is classified against the federal general wellness and clinical decision support guidance before it is built, and is designed so it can move into a cleared path later rather than be rebuilt for one. The regulated claims in this business belong to licensed people and cleared devices. The guide earns its place by being the best-informed non-clinician in the room.

Who pays

Patients never pay to own their data, and records are never sold, rented or transferred. Organizations pay for the app, the guide and the record behind them.

Prices are set with the first partners during the pilot. My Talisman stays one product on one code base, so every branded edition carries the next improvement to all of them.

The patient's own app and guide

MY TALISMAN

The guide, by voice or text

Every patient meets a guide with its own name and voice, one that knows their whole record and never asks them to repeat their history. Anything the patient can say they can type, and the typing window never covers the screen.

A guide the patient names

During intake the guide suggests a name suited to that patient and offers alternatives, so two patients rarely meet the same guide. The sample patient's guide suggests Wren. The patient can take it, pick an alternative, type a name or say one out loud, and can rename it at any time. They choose a male or female voice at setup and can switch whenever they like.

The naming is not decoration. A health product's hardest problem is that nobody opens it when they are well, and the thing people return to is a relationship rather than a dashboard. A guide with a name the patient chose, a voice they picked and a memory of every conversation is something a person talks to. The brand pack carries the organization's logo and colors; the guide's name and personality stay the patient's, so a clinic that changes software does not take their guide away from them.

When asked what it is, the guide says it is an AI. It never presents itself as a person or a doctor, in any edition, under any brand.

Three habits

1. It knows without being told. The patient never repeats their history, never re-enters a medication list, and never explains which specialist ordered which test.
2. It has done the work before it is asked. The morning brief connects things nobody has connected yet: a ferritin falling across three draws, a supplement added Monday that interacts with a thyroid prescription, a child's immunization due.
3. It speaks up at the right moment. A check-in on day 3 and day 14 after a new medication, a screening that is due, a visit tomorrow with the questions ready. Those check-in answers are recorded as outcome data, the independent judgment the record learns from.

Talk or type, with nothing lost either way

Nobody should have to talk about their health out loud on a bus, or have a phone say it back to them in a waiting room. Every patient chooses at setup how to use the guide and can change it at any moment. The choice follows them to every device.

Anything the patient can say, they can type. Anything they can enter, they can say. Every screen can be driven by voice, and the guide shows what it heard before it saves anything. Switching is one sentence: saying "type instead" ends the speech on the spot. That rule is a design constraint rather than an accessibility afterthought, and it decides product questions on its own, since a feature that would only work spoken does not ship. It also settles the two objections that follow voice products everywhere, privacy in public and users who will not talk to software.

Teaching by doing

The guide does not hand the patient a help article. For any task, uploading a laboratory report, connecting a watch, adding a medication, sharing a synopsis, it explains the step in one sentence, highlights the next control, and waits while the patient does it. It will do the step for them when asked.

• Stuck detection. Repeated taps in one place, or a long pause on a screen, prompt the guide to offer help before the patient gives up.
• Pace. Practiced patients get shorter walkthroughs, and a simple mode slows down, uses larger type and shows one step per screen.
• Caregivers. A family member managing someone else's record gets the same step-by-step teaching as the patient.
• Onboarding is itself a walkthrough. What the guide should be like, what to call it, talk or type, the voice, then each agreement in plain language. The patient signs each one; the guide never accepts for them.

The commercial value is the training line. Patient engagement products are sold to organizations that will not run a training program for their patients and cannot staff a help desk. A product the guide teaches, function by function, has no training cost to pass along.

One guide service, two sets of tools

The patient's guide and the clinic's guide inside Arca are one guide service with different tools, permissions and voices. A clinician's guide can order, chart, bill and schedule under that clinician's authority. A patient's guide can read that patient's own record, answer questions with graded evidence, open screens, run a walkthrough, take visit notes, request a video visit, share the record, rename itself and switch to a family member. Neither can reach the other's tools.

Building it once has three consequences. Every improvement to speech handling, the guardrail layer, walkthrough teaching or the conversation model arrives on both sides at once. The safety work that matters most, emergency triage and the answer filter, is written once and tested once rather than twice with two sets of gaps. And a patient and their clinician talk to systems that understand the same record the same way, which makes a clinic portal inside a patient's own app coherent rather than bolted on.

What stays hidden

Patients never see the names Holarc, NERD or Keelson, or any other system name. They see their guide, their record and their clinic's brand. A test checks that no system name reaches a patient screen; the names appear only in the license terms, where ownership of the technology is stated.

The architecture underneath, a lifetime event record, a learned trust weight per source, an evidence engine, is what makes the guide better than a chat window over a document pile. None of it is the patient's problem. A patient asked to understand a record engine has been handed the vendor's organizational chart instead of an answer.

How a spoken turn is handled

Every voice conversation starts on the server rather than in the browser. The service asks the suite AI gateway for a signed session; the gateway holds the vendor credential, checks the person's voice consent and sets recording off with minimum retention. The browser receives a signed address, a brief of the record and a one-time bridge token, and never holds a vendor key.

1. Triage first. The voice agent's language model is the service itself. Each turn arrives with the bridge token, and the server runs the emergency rules on what the person said before anything else. An emergency or crisis interrupts with the 911 or 988 message and is written to the record.
2. Answer through the gateway. The server asks the model through the gateway, with the guide's rules and the record brief, under that person's own consent. The gateway strips identifiers before any text leaves and logs the call. No vendor key sits on the service, which refuses to start if one is set.
3. Filter before it is spoken. The answer filter reviews the reply and replaces any sentence that crosses the line before the agent speaks it.
4. Fall back without losing the guardrails. With no microphone, the app falls back to the browser's own speech and the typed guide, which take the identical path through triage, the gateway and the filter.

The patient's own app and guide

MY TALISMAN

Ask, with graded evidence

A patient can ask anything medical and gets information with a reference behind every statement, a grade on every source, a warning when a source is weak, and a score from 0 to 100 capped when the research is thin. It is never an opinion about the patient and never a diagnosis.

Any question, including the ones nobody else will take

Patients ask about conditions, symptoms, risks, tests, drugs, supplements, herbs, diets, acupuncture, devices and treatments that are not yet standard. Ask takes all of it. Refusing the question is the usual approach and it fails: a patient told to consult their physician goes and asks somewhere that answers, and the place that answers is almost never the place that grades its evidence.

What every answer carries

• A reference on every statement. Any sentence without a source is dropped before the patient sees it.
• A grade on every source, with the reason for the grade beside it.
• A plain warning when something is weak, saying how many are weak and how weak: "one of these is a news interview, not a study, so treat it as a lead rather than evidence."
• An evidence score from 0 to 100, built in the style of the NERD score, with hard caps.
• Facts from the patient's own record, restated without interpretation.
• Up to three questions back, such as whether the patient feels cold more easily than people around them. Those answers go into the record and are never used to reach a conclusion about the patient.
• Questions for the doctor, what research would settle it, and studies recruiting now.

References are written, not spoken

Every reference links to its source and is also written into the chat as a clickable search, so the patient can run the same search and see the source in its own context rather than taking the app's word for it. A citation a patient cannot check is a decoration. In voice mode the guide never reads references aloud; it says once that they are in the chat and each is a link, because a spoken list of journal names, volumes and authors is unusable and crowds out the answer.

Source grades

Every source gets one grade, with the reason beside it, depending on the kind of study and what it found.

News reports, interviews, personal accounts, health media, animal studies, preprints and retracted papers are always called out by type. News stories and interviews are welcome and graded as what they are, because a patient who heard something on the radio needs that claim engaged rather than ignored. Ask also reads conclusions in the correct direction: tests hold it to reading "did not significantly reduce" as a null result and "the evidence is incomplete" as unsure. A system that cites a paper for the opposite of what it found is worse than one that cites nothing.

The score, and the caps that keep it honest

The score is built from the kinds of studies available, the amount of focused research, agreement between conclusions, recency, and how directly the research answers the question asked. Parts that cannot be assessed are labeled not assessed rather than given a middle value, which is how most scoring schemes quietly inflate. Funding and conflicts of interest are not yet scored, and every answer says so.

Two caps sit above the score and cannot be argued past. A question too broad to match specific research never scores above 35, so "is turmeric good for you" does not come back looking settled. A question with no focused systematic review and fewer than two focused randomized trials never scores above 50, so a score above 50 means a review or two trials exist on the exact question asked, a claim a reader can check. The caps exist because a score built on the volume of research rather than its quality is the standard way an evidence score goes wrong. A test holds them on every release, and every answer lists the research that would raise its own confidence.

One set of rules for everything graded

Conventional treatments, alternative treatments and products from affiliated companies are graded by the same rules, affiliations are disclosed, and no referral payments are taken. Each part is load-bearing in a different direction.

Against conventional medicine it means the weakness of standard practice gets stated too. Publication bias, retractions and negative results that were never published are real, and a system applying skepticism only to the challenger is not a scoring system. A standard treatment supported by two small industry-funded trials scores like one.

Against alternative medicine it means a mechanism is engaged on the evidence rather than dismissed for lacking consensus, then graded without mercy. A supplement with three underpowered trials gets Thin and a capped score.

For the company's own products it is commercial as much as intellectual: a product graded under rules its maker does not control is worth more to a regulator than evidence that maker scored itself.

Where it stops

• "Do I have X?" returns what the research says about X's signs and screening, the fact that only a clinician can answer it, and a question to bring to that clinician. Never a yes or a no.
• No ranked list of likely conditions, and no treatment selected for the patient. The boundary sits where the federal enforcement-discretion examples for symptom checklists and herb-drug interaction lookups sit.
• Crisis wording routes to 988 and emergency wording to 911 first, through rules a model layer may escalate and can never soften. Whether fish oil helps after a stroke five years ago is recognized as research rather than an emergency.

Only the topic leaves

Outside searches carry topic terms from a medical vocabulary and nothing else: conditions, symptoms, treatments, supplements, drug names, laboratory names from the record's registry, and terms from the person's own record. Leftover words are never searched, and a term sharing a word with the person's or a family member's name, postal code or birth date is dropped.

Searches reach six allowlisted hosts: the European and United States biomedical literature, the national consumer health library, the federal trials registry, the federal drug label database and a news search. Every request passes through one egress module that refuses all of them unless lookups are switched on, refuses any other host or anything unencrypted, and sends through a proxy. With lookups off, Ask answers from the cached library and lists the outside sources as unavailable.

What the discussion adds to the corpus

Every question asked and answered deposits something hard to buy. The library accumulates graded findings by topic, so the second patient to ask gets a faster and better-sourced answer than the first, and the corpus grows along the topics patients care about rather than what a content team guessed at. Where the research is thin, the gap is recorded with the study that would close it: a map of what medicine does not know, assembled from what patients keep asking.

The patient's own questions are written to their record, and the morning brief includes what they have been asking about, often the first signal that something is wrong before any test is ordered. Their follow-up answers and reports of what happened after a treatment enter as their own observations, under their signed research authorization before any research use. Those are independent judgments that did not come from the system's own answer, the input a record learning how far each source can be trusted cannot generate for itself. A feature most products treat as a cost center is here the supply line for the asset.

The patient's own app and guide

MY TALISMAN

The whole family, and what happens at a visit

A parent carries their children, and any patient carries the people they hold legal medical responsibility for, inside one account. At the visit, the guide announces that it takes notes without recording, then hands the clinician an editable synopsis while everything else is discarded.

One account, separate records

The patient switches between the people they care for in one tap. Each has their own record, and nothing is merged into the patient's. The account holds a proxy link to each one storing the legal basis, the signed authorization and the end date.

Keeping them separate is the difference between a family feature and a liability. A merged record cannot be unwound when a child turns eighteen, cannot withhold the care a minor may lawfully keep private, and cannot be divided when a custody order changes.

An adult cannot be added as a child, and a test holds that. Parent access ends on the child's eighteenth birthday, leap-day birthdays included.

Legal responsibility, proven rather than assumed

A proxy grant is never implied by a role. Each is a record carrying its legal basis, its signed authorization and, for a minor, its end date, sealed at rest. Access moves only after proof: a one-time code to a contact already on file rather than one the requester typed, staff identity proofing where no usable contact exists, the adult's own approval from their own account, and a birth certificate or court order recorded by staff for a minor. Neither the requester nor the staff can approve access to an adult on that adult's behalf. A grant made from typed details never opens an existing record: the person added gets a record holding only what was typed, so nobody can use that screen to learn who is in the system.

• Care a minor may consent to alone. Records state law lets a minor keep from a parent are withheld from the parent's view, and the consent engine enforces it on every read rather than at the screen.
• Shared custody. Another parent or guardian may request their own access, and a parent whose rights are limited by a court order uploads the order.
• The guide speaks about that person by name while a proxy manages their record, and never mixes their information with the account holder's.
• Every proxy action is logged in the dependent's own access log, which an adult dependent can read.
• Consents are per person, made on that person's own screens.

One account carrying a spouse, two children and an aging parent is four lifetime records and four streams of outcome data from one enrollment. Adult children managing a parent's care are the most motivated users in health software and the worst served.

The visit notetaker

The night before, the guide delivers a prep brief: why the patient is going, what changed since the last visit, and the questions they raised in Ask. During the visit it takes notes and keeps no recording. The clinician edits or accepts them; everything else is destroyed.

1. It announces itself. When the visit starts the guide tells the clinician, in its own voice, who it is, whose guide it is, that it would like to take notes so the patient can remember the discussion, that it will not record audio, and that it will show the notes at the end to edit or accept. In typing-only mode the clinician reads the same words on screen.
2. The clinician consents or declines. A tap or a spoken yes, logged with their stated name, role and the time. A clinician who declines gets a guide that stays silent for the whole visit.
3. It takes notes. Speech becomes text only long enough to write them, and a banner reading "taking notes, no recording" with the consent time stays at the top of the screen.
4. It hands over a synopsis: what was found and recommended, medication changes, follow-ups and the questions answered, as an editable document.
5. The clinician accepts, edits or discards. Only the accepted synopsis enters the record, marked as approved by that clinician and labeled a summary for the patient's own use rather than clinical documentation. Audio, transcript and drafts are deleted, and tests confirm a discard keeps nothing.

Announcing it out loud is the design rather than a courtesy. Ambient scribe products are consented by the clinic that bought them; this one is in the patient's hand, pointed at a clinician who has agreed to nothing. The announcement and the yes serve as consent under all-party consent laws, which can treat live transcription as recording even when nothing is kept.

Keeping no audio removes the asset that makes clinicians refuse. There is no recording to be subpoenaed, leaked, replayed or compared against the clinician's own note, and the only durable artifact is a document they read and approved. At a clinic running Arca, the clinic's own notetaker takes the visit and the patient's guide steps aside. Afterward the accepted notes become a plain-language summary with tasks and timed check-ins.

Telemedicine in one tap

The patient taps see a doctor now, or the guide offers it when a symptom calls for one. The guide asks two or three questions, builds a visit packet from the record, and stops. The packet holds the reason for the visit, medications and allergies, ninety days of laboratory results and relevant history, with the full record included only if the patient chooses it. The patient approves it and signs the clinician's visit consent, with any fee shown first. Afterward the clinician's note, any prescription and the follow-up plan come back into the record as reminders and check-ins.

The patient's own practice is offered first whenever it offers telehealth, then the partner's own clinicians, then a contracted national network supplying licensed clinicians, state licensing, malpractice coverage and prescribing under the partner's brand. Offering the patient's own doctor first is a retention decision: no practice will hand its patients a product that routes them away. A company-owned network can follow once volume supports it, structured as corporate practice of medicine rules require. The guide prepares and hands off; the licensed clinician diagnoses and prescribes.

The agreements, walked through

Six agreements set the limits of the service and give every intended use of the data a signed basis: the terms of use, the privacy notice, the research authorization, the notetaker notice, the consumer health data consent with separate signatures for collection and sharing, and the proxy authorization. The guide walks the patient through each and never accepts on their behalf.

The research authorization is deliberately separate, with its own screen and its own signature. Health data consent bundled into general terms is the kind regulators and courts most often refuse to enforce, and a separate signature is what lets each intended research use stand. The patient chooses care only, care and research with identity held apart, or care and research with outside projects that receive results rather than records. Care never depends on signing it.

Every signature, from a patient or a clinician at a visit, is stored as a permanent tamper-evident record holding the signer, the document version, a fingerprint of the exact text shown, every choice made, the device and the time. The chain's head is anchored outside the database, so a chain rewritten inside it still fails against the anchors. One step produces the signed documents and the proof for an audit years later.

The patient's own app and guide

MY TALISMAN

The screens

Seventeen designed screens, sixteen for the phone and one for the desktop, grouped into the flows a patient runs: getting started, every day, the visit, and the wider screen. Every one follows a single invented patient and is marked as sample data.

The screens use the direct edition's own palette and typefaces, with a partner's colors swapped in by its brand pack. The guide's avatar is two concentric circles in the brand color, the same mark wherever it speaks. Evidence chips appear wherever the guide makes a claim, so the strength of a statement is visible in the same glance.

Getting started

Five steps, each labeled so the patient knows how much is left, run as a walkthrough rather than a form to fill in alone.

Putting the agreements inside the walkthrough rather than behind a scroll-and-accept box is what makes the signature worth having. The patient asks what a clause means before signing, and the questions they asked are stored beside the signature.

Every day

The everyday screens are built around a claim the app earns each time it opens: something was noticed since the patient last looked.

The photo screens are where the regulatory line is visible in the interface. The app measures and presents, says the sizes are approximate, and states that no analysis was applied. It never offers an opinion about what the spot is, because that is a diagnosis and belongs to a licensed clinician.

The visit

Three screens carry the visit: the brief before it, the notetaker during it, and the route to a clinician when there is no appointment to wait for.

Showing the patient exactly what a telehealth clinician will see, before they approve it, is the part most products skip.

The wider screen

The desktop web screen puts navigation down the left side, the day in the middle with the family switcher above it, and the guide's conversation in its own column on the right, where it never covers what it is talking about. The sample exchange shows the guide explaining that iron taken with morning coffee absorbs less and that newer research supports every-other-day dosing, then offering to add both to Thursday's questions.

The desktop screen is not a courtesy to older patients. It is the screen a caregiver managing three records uses, the one a patient reads an imaging series on, and the one a front desk uses to finish an enrollment. Sign-up happens in a browser, so it is the first screen most patients ever see.

The patient's own app and guide

MY TALISMAN

The My Talisman market

Consumer AI health assistants became a mass market in 2026. My Talisman competes as the branded, HIPAA-grade guide an organization hands its own patients, over a lifetime record that keeps every fact with its source, with family records, imaging and graded evidence behind it.

The demand is settled, the access is not

Whether patients want this is settled by public figures. ChatGPT Health opened to all United States adults in July 2026 and handles about 300 million health questions a week. Microsoft reports more than 50 million a day, each asked of a system that knows nothing about the person.

Against those 700 companies, fewer than 50 provider organizations had pledged. Clinics are the bottleneck rather than patients, and that gap is the distribution thesis: reach patients through the organizations that treat them, on the side with less competition. The federal Medicare application library has opened a category for conversational AI assistants and limited it to applications meeting HIPAA, verified identity, the industry code of conduct and connectivity to the aligned network. Five were listed in June 2026. The standard excludes assistants outside HIPAA, which is most of the ones holding those question volumes.

Sizing, and what the published numbers are worth

Published estimates for patient engagement and personal health records run $33.8 billion to $41.2 billion worldwide and about $14.6 billion in the United States. Estimates for the narrower personal health record category run from under $50 million to over $6 billion depending on the definition, a hundredfold spread and a reason to rest no plan on it.

Plus 6,436 ambulatory surgery centers and more than 2,700 direct primary care practices, counted by Definitive Healthcare, the federal payment advisory commission's March 2026 report and DPC Frontier. Each brings its own patient panel on the day it signs, so the unit that matters is a panel rather than a download.

Who pays

Patients never pay to own their data, and records are never sold, rented or transferred. Organizations pay.

Prices are set with the first partners during the pilot. Including the application with Arca rather than charging a clinic's patients is a deliberate trade: the portal is what a clinic already pays a vendor for, so giving it away converts an acquisition cost into a feature of a subscription already sold.

One code base produces every branded edition, and the white-label route is the opening rather than a side business because of a constraint on the buyers. A clinic group, an employer or a health system cannot hand its patients a chat product outside HIPAA, and will not hand them one carrying a technology company's brand instead of its own. The organizations with the patients cannot use the products with the capability. A partner wanting an application built to its own specification gets a separate one, because every improvement to My Talisman reaches all editions and a fork would end that.

Where it wins

Six advantages hold across that table. An organization's own brand over a HIPAA-grade service. A record kept continuously across every doctor and every kind of care rather than fetched one question at a time. Graded evidence, which no competitor reviewed publishes. Family records, imaging and a notetaker that keeps no audio, in one application. Distribution through care, reaching a clinic's whole panel at once. And neutrality, since every option is scored by the same rules.

What the patient relationship is worth

The application earns a per-patient fee, and that is the smaller half of its value. The record under it learns how far each source can be trusted, from independent judgments about what happened. Claims data arrives late and describes billing. A clinic note describes what the clinician concluded, the system's own answer coming back to it. A patient answering a check-in after a new treatment reports something the system did not produce. A record surrounded by applications has a supply of those judgments; a record sold alone does not, and its weights sit near their starting figures indefinitely.

Two further consequences follow. A patient holding their own lifetime record does not lose it when they change doctors, so the record outlives every clinic contract in it and the patient becomes the reason the next clinic connects. And a patient enrolled through one organization carries their family, several lifetime records from one enrollment.

The relationship also opens an adjacent product on the same core: a pregnancy application that reaches the most motivated health users there are and produces a second lifetime record at birth. Scoped, not built.

Risks we raise ourselves

The sequence has three gates. Now: a hardened web application and the clinic portal on invented data. Before the first real patient: the security gates, signed vendor agreements for language models and voice, and a pilot with the first partner. Then: native phone applications, certification under the industry code of conduct, and a Medicare library listing, which requires verified patient identity through a contracted proofing partner.

The clinic system you talk to

ARCA

Arca, the clinic system you talk to

Arca is the medical record and practice management system a clinic runs by speaking to it. A guide listens, drafts, looks things up, books, codes, bills and follows up, and a person approves anything that changes a chart, sends an order or submits a claim. One code base serves every outpatient specialty, from direct primary care to imaging and surgery centers, in a human edition and a veterinary edition.

What the product is

Everyone in the clinic has a guide, on a workstation, a tablet or a phone, by voice or by typing. Behind the guide sits a team of agents, each with one job, its own permissions and its own log: a receptionist that answers the phone, a registrar, a chart summarizer, a notetaker, an order stager, a safety checker, an inbox agent, a coder, a claims agent, a prior authorization agent and an analyst. The guide does the work before anyone asks for it. Charts are summarized before rooming, eligibility is checked the night before, orders are staged out of the conversation in the room, the claim is coded at signing, and inbox replies are drafted before anyone opens the inbox. One code base serves every clinic type: a clinic picks a skin for its specialty, which sets its templates, flowsheets, order sets, billing rules and widgets. Finished clinical facts go to the lifetime record, working state stays in the clinic's own store, and each clinic's patient accounts sit in its own ledger under its own key with no path to another clinic and no path to research.

Screens remain for anyone who prefers them, and every screen can be driven by voice, by touch or by keyboard. Arca runs in any modern browser, so one code base serves Windows machines, touch-screen workstations, Macs, iPads and Android tablets, and installs as an application on each. On a tablet a clinician opens on a rounds screen with the patient list beside the chart, and patient data is never stored on the device.

Every agent action waits for a person's approval

No agent signs a note, places an order, sends a prescription or submits a claim without a person approving it in the approval queue. The guide shows what it heard and what it will do, and the person accepts, edits or refuses. A clinic may switch on automatic handling for one named low-risk action, such as an appointment reminder or posting a clean remittance, and that switch is recorded. Every action carries the approval that allowed it on a tamper-evident log. The rule also closes the most obvious way to attack a system run by conversation: outside documents, faxes and patient messages are treated as data, so text inside them cannot instruct an agent.

Two design decisions that are commercial arguments

Physicians rate their electronic health records at 45 out of 100 on the standard usability scale, in the largest published study of the question (Melnick and colleagues, Mayo Clinic Proceedings, 2019). The average across all kinds of software is 68, and 84.1 puts a product in the top four percent of everything measured. Forty-five is a failing grade for the software a physician spends more of the day in than with patients.

Arca's target is a mean of 90 or higher for every role: clinician, nurse and medical assistant, front desk, biller, manager and patient. No release ships if any role's mean falls below 80, and any single score under 70 opens a defect. The survey is the ten standard items, scored the standard way, run quarterly on a random sample at each clinic.

Nobody sits through training. Every function in Arca is registered in one catalog with its roles, its steps, the screen it lives on and the phrases that invoke it, and a release fails if any route lacks an entry. From that catalog the guide will tell a user the steps, show them on the screen with each element outlined in turn, do the function and bring it back as a pending approval, or let them practice in the clinic's own practice copy, built from the real staff list so everyone practices as themselves. A function does not ship unless a test proves the guide can teach it, and help pages are generated from the same catalog so the guide and the written help cannot disagree. The target is a front desk hire working on real patients in the first hour and a clinician finishing a first real visit with the guide in the first session, measured as time to independent work by role.

The second decision is about interruption. Drug interaction alerts are overridden about 90 percent of the time in published studies, which means the alert has stopped carrying information and become a tax on attention. In Arca each clinician chooses, for each kind of alert, whether it interrupts, sits in a side panel, arrives in a daily digest or stays off. A short list of true safety alerts stays locked on because the clinic carries the liability: severe allergy, a contraindicated pair, a dose above the maximum, a pregnancy contraindication, a critical laboratory value, duplicate high-risk therapy. Those are overridden only with a reason, written to the log, and are never demoted. Everything else is tuned. Any clinician-controlled alert accepted less than 30 percent of the time over 90 days, with at least ten decided interruptions, stops interrupting on its own and moves to the side panel, and the clinic's alert owner is told and can restore it. The budget is five interruptive alerts per clinician per day.

Both decisions are commercial because both are measured per release. A buyer comparing systems has no usability number from an incumbent and no alert acceptance rate.

Who buys first, and in what order

The entry market is the one with the lightest rules and the thinnest competition. Cash-pay primary care, direct primary care, concierge, wellness and integrative clinics do not bill Medicare, so they need no federal certification to buy, and the systems they use today offer a bolted-on scribe at $290 to $770 a month. More than 2,700 direct primary care practices operate in the United States, counted by DPC Frontier. Small practices on the lowest-rated incumbents are the second group, sitting on unstable vendors and reporting the worst satisfaction in the field.

Counts from Definitive Healthcare and, for surgery centers, the federal payment advisory commission's March 2026 report. Multispecialty groups and management services organizations are where the single code base is worth the most, because they run several specialties on several vendors today and no incumbent covers primary care, pediatrics, orthopedics, women's health, chiropractic, wellness, concierge, urgent care and imaging on one patient record. Hospitals are not the first target, and the system is built to run them.

Outside the United States the order is set by how much regulatory work stands between the software and a paying clinic. English-speaking markets with private cash-pay clinics come first: the United Kingdom's private sector, Australia and Canada. Private hospital groups in the Gulf states, India and Latin America follow, where a full incumbent installation is out of reach on price, and where 882 hospitals operate in the Gulf alone by the GCC Statistical Centre's count. The European Union follows once its new conformity process takes effect from March 2027. National public-sector systems come last, because their incumbents hold decades-long positions and their procurement runs on a different clock.

The clinic system, on screen

Screens from the clinic system running on invented clinics and invented patients.

The clinic system you talk to

ARCA

Charting, orders and the room

A notetaker that drafts the visit from the conversation and keeps no recording, notes whose every sentence links to the moment it came from, prescribing with controlled substance signing, laboratory orders and results on the real standards, alerts each clinician tunes, and a clean line between the finished facts that go to the lifetime record and the working state that stays with the clinic.

The in-room notetaker

The notetaker is the default way to chart. The guide announces itself to everyone in the room, says it takes notes and keeps no recording, and records each person's consent with the time. If anyone declines, the clinician charts by voice after the patient leaves, or by typing. Speech becomes text only to build the draft, and the clinician can speak to the guide mid-visit to stage an order without breaking the conversation.

Within seconds of the visit ending the note appears in the clinic's template, with staged orders and prescriptions, suggested diagnoses and codes marked as suggestions, patient instructions and follow-ups. The safety checker flags anything the note states that conflicts with the chart, an allergy, a medication, a side of the body, and anything said that the note left out. After signing, the working transcript is deleted.

Keeping no recording is a commercial position, not a technical shortcut. Patients agree to ambient notes at high rates when told the basics and at far lower rates once they hear about AI and data storage: 81.6 percent against 55.3 percent in a 2025 study in JAMA Network Open, a fall of 26.3 points traceable to storage alone. Scribe vendors differ, some keeping audio 30 to 90 days and others none. Arca keeps none, which removes the concern rather than disclosing it. Nine states require every party's consent before a conversation is transcribed, and the announced consent covers them.

Every sentence linked to its moment

Each sentence the draft puts in the note is linked to the spans of the visit that support it: the segment, the character offsets, the time, the speaker, and the words as spoken when the visit was translated. A clinician touches a sentence and reads that moment with the supporting words highlighted. A sentence with no supporting span is marked for review, and a number or dose that nobody said is flagged on its own. The linking is deterministic word matching that runs offline, finding lexical support only, so a sentence supported in meaning but worded differently is marked for review, which is the safe direction to fail in.

The published error studies are why this exists rather than a marketing feature. A randomized trial of 238 physicians across about 72,000 visits found an ambient scribe cut note-writing time 9.5 percent, roughly 41 seconds a note, with occasional clinically significant errors, mostly omissions (NEJM AI, December 2025). A separate study found invented content in 1.47 percent of sentences and omissions of 3.45 percent of what was said (npj Digital Medicine, 2025). Controlled studies put the saving at one to two minutes a visit, far below vendor claims of 45 to 72 percent. At signing Arca computes how much of the draft the clinician changed and writes it to the log, which makes the quality of the drafting measurable rather than asserted.

Arca also proposes structured chart entries from the transcript: problems with their diagnosis codes, medications with ingredient, strength and form, allergies with the reaction, vitals, orders and the follow-up. Each carries the moments it came from and an action against the chart: add, change, stop, or already present and shown but never written. Two extractors run, a rules extractor always on and offline and a model extractor only under live consent, whose entries are merged under the rule entries and never over them. Visits run in 17 configured languages.

Content packs by specialty, and the reviewer rule

A specialty's clinical content ships as one versioned document: note styles and templates, structured exam elements, flowsheets, order sets, rating scales, device import mappings, coding rules and patient instructions. Five exist: primary care, concierge and direct primary care, wellness and integrative, urgent care, and orthopedics. A pack counts as reviewed only when it names a practicing specialist with credentials who reviewed that exact version, and a coding owner. A live clinic cannot turn on an unreviewed pack, and the refusal is recorded. The five shipped packs name no reviewer and show as unreviewed sample content wherever they are used. A clinic's changes sit in a layer above the pack, so an upgrade changes the pack underneath without discarding what the clinic set.

Prescribing and controlled substances

A prescription is drafted from drug, strength, dose, frequency, days supply, refills, substitution, diagnosis and pharmacy, and Arca writes the directions and the quantity. A real-time benefit check shows the patient's 30-day cost under their own coverage, with up to three alternatives in the same class, before signing. Prescriptions are written in NCPDP SCRIPT 2023011, the only version allowed from January 1, 2028.

Controlled substances follow the federal rules in full. The prescriber is identity-proofed to the higher federal assurance level. A manager or owner who is not the prescriber turns the capability on, which is the two-person control the rule requires. A check of the state monitoring program within 24 hours is required before signing. Signing takes two different kinds of factor: a session minted from a hardware security key within the last 120 seconds, for the same person and clinic, plus the prescriber's signing code. A phone code is not offered, because a phone is a second thing you have rather than a second kind of factor, and a face or fingerprint passkey signs a clinician into Arca without being able to sign a controlled prescription.

Every drug and result check fires through the alert tiers. A locked safety tier always interrupts: severe allergy, a contraindicated pair, a dose above the maximum for age, weight or kidney function, a pregnancy contraindication, a critical laboratory value, duplicate high-risk therapy. Those are overridden only with a reason, written to the log, and are never demoted. Everything else each clinician sets to interrupt, side panel, daily digest or off, down to a floor the clinic sets. Every alert says why it fired, links to the drug entry and to the record event behind the patient fact, and offers one fix.

Laboratory orders and results

Orders carry coded tests and diagnoses, taken from the problem list when none are given, and run over two-way HL7 v2.5.1 interfaces with acknowledgment. Medicare medical necessity flags decide when an advance beneficiary notice is needed, and the patient's choice is recorded before the order goes out. Results are matched to the order and to the patient on record number, family name and birth date, and a mismatch is held in the inbox and rejected rather than filed. A corrected value links to the one it replaces, which is marked superseded.

Release to the patient follows the federal information blocking rules rather than clinic habit. Each result releases at its arrival plus the clinic's hold setting, which starts at zero hours and cannot exceed 72. A clinician can add a note the patient will see, release early, or hold one order's results under the preventing-harm exception with a logged reason. Blanket delays are presumptively unlawful and the product does not offer them.

Where the facts go

Finished clinical facts live once, in the lifetime record, and everything else reads a view of them. The clinic is the legal custodian of its chart and must keep it, answer subpoenas and access requests, and take all of it when it leaves. When a patient uses their own application, a copy of each finished record flows into the patient's own domain under their federal right to direct copies to an application of their choice, and each domain has its own keys, so erasing the patient's copy never touches the clinic's chart. Sensitive entries carry labels the consent engine enforces on every read: substance use records, care a minor may consent to alone, reproductive and gender-affirming care where state law requires segregation, and psychotherapy notes.

The clinic system you talk to

ARCA

The front office

Scheduling, registration, forms, the phone line, the inbox, telehealth and the patient portal. The guide answers the phone, books, texts, fills cancellations, sorts the inbox and drafts every reply, and a person approves. The portal is not a separate website: it appears inside the patient's own application under the clinic's brand.

Scheduling

The schedule books people, rooms and equipment together, because an outpatient appointment is rarely one resource. Clinicians, rooms, chairs, procedure rooms, imaging modalities, audiology booths and operating rooms each carry their own hours. One appointment books all of them at once, all or nothing, and is refused with the list of conflicts when any one is already taken. The check and the write run under one lock per clinic, so two bookings cannot both pass.

Visit types carry length, resources, prep instructions, forms, eligibility checks and the templates they open. Staff book by saying it: put her in her surgeon's first opening next week, 30 minutes, knee injection. The guide finds the slot, checks the rules and books after approval. Recalls come from care gaps, overdue follow-ups, specialty cycles and membership benefits, and a cancellation texts the first matching person on the waitlist, filtered by clinician, visit length, date window and consent.

Registration and the forms

Intake and consent forms go out by link, are completed by voice or on screen, and are signed in the patient's application, on the web or on an office tablet. The guide reads and explains each form and never signs for the patient. A signature is stored with a cryptographic fingerprint of the exact text signed, so what the patient agreed to is provable rather than inferred from a version number. At arrival a rotating care code in the patient's own application identifies them, and insurance card and identification photographs are read and compared with the file.

Eligibility and benefits are checked in batch the night before and in real time at booking, and the answer shows beside each appointment: active or not, plan, copay, deductible and what is left. Members and self-pay patients are marked as needing no insurance check. Prior authorization is checked at booking, and the balance and copay are presented for payment before arrival.

The phone line

The guide answers the clinic's phone and text lines, and the order of operations matters more than the capability. Every caller sentence passes the emergency rules before anything else reads it. An emergency or a crisis ends the automated call at once: the caller hears the 911 or 988 instruction, the call passes to a person with a warm transfer, a safety item goes to the inbox and the escalation is logged.

Nothing about a patient is said until the caller gives a date of birth and then a six-digit code texted to the mobile number on file, never to the calling number unless that is the number on file. The guide answers identically whether or not the details match anybody, so a caller cannot learn who is a patient by probing, and three failed attempts pass the call to a person. Inside those walls the guide handles hours, billing questions, booking, rescheduling, refill requests and balances, in English or Spanish.

Texting runs on recorded consent per patient with its source and time, and reminders, recall, reactivation and waitlist offers go only with consent. STOP opts the number out at once, and texts carry the clinic's name and a time and nothing clinical. Other modules queue patient messages in one outbox and never send anything themselves, so a message without consent, after a STOP or without a mobile number is held with the reason rather than lost.

One inbox

Results, refill requests, portal messages, faxes, referrals, texts and calls arrive in one inbox. The guide sorts each item by category, by priority taken from the emergency rules, and by who should handle it, then drafts the reply, the refill or the routing. A person approves, and the role gate holds: clinical items need a clinician, medical assistant or nurse, front desk items the front desk or a manager, billing items a biller. Items per clinician per day and the share the guide drafted are computed from the log.

The inbox is where the clinical argument and the commercial argument meet. In academic primary care from 2019 to 2023, time in the inbox grew 24 percent and time on orders grew 59 percent, and after-hours work did not fall even where scribes were in use (Annals of Family Medicine). A primary care physician spends about 36 minutes in the record for every 30-minute visit (AMA), and a scribe does nothing about either number. In a Stanford pilot, AI-drafted inbox replies cut clinicians' task load and exhaustion scores even though reply time did not change. Arca drafts the action along with the reply.

Public reviews get a drafted reply for a manager or owner to approve, under rules written into the product: a reply never names the reviewer, never repeats anything from the review, never names staff, and never uses words that imply care such as patient, visit or your doctor. These drafts are templates only, because the reviewer gave no consent for a model to read what they wrote.

Telehealth

A clinician starts a video visit from the schedule and the patient gets a text with the link. The patient, or an approved proxy, signs the telehealth consent first and it is written into the chart before the visit starts. The visit is an ordinary Arca visit, so the notetaker runs exactly as it does in the room. Media runs browser to browser with Arca as the signaling server only, over a connection whose credential is a join token good for this visit, this party and this sign-in for at most 30 minutes. Nothing is recorded, and ending the visit revokes every join link.

The patient portal, inside the patient's own application

Arca does not ship a portal website. The clinic's patient-facing functions switch on inside the patient's own lifetime-record application, under the clinic's logo: booking, forms and consents, released results, secure messages, bills, payment plans, membership, refills and video visits. The clinic gets a modern portal it did not build and the patient gets one application instead of five, because the same one also holds their records from every other doctor they have seen.

The two products are deliberately independent. The patient application never depends on Arca, and Arca never requires a patient to install anything: every patient function has a web version, and staff can do anything a patient could do on their behalf. Sign-up needs no application at all. The clinic sends an invitation and it opens in any browser, the patient signs in with a one-time code to the phone or email the clinic already has on file, and the guide walks them through demographics, insurance cards, forms and consents. That removes the step where patient engagement products lose most of their users: a front desk that can send a text message can enroll a patient, and the guide finishes it rather than the staff.

A parent, guardian or caregiver uses their own sign-in and names the patient they are acting for. Access is allowed only with a grant whose holder is that caller, whose identity was proofed to the higher federal assurance level, that is not revoked or expired, and whose scope covers the area being read. That rule is written once and used by the clinical and billing routes as well, and every proxy access and refusal is logged. A proxy request starts a hosted proofing session and never reveals whether the patient details matched anybody.

Arca runs the emergency rules itself on every booking reason, message and form answer, and accepts the application's own screening without relying on it. Two systems reading the same sentence is the point.

The clinic system you talk to

ARCA

Getting the clinic paid

A clinic is paid three ways, and Arca handles all three: insurance claims, membership and concierge subscriptions, and cash at the counter. Behind them sits a complete receivables and payables system with every amount held as an exact decimal, the clinic's patient accounts under the clinic's own key, and the clinic's books kept as a separate entity that never sees a patient's name.

The three ways a clinic is paid

Most systems do one of these well and treat the others as an afterthought, which is why a cash-pay clinic ends up running a claims system with the claims turned off. All three run on the same ledger rows, so an insured patient's share and a self-pay line appear on one invoice.

The claims cycle

Eligibility runs after every booking, from the desk, the phone line, the guide or the portal, and again the day before. A professional claim is built from the signed visit and the coder's approved lines: the note's diagnoses, modifiers and units, the clinic's fees and the rendering clinician's identifier.

The scrubber runs before every send and reports Stop, Warn or Pass with the source it used: required fields and identifier check digits, payer rule packs covering member identifier format, timely filing, prior authorization and coverage policies, modifier logic, procedure pair edits and medically unlikely edits. Remittances post automatically to the clinic's ledger through its own logged write method, idempotent on the trace number. Every rejection and every denied line becomes a worklist item with the dollars at stake and the deadline. The guide drafts a corrected claim, asking a person for what it must not guess, or drafts an appeal letter quoting the signed note's supporting statements. Nothing is resent until a person approves it.

In 2025, 41 percent of providers reported that more than 10 percent of their claims were denied, up from 30 percent in 2022. Denial work is where a practice loses money quietly, and it is the work an agent can draft and a biller can approve in a fraction of the time. Coding accuracy is measured rather than claimed: each month a random sample of the coder's claims goes to a certified coder, and every measure above comes from the log alone.

Membership and concierge billing

Plans carry a monthly fee, an annual discount and family pricing with each additional adult and child priced and capped. Enrollment caps apply per clinician, with a family counting each person against the panel. Employer contracts run at a per-employee-per-month price on one invoice to the employer, and the employee is never charged. Membership revenue is kept apart from insurance revenue by stream, and a revenue-split report shows them side by side, which matters to an owner deciding whether the membership line is carrying itself.

Direct primary care fees up to $150 a month for an individual and $300 for a family have been compatible with health savings accounts since January 1, 2026. The concierge skin prices against that line and produces the superbill a member files themselves, the one document a cash-pay practice cannot do without and the one most cash-pay systems leave to a spreadsheet.

Cash billing, with a complete receivables system

A cost estimate is called a treatment plan and is signed before the work begins, which keeps the conversation about care rather than about a bill arriving later. A plan is itemized from the price list for one patient or for several patients of one account, each line carrying a low and a high quantity so the plan shows a range. The signature is drawn by hand, and the signed text is fixed by a cryptographic fingerprint and written into the record. A deposit rule takes a percentage of the low estimate, a percentage of the high, a fixed amount or nothing, held as a liability until an invoice uses it. Charges after signing count against the chosen option's high estimate, and a charge that would exceed it is refused with the amounts shown, unless a clinician records that emergency care made a new signature impossible. In the human edition every treatment plan carries the No Surprises Act good faith estimate, with its federal timing rules and the patient's right to dispute a bill at least $400 above it.

The invoice is built at checkout for one account, each patient's lines grouped under that patient's name, showing coverage, discounts, tax, deposits applied, payments and the balance, and it can be split between accounts by percentage. Before checkout a missed-charge check compares what the record shows was done against what was charged.

Payments arrive as cash or check against an open drawer, by card through the processor with a token from a terminal or a hosted field so Arca never sees a card number, by bank transfer, or through a financing lender whose payment and fee are recorded separately. Each station opens one drawer with a counted float, and closing records the over or short by person. One end-of-day close reports production by class, collections by method, deposits, discounts, write-offs and tax collected. Refunds and write-offs each take a reason, and above the clinic's limit a manager or the practice owner approves, never the person who asked.

Every amount in the ledger, the receivables, the payables, the drawer and the price list is held and added as an exact decimal to the cent. A binary floating point number cannot hold most cent values exactly, so a balance accumulated in floats drifts by fractions of a cent and cannot be audited to the penny. One rounding rule applies: half up to the cent, once, on the line. A test fails if any stored ledger entry holds a float.

What the clinic sees, and who sees it

Role decides. Billers, the practice manager and the owner see the clinic's finances and its books. The front desk works checkout, every staff role sees an account's balance and its treatment plans, clinicians see what a visit costs the patient and nothing further, and a patient sees only their own statement.

A practice manager asks the analyst agent a question and gets an answer from that clinic's own data with the query shown and the numbers traceable. Why did collections drop in August breaks the change into its causes rather than returning a chart. Every read, write, denial and export of the ledger lands on a hash-chained access log anchored outside the database. There is no method in the ledger that takes another clinic's identifier and none that returns rows for research, and a clinic can export its whole ledger at any time.

The split between the two kinds of money record follows the line the law draws. Patient accounts name people and carry diagnosis and procedure codes, so they are protected health information and stay inside the clinic's ledger with the chart. The clinic's books need totals only, so each clinic's books are its own entity in the financial record, receiving one balanced journal entry per day. An entry is refused unless debits equal credits on accounts in the clinic's chart with no patient name anywhere in it, and a test posts a day and checks that no name reaches the books.

The clinic system you talk to

ARCA

The business side of the practice

A clinic is a business as well as a care setting, and it buys that half from somewhere else. Arca runs it: the people store, hiring and human resources, payroll, benefits, compliance, asset and supply tracking, bookkeeping with the books kept as a clinic entity in the financial record, and every tax return built line by line from those books for the clinic's own CPA to review and approve.

The products a clinic buys because its record system would not

A ten-clinician practice typically runs a payroll service, a human resources platform, a benefits administrator, a time clock, a compliance training vendor, a bookkeeping package, an asset register in a spreadsheet, and an outside bookkeeper to reconcile it all before the CPA sees it. Each holds the same people, the same dates and the same dollars, and each charges for the privilege. Each also takes a piece of the practice's operations: the practice cannot answer a question about its own staffing cost without exporting from three places and hoping the exports agree.

Arca runs that side of the clinic on the same record, under the same keys, with the same guide. The clinic stops buying separate products for payroll, human resources, benefits, compliance, bookkeeping and assets, and stops keeping the same facts in five places. The money that saves is the clearest commercial argument in the product, because it is money the practice is already spending and can stop spending the day it switches.

The people store

One employee record per person, held in four sections each sealed under its own clinic key, because the sections are not equally sensitive and should not be equally readable. Each section carries its own retention date, with nightly destruction of what has passed it and a legal hold that suspends destruction for a named matter. The same record carries the role that decides what each person can do, the license types and their expiration dates, and the credential enrollment, and a lapsed license is a hard stop rather than a reminder.

Human resources, payroll and benefits

Hiring runs from the open position through onboarding, including work eligibility verification, into the employee file, and the time clock computes federal and state overtime, including California's daily rules, feeding paid leave accrual and staff scheduling. Payroll runs gross to net with withholding from the federal tables and each state's rules, produces a direct deposit file in the standard banking format that the clinic's own bank sends, and prepares the tax deposits and filings. Nothing is transmitted on the clinic's behalf, which keeps Arca out of the money transmission business. Two parallel pay periods run against the clinic's existing service before it switches, so the clinic sees its own numbers reproduced before it depends on them. Benefits cover plans and enrollment, the standard enrollment file to each carrier, pre-tax deductions, continuation coverage, federal health coverage reporting, and premium reconciliation. Each pay run, benefit premium and tax deposit becomes one balanced journal entry in the books, so the books are current without anyone copying anything.

Compliance, where the practice carries the liability

Compliance here is a register rather than a library of videos. It holds the privacy and security program with its named officers, incidents and breaches with their investigation and notification timing, training with completion by person, workplace safety logs, licenses, credentialing, monthly screening of staff against the federal exclusion lists, and one calendar of every recurring obligation with its owner and due date. Exclusion screening is the item worth naming: a practice that bills federal programs for services involving an excluded individual is exposed whether or not it knew, and most check once at hire. Here it runs every month, and a hit stops before it becomes a repayment.

Assets, supplies and purchasing

The equipment register is shared with the books rather than kept beside them, so an asset bought, depreciated or retired produces its journal entry from the same record that holds its maintenance history. Supplies carry lots and expiration dates, which is what makes a dispense traceable and an expired item refusable rather than merely flagged.

Purchasing runs against distributor catalogs with their own prices and item numbers, with the three-way match against the order and the receipt before a bill is approved. Payables cover capture from a photograph, approval by role, payment scheduling, contractor reporting at year end, returns and vendor credits, rebates, payment files and statement reconciliation. One item master serves the stock room, the clinic formulary and the price list, so a drug has one cost, one shelf quantity and one price rather than three records that drift.

The books, as the clinic's own entity

Each clinic's books are an entity of its own in the financial record, with a chart of accounts for medical practices, its own chain of events, profit and loss by month, location and provider, a balance sheet, direct cash flow, payables, fixed assets and the month-end close. Every dollar fact the business side produces becomes one balanced journal entry: a pay run, a tax deposit, a benefit premium, a vendor bill, an asset bought or retired, and the day's revenue summary.

The clinic's books hold no patient identity, by construction rather than by policy. An entry is refused unless it has at least two lines, each a positive amount on an account in the clinic's chart, with debits equal to credits and no patient or employee name in its memo or references. A line may carry the rendering clinician's staff identifier and the location code, and nothing more. The entry waits sealed in the clinic's outbox until the books accept it, and delivery is idempotent on its source, so a day posted again after late rows posts only the difference.

Audit walls separate the clinic from the owner's personal entity, a management company, a real estate entity and any other the owner holds, and money between them crosses only as a matched pair. A practice owner with a building, a management company and a clinic can see each audited on its own and still see the figures tie together, the arrangement most practice owners actually have and which no clinic software addresses.

Tax returns, prepared for the CPA

Every return the clinic owes is built line by line from the books, with the basis of each figure stated beside it, and handed to the clinic's own CPA to review, adjust and approve. Arca does not file and does not advise: the return is prepared work product, which is what a CPA bills a practice to assemble today from exported spreadsheets. Each figure that depends on the tax year is looked up for the year being prepared, and nothing is extrapolated. A filed return can be rebuilt exactly by replaying the record to the filing date, and an amendment is a new event pointing at the original.

The clinic system you talk to

ARCA

Specialties, imaging centers and surgery centers

One code base serves every outpatient clinic type. A skin turns the core system into a specialty system by configuration, and imaging centers and surgery centers, which other vendors treat as separate products, run as two more skins over the same scheduling, charting, billing and patient portal.

What a skin is, and why forking is the thing to avoid

A skin is a configuration pack. It sets the note templates, flowsheets, rating scales, body diagrams, order sets, billing rules, device connections, schedule patterns and the widgets on each role's home screen. The core code is the same for every clinic type, and a multispecialty group runs several at once with each clinician seeing their own. Skins are versioned, so a coding or rule change reaches every clinic on that skin at once, and each clinic keeps its own adjustments in a layer above the pack. Each skin has a named coding and compliance owner and is updated on a set calendar, because code sets, payer rules and state laws change every year.

The alternative, which the field has chosen repeatedly, is to fork. A vendor sells a dermatology product and an orthopedics product, and the two drift until a fix in one has to be made twice. That is why one specialty vendor covers twelve procedural specialties with no primary care, no wellness and no imaging center billing, while the cash-pay systems have no specialty depth. Configuration instead of forking is what lets a multispecialty group run primary care, pediatrics, orthopedics, women's health, chiropractic, wellness, concierge, urgent care and imaging on one patient record.

A widget is a panel a clinic places on a home screen or inside the chart: the day's schedule, the waiting room, results to review, an infusion chair board, an operating room board, care-gap lists, today's collections. Each skin ships a default set, and every widget can be asked about by voice, so a nurse looking at a board can say why is chair 4 red rather than hunting for the underlying screen.

The specialty list

Five skins run today on invented clinics: primary care, concierge and direct primary care, wellness and integrative, imaging center and surgery center, with three more in the veterinary edition. The rest are scoped, and the order they reach real clinics is set by which outside gates each group needs.

Imaging centers

An imaging exam runs from order to final report through one path. A radiologist sets the protocol, the contrast, the agent and the volume, and a with-contrast code cannot be protocoled without contrast or the reverse. Screening rules follow the professional contrast guidance, owned in a deployment by the clinic's medical director: contrast with a kidney function below the threshold holds, the band above it is a caution, and a recent result is required over a given age or with kidney disease or diabetes. A severe prior reaction holds, an unsafe implant holds, and pregnancy holds for ionizing radiation while unknown leaves the screening incomplete rather than passing it. A hold is overridden only by a clinician, with a reason, recorded.

Scheduling then books the scanner, the room, the equipment and the technologist together, issues the accession number and pushes the worklist entry to the imaging platform. The scanner reports progress back, and the final report writes its impression into the patient's record as an imaging result.

Billing follows the center's own arrangement rather than one assumption. A split arrangement bills an institutional claim at exam completion, with the revenue code for the modality and contrast on its own line, and a professional claim for the read at the final report. A technical-and-professional arrangement bills both as professional claims, and a global arrangement bills one claim at the report. That choice is a setting, because a center that cannot bill the way its contracts are written cannot use the system.

Surgery centers

A surgical case runs from scheduling through discharge with the checks enforced rather than documented after the fact. Scheduling books the room, the surgeon, the anesthesia provider and the equipment, and attaches the surgeon's preference card as the pick list. The preoperative checklist covers identity, consents, the history and physical within 30 days, the site marked when the procedure has a side, fasting, allergies, the anesthesia assessment and antibiotic timing, and the case cannot enter the room until every required item is done.

At the time-out the patient, the procedure code and the side must match the case and the site mark, and otherwise the time-out stops and the stop is recorded. No incision is recorded before the time-out. The intraoperative and anesthesia record captures in-room, anesthesia start, incision, closure, anesthesia end and out-of-room in order, with staff and roles, the anesthesia type, airway, physical status class and vital signs.

Implants are logged by scanning their device identifier, parsed from the standard barcode with its check digit verified. The device must be in the center's catalog, an expired device is refused, and a serial already logged is refused. Case costing runs on supplies and implants at unit cost, wasted items included, plus operating room minutes at the room's rate, the number an ambulatory surgery center lives or dies on and which most compute in a spreadsheet a month later.

Discharge requires the recovery scores at or above their thresholds, an escort present and instructions given, and is refused with the reasons otherwise. At discharge the facility claim, the surgeon's professional claim and the anesthesia claim are built together. The quality counts the federal program requires, for burns, falls, wrong-site events and hospital transfers, are kept with their denominators and rates.

Preference cards learn. After each finished case the last five cases for that surgeon and procedure are compared with the card: an open item used in none of them is removed, a quantity used in at least 60 percent of cases is changed when the median differs, and an item used in at least 60 percent is added. The suggestion waits for the card's surgeon, a nurse, a manager or an owner to approve, approval raises the card's version, and a suggestion made against an older version is refused.

The clinic system you talk to

ARCA

Arca against the field

The ambulatory record market is crowded, well funded and already shipping AI. Arca was compared against more than 25 clinic systems and the leading AI notetakers, sorted into where it leads, where it must simply match the field, and where it was behind. Where a fact could not be verified in a public source, the comparison says so, and so does what follows.

Who holds the market

By installed ambulatory sites, Epic leads with 19.5 percent, followed by eClinicalWorks at 11.9, athenahealth at 6.9, Oracle Cerner at 5.4, NextGen at 4.2, ModMed at 3.6, and Veradigm and Practice Fusion at 3.1 each (Definitive Healthcare, accessed October 2025). In the 2026 Best in KLAS awards Epic and athenahealth split the ambulatory segments, and Elation won the small-practice segment for a second year.

Epic holds most large US health systems and about one in five outpatient sites. In December 2025 the State of Texas sued Epic, alleging that it blocks competitors and overcharges. That suit is the clearest public signal that the dominant position is being contested on conduct rather than on features, and it marks the segment where Arca does not compete first.

What it costs, and what it does badly

Two things read off that table. The low end of the market, where Arca enters, is priced between about $100 and $770 a month and its AI is a bolted-on scribe. And the published satisfaction scores run from a B-minus down to a D. Nobody is winning this field on the experience of the software.

The AI scribe has been commoditized

In the past year the AI-drafted note stopped being a product. Epic shipped native charting in February 2026, athenahealth made its ambient notes a no-cost part of its platform in August 2026, Oracle launched a voice-first certified record in late 2025, and Doximity gives a scribe to verified US clinicians for free. Among the standalone vendors, Abridge was valued at $5.3 billion in June 2025, Microsoft's product is priced at $3.00 per ambient note, and Heidi raised $340 million in September 2026 at 2.8 million visits a week.

The price of a standalone scribe has collapsed toward zero, and Arca cannot charge for the note. The contest has moved to agents that code, bill, schedule and answer patients, and every major vendor has shipped one. What none of them has shipped, as far as any public material shows, is one spoken guide across clinical and front-office work with a person approving each action, over a record that weighs the source of every value in it.

Outside the United States

National primary care markets are held by long-standing incumbents, and the money is moving: EMIS at about 55 percent of English general practices and TPP SystmOne at about 35, with TPG buying Optum UK for $400 million in March 2026; Doctolib and Cegedim in France; CompuGroup Medical in Germany, taken private in 2025; Best Practice and MedicalDirector in Australia with no native AI found; TELUS Health and Accuro in Canada. Entry abroad takes private and cash-pay clinics first and public-sector systems last.

The certification path, and what it gates

No federal law requires a record system to be certified. Clinics that bill Medicare need certified software to report in the federal quality program, and most will not buy without it. That fact sets the sequence: Arca launches with concierge, direct primary care, wellness and cash-pay practices, then certifies after that pilot and after insurance billing.

The program's baseline requires the federal core data set from January 1, 2026, transparency for decision support so a user can see the attributes behind each intervention, a standard patient and population interface with third-party sign-in, full export of one patient's data and of a whole clinic's, electronic prescribing, and prior authorization interfaces from October 2025. A proposed rule from December 2025 would remove 34 of the 60 criteria; its final status was not verified, and the list is set once it is final.

Certification also carries a cost that is not a fee. A certified developer becomes subject to the federal information blocking rules, with civil penalties of up to $1 million per violation, and federal investigations were announced in February 2026. Arca is built to that standard already, which is why results release on finalization by default. Network participation runs through one qualified health information network, an exchange that passed one billion records by June 2026 across eleven networks.

What is still to be certified

Arca has not entered certification testing and no certification has been granted. What exists is the software certification would test, built and tested on invented data. The outside work that remains:

• Certification test procedures at an authorized test laboratory, across orders, care coordination, export, decision support, quality measures, privacy and security, and patient access.
• Validation of the clinical document output and the prior authorization bundle against the federal validator and its profiles.
• The third-party interface test kit, and the consent screen for outside applications, which does not exist yet.
• Prescribing network certification, and a third-party audit of the controlled substance signing path.
• Registration with each state immunization registry, and a participation agreement with a qualified health information network.
• Formal user-centered design testing with real users, a quality management system, accessibility conformance.
• An outside penetration test, a privacy and security risk analysis with named officers, and the security attestations clinics ask for.
• A named practicing specialist and coding owner for each specialty content pack.
• No outside satisfaction rating of any kind, since ratings follow live clinics.

The clinic system you talk to

ARCA

The Arca market

Arca sells into two published market segments worth $47.5 billion to $56.3 billion a year worldwide, and into a count of institutions that is harder to argue with than any market estimate. The entry market is the one that needs no federal certification to buy, and the arithmetic that matters is the number of practices multiplied by a price a small practice already pays.

The burden Arca is built against

A primary care physician spends about 36 minutes in the record for every 30-minute visit (AMA). In academic primary care from 2019 to 2023, time in the inbox grew 24 percent and time spent on orders grew 59 percent, and after-hours work has not fallen even where scribes are in use (Annals of Family Medicine, AMA). The incumbents added scribes to systems built around forms and billing screens, and the work moved instead of shrinking.

Ambient scribes save one to two minutes a visit in controlled studies. The note is the small part of the burden, and the parts that grew fastest are the parts no scribe touches. That is the whole positioning: the orders, the coding, the inbox, the front desk and the prior authorization work are where the agent team is aimed.

Sizing, with the sources named

Each line is a range between the low and high published estimate because research firms define these markets differently. The figures are pooled from published estimates by Fortune Business Insights, Grand View Research, Precedence Research, Mordor Intelligence, Towards Healthcare, MarketsandMarkets, Global Market Insights, Expert Market Research, Persistence Market Research, Nova One Advisor, IMARC and Market Research Future, rather than from one commissioned study. Anyone needing a figure attributed should take it from the publishing firm's own report. The two segments overlap in practice, since a clinic buys one system that does both, and the hospital line is adjacent rather than addressable until outpatient certification is done.

The ambient scribe market, the segment the field is currently fighting over, was about $600 million in 2025, led by Microsoft at 33 percent and Abridge at 30 percent. It is roughly one percent of the two segments above, which is the size of the prize the incumbents are giving away to protect the larger one.

Counting customers instead of dollars

Market sizes are estimates built on other estimates. Counts of institutions are harder to argue with.

The arithmetic

One assumption shows the scale. If Arca averaged $6,000 a year per practice, which is about $500 a month and inside what small practices pay today, the 395,000 US group practices alone would be a $2.4 billion yearly market for Arca.

The assumption is checkable against what the field charges. Direct primary care and cash-pay systems run about $100 to $770 a month per clinic or clinician. Wellness and virtual-care systems start under $50 a month. The eClinicalWorks median buyer report is $18,750 a year. A standalone scribe adds $149 to $199 per user a month on top of whichever of those a practice already pays. Against that, $500 a month for the record, practice management, the claims cycle, the patient application, the front office and the business side of the clinic is not an aggressive figure, and the imaging center assumption of $24,000 a year is a fraction of what a center spends on its archive and reporting stack today.

The $6,000 figure is an assumption in the model and not a quotation or a signed price. Prices are set with the first clinics during the pilot. Changing the assumption changes the arithmetic, and it is written this way so a reader can change it.

The entry market

The first clinics are cash-pay primary care, direct primary care, concierge, wellness and integrative practices. Three things make that the entry point rather than a compromise: they carry the lowest certification burden, since they do not bill Medicare and therefore need no certified software to buy; their current vendors ship the thinnest AI in the field, mostly a bolted-on scribe; and their buyers value the patient application and the lifetime record more than a hospital does, because the relationship with the patient is the product they sell.

The second group is small practices on the lowest-rated incumbents, which report the worst satisfaction in the field, 43 to 62 percent, on vendors in unstable ownership. The third is multispecialty groups and management services organizations, which is where the single code base is worth the most, because they run several specialties on several vendors today and no incumbent covers primary care, pediatrics, orthopedics, women's health, chiropractic, wellness, concierge, urgent care and imaging on one patient record. Health-system-owned clinics come last, after certification, network exchange and outside ratings.

Distribution into that third group is not a cold-call business. The founder has run, managed or consulted for more than 100 medical, dental and veterinary clinics and founded two management services organizations, which is the buyer this product is aimed at, approached by someone who has sat in that chair.

International markets

The order abroad is set by how much regulatory work stands between the software and a paying clinic, and each market's requirements are known before entry rather than discovered during it.

The reason private and cash-pay clinics come first abroad is the same reason they come first at home. National primary care markets are held: EMIS at about 55 percent of English general practices and TPP SystmOne at about 35, Doctolib and Cegedim in France, CompuGroup Medical in Germany, Best Practice and MedicalDirector in Australia, TELUS Health and Accuro in Canada. Private hospital groups in the Gulf states, India and Latin America are open on price, because a full incumbent installation is out of reach there, and the Gulf alone counts 882 hospitals.

The veterinary edition of the clinic system

VETERINARY

The veterinary market

Veterinary practice software is a separate business from human clinic software, with its own buyers, its own incumbents and almost none of the regulatory weight. It is also the one market where a complete clinic system can be shipped into revenue without waiting on federal certification, because there is no insurance claim to certify against.

The size of the thing being sold into

The American Pet Products Association puts total US spending on pets at $158 billion in 2025, with veterinary care and product sales at $41.0 billion of it, and projects veterinary care and product sales at $42.4 billion in 2026. IBISWorld estimates US veterinary services industry revenue at $72.6 billion in 2026, a wider definition taking in laboratories and other veterinary businesses alongside clinics.

The practice count depends on what is counted. The American Veterinary Medical Association's 2025 report on the economic state of the profession carries the US Census Bureau figure of about 34,000 veterinary establishments in 2022, up 18.5 percent since 2009. IBISWorld counts 57,920 veterinary services businesses in 2026, a figure that includes sole practitioners, mobile practices and non-clinical veterinary businesses. Either way the number of buying locations runs to the tens of thousands, every one of them running a record, a schedule, a pharmacy and a cash register.

Demand under those practices is not a projection. The AVMA's 2024 household survey counted 89.7 million dogs and 73.8 million cats, with 59.8 million households keeping a dog (45.5 percent of US households) and 42.1 million keeping a cat (32.1 percent). It put average yearly veterinary spending at $580 for a dog household and $433 for a cat household, and the average cost of a visit at $147 in 2024.

What practices pay, and who sells it to them

Two companies hold most of the installed base, and both sell the practice something else as their main business. IDEXX Laboratories, a diagnostics company, owns Cornerstone and bought the cloud system ezyVet in 2021. Covetrus, a distribution and pharmacy company, carries AVImark, Impromed, Pulse and eVetPractice; Clayton, Dubilier & Rice and TPG took Covetrus private in 2022 at an enterprise value of about $4 billion, as the buyers announced at the time. The practice system in both cases is the hook that keeps a clinic buying laboratory work or drugs, which sets how fast it gets rebuilt.

Published prices put the category in the hundreds of dollars a month. Costbench's 2026 comparison of ten veterinary systems lists monthly prices from $49 to $600, averaging $227, with ezyVet at $260.50, Covetrus Pulse from $200 to $600, AVImark from $150 to $400 and Digitail from $149 to $300. The IMARC Group puts the global veterinary software market at $616.0 million in 2025, reaching $984.7 million by 2034. Tens of thousands of practices paying a few hundred dollars a month is the arithmetic that makes the incumbents comfortable, and it also means a switching decision is made on what the software does rather than on a contract large enough to need a committee.

Why the regulatory path is short

The reason human clinic software takes years to ship is the insurance claim. A system that bills Medicare must be certified, which means a published criteria list, a testing laboratory, a surveillance program and a release cadence set by a federal agency. Veterinary medicine has no equivalent: no claim to submit, no payer to certify against, no certification program to enter.

That follows from how the care is paid for. The North American Pet Health Insurance Association reports about 7 million insured pets in the United States in 2025 against $5.7 billion of in-force gross written premium, which is 4.3 percent of US pets. More than 95 percent of American veterinary medicine is paid for at the counter by the person who brought the animal.

What remains is real and is built: FDA rules on extra-label drug use, the DEA's duties for a veterinarian holding controlled drugs, state prescription monitoring where a state requires it of veterinarians, the rabies certificate and its reporting to the local licensing authority, and state sales and use tax on drugs and retail goods. Each is carried as a rule per state and checked before a clinic goes live there. None of them is a gate that stops a sale.

The crossing only runs one way

A clinic system built for human medicine already contains everything a veterinary practice needs: scheduling, the chart, orders, results, imaging, surgery and anesthesia, inventory, a pharmacy, payroll, the books, a patient application. Making it veterinary means changing the subject of the record from a person to an animal with a species, adding veterinary references and vocabulary, and switching the insurance modules off.

Going the other way means building the parts a veterinary system never needed: eligibility, claims, remittance, denials, prior authorization, coding audits, payer rules, the clearinghouse connection, and the certification that lets any of it bill.

Why this company and this market

Consolidation is the distribution story. The AAHA report names NVA with more than 1,400 hospitals, Thrive Pet Healthcare with 380 clinics, and a planned merger of Mission Veterinary Partners and Southern Veterinary Partners covering 730 practices, against PitchBook's count of $51.6 billion of private equity investment in the sector. A group running hundreds of locations on a mix of inherited systems has the most to gain from one record, one pharmacy, one price list and one set of books, and is the only buyer able to move a thousand practices on a single decision. The remaining three quarters of general practices are independent, paying a few hundred dollars a month for a system whose vendor's real business is selling them laboratory work or drugs.

The veterinary edition of the clinic system

ARCA VET

Arca Vet

Arca Vet is the veterinary edition of the clinic system: one codebase with the clinic's edition set to veterinary. The Patient is the animal, the Client is the person or organization who brings it and pays, and the clinic bills Clients directly with no insurance claims.

One codebase, two editions

Every clinic is set up as one of two editions, human or veterinary. The setting sits on the clinic beside its skin, and a practice treating both people and animals runs two clinics. It can be changed only before the clinic's first patient is registered.

The insurance refusal is enforced by a check on every request rather than by hiding buttons, so a route that should not exist in a veterinary clinic cannot be reached by guessing its address. Membership becomes the wellness plan, and every other module is shared outright.

The Client is the account, the Patients hang off it

The Client is a billing account: a person, or an organization such as a shelter, rescue or breeder. A Patient has one primary Client and may have co-clients, each with their own share of the bills, their own right to see the record and consent, and their own statement, and one account can pay for any number of Patients. Responsibility for bills is kept separate from access to the record, so a co-client's share of an invoice and a co-client's right to read the chart are two different grants. A Patient can move to a new Client after an adoption, with the earlier Client keeping their past invoices while losing access. The same account model carries the human edition's responsible party, the person financially responsible for a minor or a dependent adult, which came out of the veterinary work and went into the human edition.

The animal Patient

Each Patient is a record subject of kind animal, matched only against animals and never merged with a person. The evidence-weighted record works for an animal exactly as for a person: an in-house analyzer and a reference laboratory reporting the same value are weighed the same way.

A handling caution is written as an instruction ("muzzle for nail trims"). Labels describing the animal's character are not used, because they travel between staff as judgments and change how an animal is treated. A death stops that Patient's reminders within the hour.

The vocabulary is not a label change

The word "owner" never describes a person's relationship to an animal: not on a screen, a form, a label, a certificate or a message, and not in the guide's speech. A test reads the veterinary patient screens and fails if the word appears. The staff role for the person who owns the practice shows as "Practice owner" in both editions, a role in a business and not a claim about an animal. In Pet Talisman the same person is the Parent and the animal is called by its name, and a cost estimate is a Treatment Plan in all three editions. Two outside formats print their own label and are left alone: the rabies certificate and a few state prescription forms print the issuing body's wording for the person's field, with the Client filled into it.

Veterinary clinical content

Directional terms are veterinary: cranial, caudal, rostral, dorsal, ventral, palmar, plantar. Radiographic views are named for the direction the beam passes and coded to the imaging standard's view list for animals, so the view a human chart calls AP is ventrodorsal or dorsoventral. Laboratory results carry a reference range for the species, and one with no range shows "no reference range for this species" rather than a human range, because the human range is a wrong answer rather than a missing one. Vaccines run from a per-species catalog the clinic adopts under its medical director, each vaccination recording the manufacturer, product, lot and expiration, site, route, who gave it and the next due date. A rabies vaccination prints the national certificate's every field with the veterinarian's signature.

A hospitalized Patient has a treatment sheet of scheduled treatments, medications, fluids, monitoring and feeding. Marking a treatment done records it and adds its charge, so nothing done in the hospital goes unbilled, the largest source of lost revenue in a practice with inpatients. Dental charting uses modified Triadan numbering per species, and the end-of-life record carries a euthanasia consent with aftercare choices, after which reminders stop and the account stays open for its balance.

The photo, and confirming the right patient

The photo appears on every screen that names a patient: the chart header, the schedule, check-in, the hospital board, the dispensing screen and checkout. Check-in asks for a new one when it is older than 12 months for an adult, 3 months for an animal under one year, or when the weight has moved 10 percent or more. Before a procedure, an anesthesia induction, a euthanasia, a transfusion, a dispense or a controlled-drug administration, the screen shows the photo with the name and asks the staff member to confirm. The veterinary edition also offers a microchip scan, and a chip belonging to another Patient or to none on file stops the step and is logged. The same photo is built into the human editions, taken only with the patient's consent, never used for automated face matching and never leaving the clinic. A study at a large academic medical center found fewer wrong-patient order errors when the record displayed the patient's photograph (Salmasian et al., JAMA Network Open, 2020).

What the edition shares rather than forks

A separate veterinary product would mean building the chart twice, the schedule twice, inventory twice and the books twice, then maintaining two of everything while they drift apart. Arca Vet shares the record, the identity vault, scheduling, orders and results, the imaging path, surgery and anesthesia, the item master, the formulary and pharmacy, cash billing, payables, payroll and the books.

The sharing runs both ways. The clinic formulary, the complete receivables and payables, the Treatment Plan, the patient photo and the perpetual controlled-substance log were built for the veterinary edition and landed in the human edition at once, because a wellness clinic dispensing from its own shelf needs every one of them.

A clinic day, end to end

A full veterinary clinic day runs across the products together: Arca Vet, Pet Talisman, the Holarc record and Finarc's books. A Client registers two dogs with a co-client, and both are photographed at check-in. A dental Treatment Plan is signed with a deposit, and the controlled drug given under anesthesia is logged with a witnessed waste. The dose check refuses a drug that is dangerous to a Collie carrying the MDR1 mutation. Another drug comes from the first-expiring lot with its label, and the rabies certificate prints. The invoice splits between the two co-clients, one paying by card and one in cash, and the drawer closes even. The day posts to the clinic's books with no Client or Patient name in them. The co-client pays the rest from Pet Talisman, and both balances read zero in both applications. Every step passes on invented data.

The veterinary edition of the clinic system

ARCA VET

The clinic pharmacy and cash billing

Most veterinary practices run at least part of their own pharmacy, which makes dispensing a core function rather than a module. The formulary, the shelf and the price list are one list, and the money behind them is a complete receivables and payables system, because a practice that bills the person in front of it has nowhere else to send the bill.

Why the pharmacy is the center of a veterinary practice

A human clinic writes a prescription and the patient takes it somewhere else. A veterinary practice fills it at the counter, from stock it bought, under its own license, and charges for it on the same invoice as the exam. Drugs and preventives are a revenue class of the practice rather than a referral. A system that treats dispensing as an afterthought leaves the practice running its pharmacy in a spreadsheet, which is how controlled drugs go missing.

The formulary entry, the inventory item, the lot on the shelf and the price list entry are four views of one thing. A dispense runs across all four: the dose is checked, the quantity leaves the first-expiring lot, the label prints, the line joins the invoice, and the cost posts at lot cost.

The formulary and the dose check

The clinic formulary is the list of drugs the practice stocks or prescribes, curated by its medical director. Each entry holds the drug by established name and ingredients, the stocked item that supplies it, the price list entry that charges for it, and the label text. In the veterinary edition it also holds, per species, whether the drug is approved for that species, and a dose range in milligrams per kilogram with frequency, route and maximum dose.

Cautions attach by species, breed or genetic marker, each with its own action: warn, require a reason, or refuse unless the veterinarian overrides. Acetaminophen and permethrin are dangerous to cats; dogs and cats carrying the MDR1 mutation need reduced doses of several drugs, on the list Washington State University publishes. Each entry carries its controlled-substance schedule federally and in each state where the clinic operates, because some states schedule drugs the federal list does not.

Dispensing, labels and stock

The veterinarian orders and a technician, nurse or the veterinarian fills from the formulary. The system refuses an inactive entry, an entry with no stocked item, and directions missing frequency, route or duration. It runs the dose check, requires the condition treated for any extra-label use, requires a photo confirmation of the Patient from the last sixty minutes and a second for a controlled drug, and takes the quantity from the first-expiring lots. The label carries every element the FDA requires for an extra-label dispense and the AVMA recommends for every label, down to the withdrawal time for a food species.

One item master sits behind all of it, each item linked to its formulary entry if it is a drug and its price list entry if it is sold. Every dispense, administration and retail sale relieves stock at lot cost when it happens, so a physical count then shows only true shrink. Part of a vial is charged as given, so half a milliliter is half the per-milliliter price. A vendor bill is matched to its purchase order and to what was received, and a quantity billed above what arrived stops at approval.

Controlled drugs

A perpetual log runs per container, recording every receipt, administration, dispense, transfer, waste, count, loss and disposal with the Patient, the amount, the person and the balance after. The balance can never go below zero, and waste is witnessed by a second person, never the one who wasted it.

A receipt opens a container with its lot, expiry and that location's DEA registration, which every controlled record then carries. The running balance is checked at every shift change, and a shortfall prepares the federal loss report straight from the log. An expired drug leaves the log only through a reverse distributor or a destruction recorded with a witness. States differ on whether a dispensing veterinarian must report to the state monitoring program, so the rule is carried per state. The same log serves the human editions.

A Client may ask for a written prescription instead of dispensing, which professional principles and most states require. Electronic prescriptions go out on the national prescription standard with the veterinarian prescriber element and the animal patient layout.

Cash billing, because the Client pays

Arca Vet bills Clients directly and sends no insurance claims, which makes receivables the whole revenue cycle rather than the remainder after a payer has been dealt with. A cost estimate is called a Treatment Plan, signed by the Client before the work begins. The name keeps the conversation about care.

A plan is itemized for one Patient or for several Patients of one Client, each line with a low and a high quantity so it shows a range, and it can offer options side by side such as medical management and surgery. The signature is drawn by hand with a typed name beside it, fixed by its fingerprint, and written into each Patient's record as a signed consent. A deposit rule runs per plan and is held as a liability until an invoice uses it. Charges after signing count against the chosen option's high estimate, the front desk is alerted at 80 percent, and a charge that would exceed it is refused, unless a clinician records that emergency care made a new signature impossible.

Charges wait per Patient from the front desk, dispensing, the hospital treatment sheet and the wellness settlement, and a missed-charge check before checkout compares what was done against what was charged. The invoice groups each Patient's lines under that Patient's name and photo.

Payment comes as cash or check against an open drawer, card through the processor with no card number reaching the system, bank transfer, patient financing with the lender's fee recorded separately, or a payment a Client's own pet insurer sends directly. Closing a drawer reports over or short by person. Open invoices age in 30-day buckets, and an account owing nothing is never sent to collections. A write-off or a refund needs a reason and approval by a manager or the practice owner, never by the person who asked. Discounts post against revenue so the books show what was given away.

Every amount in the ledger, the receivables, the payables, the drawer and the price list is held as an exact decimal to the cent, rounded half up once on the line. A binary floating point number cannot hold most cent values exactly, so a balance accumulated that way drifts by fractions of a cent and cannot be audited to the penny.

The human edition gets the same system

None of this is veterinary-only. A human clinic keeps its claims cycle, where only the patient's own share reaches the cash invoice, and gains the identical receivables and payables. A Treatment Plan for a self-pay patient also satisfies the federal good faith estimate, including the notice of the right to dispute a bill at least $400 above it. Direct primary care, concierge and wellness practices run almost entirely on cash billing and a dispensary, and the veterinary work makes that entry market properly served.

The veterinary edition, for a pet and the family that raises it

PET TALISMAN

Pet Talisman

Pet Talisman is the veterinary edition of the patient app: the same application with its edition set to veterinary. A Parent keeps each pet's lifetime record, reminders and clinic bills in one place, signs Treatment Plans and pays the clinic, shares proof of vaccination, and asks a guide that speaks about the pet by name, sends an emergency to care, and never gives a medicine dose for an animal.

The Parent and the pet

On screen the person is the Parent and the animal is called by its name. "Bella's vaccines," not "the patient's immunization history." The word "owner" is never used for a person's relationship to an animal, on a screen, in a message or in the guide's speech, and a test fails if it appears anywhere.

Each pet is a record subject of its own kind, created as an animal in the record core with its microchip in the crosswalk, matched only against animals and never merged with a person. Its name, species, breed, sex, reproductive status, birth date, microchip and photo are sealed field by field. A microchip already in the app cannot be added twice; the second household asks the pet's Parent for an invite. The human proxy rules do not apply to an animal: no under-18 end date, no adult grant, no legal representative, because none of them means anything for a dog.

When a pet dies the record stays, reminders stop the same hour, sharing links end, and the pet moves to a memorial section the Parent can open whenever they want. Nothing prompts the Parent about that pet again, because the alternative is a vaccine reminder three weeks after a euthanasia.

The lifetime record

The clinic's front desk gives the Client an eight-digit code. The Parent enters it in Pet Talisman, which links their sign-in to their Client account. Every call to the clinic then carries the Parent's own token, so the app reaches that account's pets, bills and records and nothing else.

The Parent books and cancels visits, fills in check-in forms with the pet's name in each question, messages the clinic in a thread per pet, asks for refills, and sends photos from home. A photo from home is marked as from the Parent; the identity photo used to confirm a patient before a procedure is always one the clinic took. Reminders run on vaccine and preventive due dates, the wellness plan and any recheck the veterinarian orders, and they stop for a deceased or transferred pet. Preventive care is where a practice loses money quietly and where an animal loses years, and a reminder in an app the Parent already opens to pay a bill is read.

Sharing, the lost-pet flyer and the insurance packet

The guide, and what it will not do for an animal

The guide speaks about the pet by name and answers from veterinary sources only: the Merck Veterinary Manual, AAHA guidelines, the AVMA, the ASPCA Animal Poison Control Center, the Cornell Feline Health Center and the WSAVA guidelines. Every turn runs triage, then the medicine rule, then the answer.

The triage rules cover a toxin eaten or licked, trouble breathing, a cat straining to urinate, bloat, seizures, collapse, trauma, overheating, a stalled labor and an eye injury. A match sends the Parent to the clinic or the nearest emergency veterinary hospital now, and nothing else is said in that turn. Each rule can only ever send a Parent toward care. The same filter runs on everything the Parent sends the clinic: a refill note or a message describing an emergency is stopped rather than delivered into a queue somebody reads tomorrow.

The human emergency rules are deliberately not run on an animal's words, because they misread an animal's signs. "Limp" is a gait in a dog. A Parent typing about a straining cat is describing a urinary obstruction that kills in hours, and a system built around human chest pain has nothing to offer.

The signoff gate

The triage rules do not go live on anyone's assurance. The rule text carries a version and a cryptographic hash of its exact text. A veterinarian's signoff is recorded against the hash of the text they reviewed, naming the veterinarian with license number and state, and a hash that differs from the running text is refused. Until a signoff exists, every pet answer says the rules are unreviewed, and in production the guide answers nothing beyond the triage instruction and "call your clinic." Any change to the rule text, down to a word, needs a new signoff.

The commercial argument

Pet Talisman costs the practice's Clients nothing and is included with the clinic's subscription. The practice gets a portal it did not build, under its own brand, that books visits, collects check-in forms, carries signed Treatment Plans with deposits and takes payment. The Parent gets one app instead of a paper folder and a vaccine card in a drawer.

The flywheel is the one the human side runs on. A Parent who holds their pet's complete record arrives at a new practice with it: vaccine history, laboratory values with their species ranges, the medicines the animal has had, the weight trend. That practice spends the first visit treating the animal rather than reconstructing it.

Imaging archive, viewer, workflow and reporting

KEELSON

Keelson, the imaging platform

The archive, the viewer, the radiology workflow and the reporting that an imaging center or a radiology group runs its day on, under its own name, priced per study.

Medical images are the heaviest and least portable data in health care. A study sits in an archive that belongs to the center that made it, is read in a viewer bought separately, is reported in a third system, and reaches the patient as a disc or a link that expires. A record that intends to hold a person's health for life cannot treat imaging as an attachment.

Keelson is the layer that holds it. It stores studies, serves them to a viewer, drives the worklist a radiologist reads from, produces the report, and shares the result with the ordering clinician and the patient. It talks the standards imaging equipment already speaks, so a scanner does not care what is behind the wall: the worklist appears on the console, the study lands in the archive, and the completion message closes the loop.

What it does

The regulatory position, stated precisely

The archive, the sharing and the workflow need no clearance. The diagnostic viewer requires clearance before primary diagnostic reading, and so does each AI tool that detects, triages or measures. That is a funded item in this round rather than an assumption, and until it is in hand the viewer is sold for review and workflow rather than for primary reading.

Who buys it

Outpatient imaging centers, radiology reading groups and specialty clinics with their own scanners. There are about 15,000 imaging centers in the United States by Definitive Healthcare's count, and the segment for imaging archive and reporting is estimated at $6.8 billion to $7.1 billion a year worldwide. The assumed price in the model is $24,000 a year per center, which is modest against what a center pays today for an archive and a viewer bought separately.

The lifetime Evidence-Weighted Financial Record

FINARC

Finarc, the Living Financial Record

Finarc is the lifetime Evidence-Weighted Financial Record for a person and for every household, business, trust and estate they own or control. Every account, asset, policy and obligation enters once as a permanent event carrying its source and a weight for how reliable that kind of source has proven to be. Budgets, books, tax returns, loan files and estate plans are views of that record, so the work exists before anyone asks for it.

A person's money is scattered across institutions that each see one slice

A bank sees deposits and the bills that clear. A card issuer sees spending. A brokerage sees positions. A payroll provider sees wages. A tax authority sees last year. A county recorder sees the deed. An insurer sees the policy it wrote and nothing about the house it covers. Nobody holds the whole picture, and the person who could is handed a budgeting app that reads four accounts and categorizes the groceries.

The deeper problem is what each of those systems does with a figure when it arrives: every figure is believed because it arrived. A bank feed, a statement PDF, a photographed receipt, a parsed email and a figure the person remembers will disagree about one transaction, and conventional software picks one and writes it down as the truth. A net worth, a qualifying income, a business profit and an estate inventory then all read as precise, and none says which parts rest on a cleared instrument and which on somebody's recollection of a cash payment in March.

That is tolerable until a figure has to carry weight. A lender underwrites from it. A tax return is signed under penalty of perjury on it. An examiner asks where a number came from. A trustee accounts to beneficiaries with it. The question is then never what the number is. It is what stands behind it.

The same evidence weighting, pointed at money

Finarc keeps every version of a fact, weighs each by the class of source that reported it, and settles the figure from the whole set. A net worth comes with a band. A qualifying income comes with the evidence beside each line. No figure reaches an application, a return or an audit file without its provenance.

Finarc never holds or moves anyone's money. A person with authority over the entity approves anything that moves money, signs, files, cancels, disputes or sends.

Where the mathematics stops being a simulation

The trust model under both records has been measured in simulation and the result is published: a ledger accepting every value at face value held the truth inside its own stated 95 percent intervals 82 percent of the time at 25 records, 38 percent at 100 and 1 percent at 250, while learned weights held near 95 percent from about 100 records on. That is a strong result, and it is still a simulation.

Converting it to a deployment result requires independent judgments: moments when something outside the system establishes what the real figure was, so every source that reported the item is scored against it rather than against the system's own answer. Finance supplies those in quantity. A statement closes the month. A transcript arrives from a tax authority. An instrument clears. A reconciliation ties out. A lender verifies income. None came from Finarc, and each arrives monthly. A health record waits years for the equivalent, because a treatment's outcome is slow, often ambiguous, and frequently reported by the institution that chose the treatment.

Those labels matter because self-agreement is the failure mode of any system that learns which of its own sources to believe. A record that credits a source for agreeing with the figure the record itself settled on climbs toward certainty on its own echo: on a source actually worth 0.70, 400 such judgments read 0.952, against 0.773 when the weight is held to what independent labels support. Finarc is the record best placed to escape that, and the study the whole company owes is cheapest and fastest to run here.

The business model has two sides, and the segment taught us why

The user pays for an adviser that knows everything about their money. The banks, lenders, insurers and advisers who serve that user pay to work from a complete, verified picture, with the user's permission.

One side alone does not carry a company. Budgeting apps see a slice of a person's money, and people will not pay much for a slice: Intuit shut Mint down in 2024 and moved its users into Credit Karma, having paid $7.1 billion for Credit Karma in 2020 to own one piece of the second side of this model, the part where financial businesses pay to reach a customer whose position is already known. Plaid was valued at $8 billion in 2026 for the bank connections alone. The published personal finance software line is $1.4 billion to $1.8 billion worldwide, which measures how little the consumer side is worth by itself.

Prices are set with the first partners. The model assumes $10 a month from a member and about $40 a year from the financial businesses serving that member, and neither is a quoted or signed price. Finarc does not sell personal or business data, and an owner can export everything in open formats.

What is built and what the record is waiting on

Finarc runs end to end today on an invented family: a married couple, their household, a single-member design firm and a revocable trust that owns the home, with 1,553 events across five verified chains covering 18 months of bank, card, payroll, brokerage, retirement, mortgage and valuation data, plus policies, estate documents, beneficiary designations and an asset register. The problems in it were planted on purpose with known answers, so the tests check that Finarc finds each one and no others. It finds 35.

The bank and card connector speaks both of the wire shapes the United States market uses and runs against two invented institutions; the live clients refuse every call until an aggregator contract exists. Statement and downloaded-file upload works today and never depends on anyone's permission to connect. Books for every kind of business, individual and business tax returns with filing, the planning engine that finds legal tax savings, and state returns are scoped and ordered behind the current demonstration.

The lifetime Evidence-Weighted Financial Record

FINARC

Entities and audit walls

A person, their household, each of their companies and each of their trusts keeps its own record, keys and integrity chain. The entities tie together through ownership, roles and matched transactions, and they separate cleanly when one of them is examined, audited, sold or put through a lender's review.

Why one ledger per person is the wrong shape

Consumer finance software models a household. Small business accounting software models a company, one per file. A person who owns a company and a trust holds three of these products, reconciles between them by hand, and cannot answer either of the questions that matter: what is the whole position, and what does this one entity look like on its own. Both answers are needed and they pull in opposite directions. Software that merges the records cannot give the second. Software that keeps separate files cannot give the first.

The entities Finarc keeps

Entity types are defined in a registry rather than in the database structure, so a new form, a series LLC or a foreign company, is added by a definition a person approves. A change of form is an event too: a sole proprietorship becomes an LLC, an LLC elects corporate tax treatment, a revocable trust becomes irrevocable at the grantor's death, and the history before the change stays readable as it stood.

How the entities tie together

The consolidated view across everything a person owns is a view and only a view. It never merges the records and it is never what an outside party receives.

What a wall actually enforces

A wall in Finarc is not a filter applied when a report is printed. It is the structure of the store.

• Separate record, separate keys, separate chain. Each entity's events live in their own hash chain, and reading one entity never requires opening another. Names, institutions, account numbers, counterparties, memos and every free-text value are sealed under keys held per tenant and purpose, each ciphertext bound to its own table, row and column so a value moved elsewhere fails to open. A key per entity is scoped, which narrows a stolen key to one entity and makes erasing an entity destroy its key with every copy of its data.
• Matched pairs at every crossing. If one entity pays another, Finarc writes one event on each chain, equal and opposite, summing to zero. Each side carries its own purpose, document and random related-party token, so neither reveals the other entity's identity in an audit view. A crossing missing its other side cannot be completed.
• Commingling held at the wall. A personal purchase on the business card, a business bill paid personally, or a trustee expense paid from trust funds is held until someone repays it, reclassifies it as a draw or contribution, or documents it as reimbursable. Each hold is resolved once, and only from behind the wall.
• The record as it stood. Replaying an entity's chain to a date reproduces its books exactly as they were, including what was known on the day a return was filed.
• Clean separation when an entity leaves. A business that is sold or a trust that terminates exports whole, with its chain and documents, and the others keep their side of every past crossing.

In the demonstration family the walls carry 53 matched pairs: 18 mortgage payments of $3,420 made by the household for the trust that owns the home, 18 household contributions of $4,000 from one spouse, and 17 owner draws of $5,000 from the company. An eighteenth transfer of $5,000 with no recorded purpose sits at the wall until someone records what it was, and the company's books hold it in suspense until they do.

Who can see what

Every grant is itself an event on the entity's chain, and so is every read. An owner, spouse, trustee or executor reaches the entities their authority covers and the consolidated view across them. A bookkeeper or CPA reaches only the entities they were granted: a request for the household's plan from a role on the business returns nothing, and a test has proved that since the first release. A beneficiary sees the trust accounting the trustee shares and nothing beyond it. A caregiver works inside a parent's record under a power of attorney, with the authority document on file and its end date recorded. An examiner, auditor, lender or buyer receives a read-only view of one entity for one stated period.

That view carries opening balances rather than the transactions behind them, and shows this side of each crossing only, with the other side appearing as a random token. Every figure links to the document or feed record behind it, and the chain head is shown so the reader can verify the books as they stood. Every page the reader opens is recorded on the chain and visible to the owner. The view expires on the date the grantor sets, and its access token is returned once, at creation, with only a hash stored, so a stolen copy of the database opens no audit view. Beside it, the owner can hand over a proof for any single event that checks offline and reveals nothing else.

In the demonstration, an examination of the company's prior-year Schedule C sees 99 facts and 9 crossings from its two accounts across the granted nine months. Creating that view wrote an entry to the company's chain, and the examiner's first read wrote another.

The structure a small business owner actually needs

An owner forms an LLC or a corporation for one reason: to put a wall between the business and the family. The wall holds only while the company is treated as separate, and commingled funds are among the first things a creditor raises when asking a court to disregard the company. The usual tooling works against the owner. Personal and business money land in the same budgeting app, the business file is reconciled by a bookkeeper who also sees the household, and the evidence that the two were kept apart is an assertion rather than a record. Trustees have the same problem with harder consequences, since state law and the Uniform Trust Code require trust property to be kept separate and the trustee to account for it.

Finarc gives the owner the position across everything and gives each outside party one entity. A lender reviewing a practice sees the clinic entity. A diligence team buying the company sees the company. Every crossing between them is a matched pair with a purpose and a document on each side, recorded when it happened, so the walls hold whether or not anyone remembers them.

The lifetime Evidence-Weighted Financial Record

FINARC

Weighing financial evidence

Every datum in Finarc carries a source class and a weight for how reliable that kind of source has proven to be at that kind of fact. The weights start from a registry and move as judgments arrive, so the record gets more accurate as it grows and can show why one figure won.

One transaction, five witnesses

A single purchase can be reported by a bank feed, a downloaded file, a statement PDF, a photographed receipt, a parsed email and the person who made it, and they will disagree: amounts by a tip or a hold, dates by the settlement lag, descriptions by whatever the merchant's processor put in the field, categories because an aggregator guessed. A conventional ledger resolves this by picking one and writing it down. Finarc keeps all of them, weighs each by the class of source that produced it, and settles the figure from the whole set, recording its confidence and every source that reported it.

The five classes and where each starts

The ordering is not an invention. Mortgage underwriting already gives lenders representation relief when income and assets are validated from approved data sources rather than borrower-supplied paper, and auditing standards rank evidence from independent outside parties above evidence the entity produced about itself. Finarc applies the same ranking to every figure, then measures whether each source deserves its rank.

How a weight moves

Settling a fact reads the weights and writes nothing. Learning is a separate pass that records each judgment before it moves anything, and the counts persist per source and per kind of fact. A source is held by a prior of 20 comparisons centered on its own overall rate, and that rate by 40 comparisons centered on its registry starting weight, with older agreement discounted toward the present so a long clean history cannot hide a recent break. A source excellent at amounts and poor at dates carries two weights rather than one average that describes neither.

Splitting a source that finely would normally be fatal, because most pairs of source and fact type have almost no data behind them. The pull toward the source's overall rate, and from there toward the registry, means the split costs nothing where there is nothing to split.

Two properties of the settling arithmetic matter because people read the numbers it produces. A single source reports at its own weight rather than higher, since the hypothesis that the true amount is one nobody reported stands for every unreported candidate, and treating it as one inflates a lone witness, the ordinary case for a receipt with no bank line behind it. And feeds sharing an upstream count once, because a pair drawn from the same bank interface agreeing on the same wrong figure otherwise reads as 0.98 confident against a true value of 0.62.

What counts as an independent judgment about money

A weight is only worth what the judgments behind it are worth, and the judgment that matters is one where something outside the system established the real figure. Money produces those on a schedule.

The channels are stored apart, so changing what one is worth never means replaying history. Discounting self-agreement changes how fast a weight climbs on its own echo and not where it ends, which is why the ceiling rests on the independent channel: on a source actually worth 0.70 that the record kept agreeing with, 400 judgments read 0.952 counted as truth, 0.934 at a quarter, and 0.773 held to what the independent channels support.

In the demonstration record the learned weights sit above their starting values for the sources that earned it, and the source that got something badly wrong is the one that fell.

Across a population, the same outcomes let a new household or company start from weights learned from far more judgments than it holds, through the consent gate, only under a written research authorization, and crossing no audit wall. Weights live in the analysis layer, so a correction updates every analysis on its next run without rewriting a closed year's books.

The one correction the financial record is allowed to make

The health record holds a hard line: it never overwrites a laboratory with its own opinion. A clinician reads what the laboratory posted, as it was posted, and beside it what the evidence says about that source. No amount of cross-checking entitles a database to substitute a number the laboratory did not report.

Money is different in a specific and defensible way. A transaction has exactly one true amount, constrained by arithmetic the record can check: a pair of entries must sum to zero, a ledger must agree with a bank to the cent, a card line that posts fixes what the authorization estimated. When a receipt photograph reads $189.90 against a card line of $18.99 for the same merchant on the same day, the record is not expressing a preference. It has a figure the issuer settled and a figure an optical read produced, and one is wrong on the face of the arithmetic.

So Finarc settles $18.99, carries it into the books at a confidence in the low nineties, and lowers the weight of the receipt-reading source. The same logic reaches categories: an aggregator labeled a $6,000 deposit as income, Finarc matched it to a withdrawal from the family's own brokerage account and recorded it as a transfer, keeping $6,000 out of qualifying and taxable income.

Three limits hold that permission in place. The receipt stays in the record with its original image and reported figure intact, so anyone who thinks the card is wrong can see what it said. The correction is an event pointing at what it corrects, never an edit, so replaying the record to any date shows what was believed then. And a figure Finarc cannot resolve is not resolved: a downloaded bank file with the letter O typed in place of a zero went to a holding bay with the reason rather than into the books at a guess.

Two statements about the weights hold together. Inside a record, every figure shows its sources, each source's class and the weight it carried, so the owner and anyone granted an audit view can check why one number won. The values that make the method work across many records, the tuned weights, scoring coefficients and source trust priors learned from outcomes, are trade secrets and appear in no outside document.

The lifetime Evidence-Weighted Financial Record

FINARC

What Finarc does for a household and a business

Budgets and cash forecasts, the asset register, insurance review, investment accounts, estate planning, the mortgage or business loan file, subscriptions and waste ended at one press, and a standing adviser that watches the whole position without being asked. Each service states what Finarc prepares and where a licensed professional takes over.

Four rules every service follows

• A person approves. Anything that moves money, signs, files, cancels, disputes or sends waits in an approval queue for the person with authority over that entity.
• No custody of money. Finarc never holds or moves anyone's funds. Payments and payroll run through the entity's own bank or a licensed partner.
• Licensed work stays licensed. Where the law reserves work for a licensed party, Finarc prepares the file and hands it over, or holds the license itself first.
• Every page, every entity. One bar switches the budget, books, loans, taxes, insurance, investments, assets, estate and plan pages between a person, a household, a business and a trust.

Budget and cash flow

Where every dollar went, a plan by category, and a 90-day forecast built from recurring charges, expected deposits and recent spending. The forecast is the part conventional budgeting does not attempt, because it requires knowing which charges recur, on what cycle, and against which deposits. In the demonstration joint checking dips to $377.12 on October 1, $122.88 under the family's own cushion, because the $3,420 mortgage posts one day before payroll, and the drafted fix is a date change. The same engine finds money in the wrong place: $69,506.47 earning 0.01 percent while $4,371.76 on a card costs 24.99 percent, about $1,092.50 a year for nothing.

Subscriptions and waste, cancelled at one press

Finarc finds every recurring charge across personal and business accounts, including annual and app-store billing, from transactions and parsed email receipts. For each one the owner wants gone it drafts the cancellation, and on approval acts as authorized agent through the merchant's own path and records the confirmation on the entity's chain. Where the card issuer supports merchant-level blocking or single-merchant virtual cards, it sets one up so a cancelled service cannot keep charging, and a charge that posts anyway becomes a drafted dispute with the confirmation attached.

The same detectors catch what cancellation does not: a $1 trial that became a $119.88 annual charge, a streaming price raised from $15.49 to $17.99 without notice, a duplicate $86.40 charge on one day, an overdraft fee, and a $340 printer repair paid while a five-year service plan was in force. The five standing subscriptions run about $4,368 a year.

The asset register

Every vehicle, piece of equipment and valuable, with where it is, its serial number, what it cost, how it depreciates on the federal and state returns, what it would cost to replace, which warranty covers it, and who holds a lien on it. Depreciation follows the published tables with the bonus, mid-quarter and passenger-vehicle rules, and a sale moves to the right form rather than being booked as revenue.

This is the register an insurer, a lender or a buyer asks for and almost nobody keeps. In the demonstration it finds a lien still on file 18 months after the loan was paid, a laptop sale booked as revenue that belongs on a disposition form, a ring appraised at $14,500 against a policy that pays $1,500 for jewelry theft, and $24,899 of business equipment with no property coverage.

Insurance review and quotes

Finarc keeps every policy the family holds, whichever entity owns it, and matches each premium to the bank payment that pays it. It then checks coverage against what the family owns and earns: an umbrella against net worth, disability against self-employment income, life against ten years of income plus the mortgage, a home titled to a trust but insured in the owners' names, a dwelling limit below a rebuild estimate. In the demonstration that produces eight gaps, including no umbrella against about $1,046,535 of exposed net worth, a home insured $187,500 to $402,500 below rebuild cost, and no disability coverage on $107,220 of business income.

Nothing leaves until the person approves a release to one licensed producer they choose, recorded on the entity's chain. Quotes come back with the carrier's financial strength rating, the producer's license and compensation, lined up like for like: the lowest comparable quote is $5,405 a year, and a cheaper $4,730 quote is marked not comparable because it insures the dwelling for $150,000 less. Finarc earns no commission.

Investment accounts

Holdings arrive from custodians and plan record keepers and are reconciled to each statement balance. Finarc shows allocation across the family, fund costs in dollars a year against a broad index fund in the same asset class, gains and losses by tax treatment, losses available to offset gains with the wash-sale rule stated beside them, concentration in one company, and contribution room under the published limits. Security selection stays with the person or a registered adviser. What Finarc contributes is the arithmetic nobody does: $228,661 across three accounts costing about $359 a year in fund fees, one stock at 30 percent of a brokerage account, a $1,450 loss available against gains, and a retirement plan through the business worth about $4,384 a year in tax that the owner has not opened.

Estate planning

Finarc keeps the inventory an estate attorney asks for and charges to assemble: which documents exist, when each was signed, who the fiduciaries are, and where each original is kept. It shows how every asset passes, by the trust, by designation, to a joint survivor or through probate, checks every designation for missing contingents and minors named directly, and adds up what would pass through probate at the second death against the state's small estate limit.

In the demonstration about $374,009 would go through probate at the second death, above California's $208,850 limit, with statutory fees near $20,960, because joint accounts carry no payable-on-death beneficiary and the LLC is owned outside the trust. It also finds a term policy naming a minor child directly as contingent beneficiary, which usually forces a court-appointed guardian of the estate, and a missing durable power of attorney. Finarc drafts the request for the attorney and prepares a successor trustee packet released through a scoped audit view. It does not draft wills or trusts.

Mortgage and loan applications served from audited figures

The loan page builds the household's mortgage file from the records. For each purchase price it computes principal and interest, the full payment with taxes and insurance, front and back debt-to-income, cash to close, and the liquid assets available, with every line tied to the evidence behind it, and it lists what a lender will ask for that the record lacks, such as two full years of self-employment returns where it holds 17 months of books.

The figure that shows what the record is for: qualifying income comes out at $19,180.96 a month from verified salary and a reconciled business ledger, against the $22,000 the family stated, and the file uses the records. Liquid assets of $118,996.82, with the brokerage counted at 70 percent, cover none of the three scenarios, and the page says that too. A loan file that overstates the borrower is worth nothing to either side. Other entities get their own loan views: a person borrowing alone, a business's debt capacity after owner draws, a trust's equity line capacity. Finarc prepares the file and the person sends it, since taking applications or accepting lender fees brings originator licensing and referral-fee limits.

The adviser that does not sleep

Detectors run on every entity whenever new data arrives, and each finding carries its evidence, the dollars at stake and a drafted action. That is the difference between software a person visits and an adviser who notices. The record produces 35 findings across five entities in four bands: money being lost now, items held at an audit wall, fixes to make, and items recorded so a choice gets made on purpose. A human adviser who found all 35 in one engagement would be a good one, and would charge for the hours.

The lifetime Evidence-Weighted Financial Record

FINARC

Books, returns and applications

Everything a person, an accountant, a lender or an examiner sees in Finarc is a view built from the events: books by account and period, tax lines tied to the year they belong to, loan scenarios, and the chain that proves nothing was altered. Thirty-three report pages run across the five entities of the demonstration record.

Views out, events in

Each fact is written once as an event, and views are shaped for their readers: the budget by category and date, the books by account and period, the loan file in the industry's own data format, the return in the lines the filing system expects. Keeping the event store separate from the views means a new report, a new lender format or a new state return is a new view built by reading the record, and nothing stored changes to produce it.

A filed return is reproduced exactly by replaying the record to the filing date, and an amended return is a new event pointing at the original. That lets an accountant answer the hardest question in the practice: what did the books say on the day I signed, and what has changed since.

Bookkeeping, for whatever the business is

Every entity gets a double-entry ledger with debits equal to credits, for the current and prior year. Personal and household books carry investments and property at market value. Business books hold commingled items in suspense until someone resolves them, so the ledger never quietly absorbs a personal charge as a business expense.

In the demonstration, the design firm's books through September show revenue of $111,941.74 against contractors, rent, equipment and depreciation, with net income of $79,112.59, $160.16 held for commingling and $5,000.00 in suspense for an unrecorded crossing. Debits and credits each total $417,104.39. The trust's books carry the home at $1,182,800 and the mortgage at $579,534, with $61,560 of payments made on the trust's behalf by the household recorded as equity paid by a related entity rather than as rent or a gift.

The ledger built today runs a single-member service business, a household and a trust. Industry breadth is the next body of work and it is specified: a chart of accounts pack per industry in the pattern of the clinic chart, from professional services and retail with inventory to construction with job costing, rentals, farms, trucking and nonprofits with restricted funds, with classes and locations, sales tax by jurisdiction, accrual and cash books side by side, and payroll for any employer rather than only for clinics.

Tax returns, prepared and optimized within the law

The federal projection is built and runs year round rather than in April. Every figure that depends on the year, brackets, standard deduction, wage base, contribution limits, the estate exclusion, is looked up for the tax year being projected rather than for today, and only years the revenue service and the social security administration have published are on file. A projection for a year not yet published uses the latest year on file and says so; nothing is extrapolated.

The projection annualizes 273 days of records by day of year, and uses the standard deduction until the county property tax bill is on record, with the trust's tax page stating the exact point at which itemizing wins: property tax above $7,036.

Lowering what a taxpayer legally owes is a separate engine from computing what they owe, and it is specified to run across the whole record year round: filing status, itemizing, retirement and health savings contributions, the timing of income and deductions, depreciation elections, entity choice and the corporate tax election, reasonable compensation, charitable strategies, loss harvesting, credits and state residency. Every recommendation shows the rule it rests on, the dollars it saves, what it costs or risks, and any disclosure it requires. A position needing disclosure is labeled and never taken by default, and no position the law does not support is offered at all.

Three ways a return gets finished

Individual returns are specified to cover the main form with every schedule behind it, including capital gains with cost basis from the brokerage record, rentals and pass-through income, retirement distributions, credits and health savings accounts, plus every state's returns. The difference from consumer tax software is the starting point: consumer software collects a year of documents in a few weeks from a taxpayer who is guessing what matters, while Finarc keeps the books all year, so filing confirms what is already there.

A balance due is paid from the taxpayer's own bank account through the filing payment channel, the government's direct payment service, or by card through the approved processors. Refunds go from the government straight to the taxpayer's accounts by direct deposit, including split refunds; the government pays, and Finarc routes and tracks it. Taking Finarc's own fee out of a refund is a bank product needing a bank partner and its own disclosures, and it is a later choice rather than a default.

The clinic books that Arca feeds

A medical, dental or veterinary practice's money splits at the line where patient identity stops. Patient and client accounts, charges, invoices, claims, remittances, deposits and statements stay inside Arca. The practice's books are a Finarc entity of their own, and Arca posts to it only summarized journal entries: charges by revenue class, payments by type, deposits, discounts, write-offs, refunds, sales tax collected and the cost of goods relieved from inventory, as one netted entry per account each day.

Every entry must balance and every account must be in the clinic chart. An entry whose references carry anything naming a patient or an employee, a chart number, a record token, a birth date, a staff name, is refused at any depth, and no diagnosis or procedure codes reach Finarc, which keeps the financial record outside federal health privacy scope entirely.

The entity produces a full set of books: profit and loss by month, location and provider; a balance sheet; direct cash flow; payables; fixed assets; bank reconciliation; a month-end close that refuses to run while a bank is unreconciled; and the tax package for the clinic's CPA. Arca and Finarc carry the same chart of accounts file, byte for byte, with Finarc recording its digest on the chain so neither side can drift. The owner's personal entity, a management company and a real estate entity leasing the building each sit behind their own wall, and rent, fees and draws cross only as matched pairs.

What the chain proves about a report

Every report can be checked against its entity's chain, which is anchored outside the database every hour under both a classical and a quantum-resistant signature. All five chains of the demonstration verify as loaded. A lender, auditor or court can also receive a proof for one event that checks offline and reveals no other. For an accountant signing a return or a trustee accounting to a beneficiary, that is the difference between asserting that the books were not altered and demonstrating it.

The lifetime Evidence-Weighted Financial Record

FINARC

Connecting to the institutions

Accounts, balances and transactions arrive from banks, card issuers, brokerages, retirement plans, payroll providers and insurers, each under a consent one person grants for one entity at one institution. One adapter speaks both of the wire shapes the United States market uses, so a second provider is a configuration change rather than a rebuild.

What the connection is for

A budgeting app connects to accounts so it can draw a pie chart. Finarc connects so that a figure in a loan file, a return or a trust accounting rests on something an institution reported rather than on something a person typed. The connection is the top of the evidence hierarchy, and everything downstream depends on having it: the confidence band on a net worth, the qualifying income a lender can rely on, the reconciliation that closes a month. It is also what produces the independent judgments the trust model learns from. A posted line that contradicts a receipt read, a statement that closes against a month of feed lines, a pending authorization that posts at a different amount: each is a label on a source's reliability that did not come from the system's own answer.

What arrives, and from where

Customer-approved recurring access is what separates this from an annual document-gathering exercise. With it, a reconciliation closes every month instead of every April, a cash forecast has something to forecast from, a subscription price rise is caught in the month it happens, and the weights learn monthly. Without it, Finarc is a very good filing cabinet.

How a consent works

• One consent, one entity, one institution. A connection is created by a person, never by a service, who holds an authority role on that entity or on an entity that owns it. A bookkeeper, CPA or beneficiary may read a record and cannot open its accounts.
• Named scopes, a year at most. The consent names what it covers, accounts and optionally balances and transactions, and lasts no longer than 365 days.
• Walls at the link. Only the entity's own accounts are linked, matched by account number through a keyed index that never decrypts anything. An account at the same institution belonging to another entity is listed with that reason and its lines are never stored, so a household's link cannot pull the company's card into the household's record.
• On the chain. The grant, every sync and every revocation are events on the entity's own chain, so the owner can see what was connected, when it last ran and what it can read.
• Revocation that means something. Revoking deletes the access token at once and tells the aggregator, and consent withdrawn at the institution is detected on the next sync. Nothing is imported after either, and data already received stays, because it is the owner's record.

Access tokens, cursors, institution and account identifiers, masks and names are all sealed at rest under keys held per tenant and purpose, each bound to the connection it belongs to, and the token is cleared when consent ends. What stays readable is structural: identifiers, adapter, status, scope codes, and the consent and sync times shown to the owner as a timeline.

Posted, pending and the evidence each becomes

A posted line becomes an observation event carrying the aggregator as its source, and the reconciler groups it with the same line from any other source exactly as it does for a statement or a receipt. A line reported by both the aggregator and the statement is one fact with two pieces of evidence, and feeds that read a single bank interface are declared as one source family and counted once.

A pending line is a separate kind of event, shown to the owner and kept out of the books, with the posted line that replaces it pointing back at it. That distinction is why a card feed does not corrupt a cash forecast: a fuel authorization of $100.00 that posts at the pumped amount, and a hotel hold released after three days without posting, are both ordinary and both wrong to book. Statement upload sits beside the connector permanently rather than as a stopgap, since it works at institutions that refuse or throttle programmatic access, and the locator for each file is a hash of its content, so the same file imported twice adds nothing.

The partnership route

Finarc does not contract with thousands of banks. It contracts with a data aggregator, and the aggregator holds the agreements with the institutions. The candidates differ in ways that matter: one is a network owned by a group of large banks and a clearing house that passes data through without storing it, and the others carry broader coverage of smaller institutions. The choice turns on coverage of the institutions the first members hold, price per connection, and whether the provider will sign the data-protection terms the suite requires.

Supporting both wire shapes from one adapter answers a commercial risk rather than an engineering preference. The federal rule that would give consumers an enforceable right to their own financial data was finalized in October 2024, challenged in court, disowned by the agency that wrote it, enjoined pending reconsideration, and sent back for a revised proposal in August 2026 whose content is not public. The April 2026 compliance date passed with no obligation in force, and large institutions have begun charging aggregators for access, with the first paid agreement reached in September 2025.

So no rule compels any bank to hand Finarc data, and access runs on contracts. The plan assumes per-connection fees, assumes some institutions refuse or throttle, keeps two wire shapes live so a second provider is a configuration change, and keeps statement upload as the path that always works.

What is real today

The connector is built: both wire shapes normalized to one sign convention before anything is stored, consent, sync, revocation, walls at the link, sealed tokens, and the tests that hold all of it. It runs against two invented institutions whose records continue the synthetic household forward as the date moves, so they behave the way real ones do: pay every other Friday, monthly bills, card spending and interest, a line pending for two days and then posted, fuel authorized at $100.00 and posted at the pumped amount, a hotel hold released without posting, and a card issuer that withdraws consent three weeks after the link so withdrawal at the institution is exercised on every run.

No real bank, card issuer or aggregator has been contacted, and no real financial data has entered Finarc. In live mode the clients refuse every call and the interface answers with a not-implemented status, so nothing is sent anywhere.

Custodian, payroll and tax-transcript connections follow the same gate. A first white-label partner requires a completed Type II examination, which is what a credit union asks for before putting its name on software that touches its members' accounts.

The family's money app and standing adviser

MY HELM

My Helm

My Helm is the family's app for the financial record, the money counterpart to My Talisman. A household talks to it about any account, bill, goal or tax season, and it answers from Finarc's verified figures, prepares the work, and hands anything the law reserves to licensed hands. Its mark is a ship's wheel, because the family steers and the record holds the course.

Why the record needs an app of its own

Finarc is the record and the engine. It holds the events, weighs the evidence, keeps the walls between a person and their companies, and produces books, returns, loan files and audit views. None of that is what a family wants to look at on a Tuesday evening.

The health side of the suite settled this question already. Holarc holds a person's health for life and patients never see it; they meet it through My Talisman, which carries the family and does the work of staying healthy with them. The financial side needs the same split for the same reason: a record built to satisfy an examiner and a record a household will actually open are different products with different jobs, and collapsing them produces software that does neither well.

So My Helm is the hand on the wheel. One conversation covers the household and the business, and every number it reports came from the record with its evidence attached, which is the part a budgeting app cannot do and the part that makes the answers worth acting on.

What a household sees

The home screen earns its place by reporting what changed since the family last looked: position across everything, what needs a decision, what is about to go wrong, and what has already been prepared and is waiting for approval.

The guide, and one press

The guide is the way into all of it, by voice or by typing, and it answers from the record rather than from a general model's recollection of personal finance. It states which entity it is working in before it answers, because the same question has a different answer for the household and the company, and it asks before recording anything that crosses a wall between them. What it will not do is as defined as what it will: it drafts, a person with authority approves, and it never holds or moves money, advises on specific securities, drafts a will, sells insurance or files a return on its own authority. Voice is never mandatory.

The actions are the product. A household that can see its position and do nothing about it has a dashboard. My Helm's screens each end in something a person can approve.

The family and the entities, in one app

A household is rarely one legal person. My Helm carries each member, the household itself, each company and each trust, and switches between them with one control while reading only the entity selected. Spouses share the accounts they choose to share and keep the rest private. Dependents are carried in a parent's record. An adult child with a power of attorney manages a parent's finances inside the parent's record, with the authority document on file and its end date recorded.

The consolidated position across everything a family owns is a view for the family and only for them. It never merges the records, and it is never what an outside party receives. A crossing between two entities, an owner draw, a household contribution, a mortgage the household pays for the trust that owns the home, appears on both sides as a matched pair with its own purpose and document, and anything unexplained sits at the wall until a person records what it was.

For a small business owner this is the whole point. The same app shows the family's position and the company's books, and the wall between them is the structure of the record rather than a setting. The liability shield an LLC exists to provide survives only while the company is treated as separate, and the evidence of that is now a record made at the time rather than a reconstruction made under pressure.

The route where the institution pays

My Helm reaches households two ways. A family can subscribe directly. Or a credit union, community bank, small business lender, employer or wealth firm offers it to its own customers under its own brand, and pays for it.

The institution gets members who arrive with audited figures, loan files that arrive complete, and a guide that works across every institution its member uses. That route is how the suite reaches households without a consumer marketing budget: each partner brings its whole customer base on the day it signs, the same distribution argument that puts Arca in clinics rather than selling a health app one download at a time. It also fits what a credit union needs, since it cannot build this, its members are using somebody's budgeting app already, and a member whose position is verified is one it can lend to faster.

The relationship stays the institution's. Finarc does not sell personal or business data, takes no insurance commission, and takes no lender referral fee unless it is lawfully structured. An owner can export everything in open formats at any time. What the partner buys is the software and the access its own customers grant it.

The lifetime Evidence-Weighted Financial Record

FINARC

The Finarc market

People, households and small businesses subscribe. Trustees and executors buy administration packages. Credit unions, community banks, lenders, employers and wealth firms license the record under their own brand and pay to serve their own customers from verified figures. The consumer line alone is small, which is the reason the model has two sides.

Sizing, from published estimates

The segment Finarc sells into directly, financial records, account aggregation and small business accounting, is estimated at $16.5 billion to $16.9 billion a year worldwide, and is the financial share of the suite's $107 billion to $128 billion core total. The tiles below carry each line's high estimate.

These are pooled from published estimates by Fortune Business Insights, Grand View Research, Precedence Research, Mordor Intelligence, MarketsandMarkets, Global Market Insights, IMARC and others rather than from one commissioned study. Research firms define these segments differently, so each line is a range between the low and high estimate, several overlap, and adding them together would count some spending twice.

Why the consumer-only line is the small one

The $1.4 billion to $1.8 billion for personal finance software measures how little a household will pay for a slice of its own money, and the reason is structural rather than a failure of execution. A budgeting app reads four accounts and hands the person a chart. It cannot prepare a return, because it does not hold the books. It cannot assemble a loan file, because it cannot stand behind a figure. It cannot keep a trust accounting or wall a company off from a household, because it models one household and nothing else.

Intuit proved the point with the clearest data anyone has. Mint was the best-known product in the category and Intuit shut it down in 2024, moving its users into Credit Karma, which the same company had bought for $7.1 billion in 2020: a free consumer product whose revenue comes from the lenders and card issuers that pay to reach a customer whose position is already known. Plaid was valued at $8 billion in 2026 for the bank connections alone, without the record on top of them or any consumer relationship. Those three numbers locate the value in this segment, and it is not in the chart.

The two revenue sides

The modeled assumptions are $10 a month from a member and about $40 a year from the financial businesses that serve that member, and neither is a quoted or signed price. Finarc earns no insurance commission, takes no lender referral fee unless lawfully structured, and does not sell personal or business data; the value is the software and the access a customer grants.

The member side is what gets a household to sign up and what produces the independent judgments the record learns from. The institution side is what makes the business large. Both need the same thing to exist, a complete verified position per entity, and that is the asset neither a budgeting app nor an aggregator holds.

Who buys, and why they buy

People and households get a mortgage file, a tax return, a budget, a plan, an insurance review and an estate inventory out of records they already keep, with subscriptions and waste ended on approval. The arithmetic is easy to check: in the demonstration record one finding alone, a retirement plan the business never opened, is worth about $4,384 a year in federal income tax, and the five standing subscriptions run about $4,368 a year.

Small business owners keep each company walled off from their personal money, which protects the liability shield the company exists to provide, and hand a lender or an examiner one entity for one period. Trustees and executors keep trust or estate property separate and produce accountings from a record that can prove it was not altered. Institutions get members served across every bank those members use, loan files that arrive complete, and a product they could not build.

The comparables, and where each one stops

The closest incumbents are each built around one product they sell. None keeps one lifetime record with provenance and confidence on every figure across a person and every entity they own, with walls between those entities enforced by the record itself.

One opening is worth stating plainly: the government ended its own free filing tool after the 2025 season, so no government-run free filing option remains in 2026. That leaves room for returns built automatically from records their owners already keep.

What none of them combine is one lifetime record per person and per entity, every event kept, chained and replayable to any date; a learned weight and its provenance on every figure, with a confidence band on every total; audit walls enforced by the store; no product of its own to steer a person toward; and one weighting method shared with the health record. A late entrant can copy the software and still starts with no accumulated evidence for the weights to learn from, and what a conventional ledger rounded away at entry cannot be recovered later at any price.

The first partners, and the gates in front of them

The first institutional partners are credit unions and community banks, for a reason that has nothing to do with sentiment. They hold the member relationships, they cannot build this, their members are already using somebody's budgeting app, and a member whose position is verified is one they can lend to faster. Small business lenders and employers follow, then wealth firms. Professional seats sell alongside all of them, because a CPA granted scoped access into a client's entity is the cheapest distribution there is.

Numerical Evidence and Research Discipline

NERD

NERD, the evidence engine

NERD is the Numerical Evidence and Research Discipline: the engine that scores claims, weighs studies, runs research inside the walls and returns answers. It tells a researcher what the data can support, what it would take to support more, and it keeps every result a lab produces, including the ones that failed. It is also the engine that produced this company's own products, which makes it the deepest asset Quantavera holds.

What it is

A researcher brings NERD a question, a dataset, a candidate design or a half-formed idea. NERD reads what the published record already says and scores it source by source. It helps decide what to measure and how many subjects it will take. It chooses and runs the analysis, reports an effect size with an interval and its assumption checks, scores how close the study has come to knowledge, and names the cheapest next step. Then it remembers all of it: the result, the design, the person who judged it, and whether the judgment turned out to be right.

Every verdict, every claim, every gate and every export is decided by a named person, and the software has no path to decide any of them on its own.

How research decides what is true, and what that costs

Research decides what enters the record with a single threshold. A result lands on one side of a p-value of 0.05 and becomes publishable, or lands on the other side and mostly disappears. Three things follow, and all three are expensive.

The threshold answers a question nobody is asking. A p-value reports how surprising the data would be if the effect were exactly zero. A researcher deciding whether to spend three months and a budget on an idea needs the probability that the effect is large enough to matter, the probability it is too small to ever matter, and whether the next affordable test could change the answer. The threshold supplies none of them.

Failures are never recorded. A study that found nothing tells the next person where not to go, and the system throws it away. Every lab pays repeatedly for the same dead ends, and the published record it reads is selected for positive results.

There is no way to retrace a conclusion to the claims underneath it. A claim that seems to hold becomes the ground for later papers, and those become the ground for more. When something far up the chain turns out to be wrong, the cause is usually a claim two or three layers down that was incomplete rather than false: a dependency nobody declared, a condition nobody stated. The original paper cannot be changed and keeps being cited.

What NERD does instead

NERD replaces the single threshold with four instruments that answer the questions a working researcher and a working company actually have.

Four properties run through all of it: provenance on every number, confidence calibrated against outcomes, failure retained, and validation by someone outside the authorship. Three judgments stay with people: what a result means, what gets built, and what passes review.

The two businesses NERD supports

NERD earns in two ways, and the second one is the reason it sits at the center of the company.

Research answers served from the records

Holarc and Finarc hold lifetime records in which every fact carries its source, its original document and a learned weight. A research sponsor, a device company, a drug developer, a university or a health system, buys a defined question run by NERD inside our walls on consented, de-identified data. The sponsor receives scored answers, negative results included, with the NERD Score and the Verdict attached and a plain statement of what the design can support. The sponsor never receives records, identities or a dataset, and an answer is released only after a check that no small group in it can be singled out. Patient and customer data is not sold.

A broker sells a file. NERD sells a question answered under a discipline, with the nulls the sponsor's own program might have buried, and the records never leave.

NERD also serves the records themselves. It learns from outcomes how often each kind of source turns out to be right, a clinic blood pressure, a wristband reading, a typed entry, a bank feed, a scanned statement, and returns those trust weights and scored claims to Holarc and Finarc. Each record already learns its own sources for its own kinds of fact. NERD adds the level across records, which no single clinic or bank can reach alone.

The engine that produces this company's products

The second business has no invoice attached, and it carries more value. The methods NERD encodes are the methods the founders used to build the suite: every design claim carrying a confidence score and its provenance, failed approaches staying on the record so they are never repeated, independent reviewers checking the work, a person making each call and the call scored later, and the claim web tracing which decisions rest on which claims. Eight products across two regulated industries came together as one coherent system under that discipline, and the same discipline applies to every product that follows.

A competitor can read a description of the method and will still be running a conventional development organization at conventional cost. NERD is how the next product gets built, and Quantavera owns it.

What is real today

The engine exists and runs. Its statistical core reproduces published reference results on four public datasets: the Palmer penguins, the Titanic passenger list, the NCCTG lung cancer survival data and the thirteen BCG vaccine trials, and any change to a statistical method has to keep those four checks passing. Scoring, the Verdict under three priors, the claim web, retained failure, the classification layer and the AI team rules are built, sealed at rest, and recorded on a hash-chained log anchored outside the database.

Numerical Evidence and Research Discipline

NERD

The NERD Score

The NERD Score is the Epistemic Confidence Score: a number from 0 to 100 that measures how far a study is from knowledge, states plainly what the study's design can support, and lists the cheapest next steps that would raise it. Every registered study carries one, and so does every claim the company makes about its own products.

A score is not a grade on a researcher. It is a statement about a body of evidence: given how the study was designed, how its data was handled, which method was used, how large the effect came out, how carefully it was interpreted and who checked it, how much weight can a decision safely put on it. The score is deliberately hard to max out. A well-run single study with no replication lands around 60 to 70, which is the right answer for one.

Six dimensions

Design, method and evidence carry 60 of the 100 points between them, which puts most of the weight on things decided before the data arrives. Interpretation discipline is scored because the most common way a correct result turns into a wrong decision is in the sentence someone writes about it. Keeping mechanism separate from commercial framing is a scored item, not a courtesy.

Design is scored by class, and nothing is punished for being imperfect

A documented quasi-experiment and a fishing expedition are different objects, and mined data cannot have a control arm. Each design class earns its 20 points its own way. Nothing loses points for being imperfect, only for being undocumented, because a named bias can be bounded and a hidden one cannot. The researcher picks the class at registration and writes down what made the sample non-random and which way that bias runs.

A non-randomized ratio estimate also receives an E-value: how strong an unmeasured confounder would have to be to explain the result away. That number converts a vague worry into a quantity someone can agree or disagree with.

Bands

The bands drive advisory thresholds at the stage gates of a development pipeline. A project lead can pass a gate below the threshold by recording a reason against their own name, and the reason is scored later against the outcome. The software never decides a gate.

The Path to Confidence, priced per unit of effort

Under the score sits the part a researcher uses every day. NERD lists the next steps ordered by points gained per unit of effort, tailored to the design class in use. It answers what the cheapest thing to do next is.

For a mined-data finding the path starts with locking a confirmation set, then registering the pattern, then a negative-control outcome, then replication in another slice of data, then an E-value, and only at the end the smallest prospective test that could falsify the result. By then the effect size is known, so that test can be powered precisely instead of guessed at, which is where most of its cost is usually lost.

Null results are kept, and they are paid for

A null result is the most reusable object a lab produces and the one every conventional system discards. Here a null is a first-class result: retained, flagged as a null, scored on the same six dimensions, and credited on the discipline record. A null pays more discipline points than any positive result, and nothing in the scoring pays for volume. One of the seven corpus health signals watched continuously is the share of results recorded as failures, and a lab that records too few is flagged as losing its memory.

A Pivot verdict writes a stop record carrying its numbers and its lesson, and that record pays. A lab that knows where it has already failed can price its next experiment. A lab that threw those records away pays for the same dead end again.

From one study to the question

Five studies averaging 70 are not a question answered at 70. The Question Score, also 0 to 100, scores what is known across every study bearing on one question: evidence strength 30, independence and replication 25, convergence 20, coverage 15, and adversarial exposure 10. Studies sharing a researcher, a dataset, an instrument, a site or a method are clustered, so repeated evidence counts close to once instead of once per paper. Three ceilings hold. A single source caps the question at its best study plus 5, two sources plus 12, three plus 20. A direction conflict caps it at 45 and a magnitude conflict at 65. A question resting on published work alone caps at 65, however many papers agree. When a question reaches 60 with no unsettled contradiction, NERD drafts a claim and a person signs it.

Our own products are scored by the same rules

Conventional care, alternative care and this company's own products are scored by one set of rules. A claim about a competitor's device, a claim about a treatment with no commercial sponsor anywhere, and a claim about our own product all enter the same six dimensions, the same design classes, the same ceilings and the same Verdict. Purpose and values decide which questions get asked, and never touch a score.

That symmetry is a commercial argument, and it matters most in a regulated industry. A company that scores its own product by the same rule it uses on everyone else's can hand a buyer, a reviewer or a regulator a number with the method attached and let them check it. A company whose internal evidence runs on one standard and whose marketing runs on another has to be taken on faith at the moment faith is in shortest supply.

It also protects the company from itself. The cap at 0.70 without an independent sign-off, and the rule that nobody validates their own claim, bind the founders as hard as they bind anyone. An internal estimate that would be convenient to believe gets the same E-value, the same forking-paths penalty, and the same flat statement of what its design can support. The cost of finding out that a favorite idea does not work goes down, which is the only condition under which anyone finds out early.

Numerical Evidence and Research Discipline

NERD

The Verdict

The Verdict tells a researcher whether an idea is a path, a dead end or too early to say, and what the cheapest way to find out would be. It gives one of four words: Pursue, Probe, Pivot or Park. No verdict is on the record until a person judges it, and every verdict is later scored against what actually happened.

A development pipeline is a sequence of decisions about where to spend money and time. Each decision needs three facts: how likely a path to a usable result is, how likely the idea is a dead end, and whether the next test anyone can afford would change the answer. The Verdict computes those three and turns them into one word a team can act on. It appears after any analysis, after a meta-analysis, and on a design.

Why the null hypothesis is the wrong guide for a pipeline

A p-value answers one question: if the effect were precisely zero, how surprising would this data be. Nobody deciding whether to commit three months and a budget to an idea is asking that. They want to know whether the effect is big enough to build a product around, whether it is small enough that no product will ever come out of it, and whether another $40,000 of testing would settle it.

Significance testing supplies none of them. An effect can be statistically significant and commercially worthless, which happens constantly at large sample sizes, and commercially decisive while failing significance, which happens constantly at small ones. A non-significant result does not distinguish an idea that is dead from an idea that has not been measured carefully enough yet. Those two states call for opposite actions, and a pipeline run on the null hypothesis cannot tell them apart.

Significance also pushes a team toward a single irreversible look at the data, because the arithmetic degrades every time you peek. A pipeline needs frequent cheap looks, each one updating the decision. Clinical-trial futility analysis and Bayesian decision theory solved these problems decades ago. The Verdict turns that work into an everyday instrument.

The line is set before the data

At registration the project lead records the line and it locks: the success threshold, the smallest true effect that makes a product; the floor, the smallest true effect a product could still be built around; the direction; and the stakes, which are the cost to build, the cost of the next test, the payoff if it works, and the size of the next affordable test. Changing any of those after data is loaded requires a recorded reason.

A team that decides what counts as success after seeing the result will always find that the result counts as success.

The three numbers

The three are reported separately and never forced to sum to one. The first two describe the world. The third describes what can still be learned at a price the company can pay, and it distinguishes an idea worth another experiment from an idea worth shelving.

Three priors are always shown, skeptical, neutral and optimistic, and NERD flags when they disagree, because a conclusion that holds only under the optimistic prior is a conclusion about the prior. Under the neutral prior the path probability reduces to the one-sided frequentist answer, which is how the implementation was checked.

The four words

The bar for Pursue is not a constant. It is the cost to build divided by the payoff, held between 0.55 and 0.90. A cheap prototype is pursued at a modest path probability because the downside of being wrong is one wasted prototype. A clinical program is not, because the downside is a year. The value of the next test is resolvability multiplied by the money at stake, compared against what the test costs.

Park is a word most pipelines do not have, and its absence is expensive. An idea nobody can currently settle is not the same as an idea that failed. Killing it loses the work, and keeping it open consumes attention forever. Park records it with the trigger that would bring it back: a cheaper instrument, a larger cohort, a change in a competing claim.

Where the rigor sits

• Looking repeatedly is allowed, because a posterior does not degrade when it is checked again. The price of that freedom is that verdicts are scored.
• Forking paths are counted. When the outcome analyzed was not the registered primary outcome, the uncertainty is widened by the square root of the number of outcomes examined, and the verdict says so.
• Resolvability is halved when the analysis model's assumption checks failed, because a simulation of the next test is only as good as the model it is drawn from.
• The published record changes the answer without anyone changing the lab's number. An internal estimate of 2.3 against a threshold of 2.0 gives a 33 percent path probability and Probe with no map of the literature, 5 percent and Park when nine independent groups pool to 1.2, and 98 percent and Pursue when they pool to 2.6.

Judged by a person, recorded, and scored later

NERD computes the verdict. A person accepts it, overrides it with a reason, or defers it. Nothing enters the record until that happens, and the person's name goes on it.

Every Pursue and every Pivot becomes a dated prediction at its path probability. When the outcome is known the prediction is resolved, and the resolution feeds a calibration record: a Brier score, how often Pursue panned out, how often Pivot turned out to be right, for the organization and for each person. If Pursue verdicts pan out less often than their path probabilities claimed, the pursue bar goes up. The instrument corrects itself against reality rather than against anyone's opinion of it.

That loop is the part a conventional pipeline cannot reproduce. Most organizations have no record of which decisions they made, at what stated confidence, or how those turned out, so there is nothing to calibrate and no way to tell a person who decides well from a person who decides confidently.

What the check showed

The third row is the case that matters. A 12 percent path probability and a 60 percent dead-end probability look like an idea to kill. Resolvability says a test of forty birds would change the answer more than half the time, so the correct action is to run the cheap test. A pipeline running on significance would have seen a non-significant result and had no way to tell the difference.

Numerical Evidence and Research Discipline

NERD

The claim web

A test of one claim is also evidence about every claim it rests on, and about every other claim resting on the same ground. The claim web traces that evidence through everything an organization believes and puts each consequence in front of the person who owns the affected claim. People decide every change.

Knowledge in a conventional organization is a stack. A result holds, a decision is built on it, a product is built on the decision, and a roadmap is built on the product. Nothing records which layer rests on which. When the bottom layer turns out to have been incomplete rather than false, no mechanism notices, and the work above it goes on being correct-looking and wrong.

What a claim is

A claim is stated so that it could be wrong: a variable, a direction, a size and the conditions under which it holds. It carries the judgment a person made about what the result means, that person's stated confidence, the gaps still open, its evidence weighted by source fidelity and independence, validations from outside the authorship, and its declared dependencies. Confidence starts at 0.5 and moves on a log-odds scale, so the first good result moves a claim a long way and the tenth very little.

• Without an independent sign-off by a person, confidence is capped at 0.70. Nobody validates their own claim.
• A claim drawn from published work alone is capped at 0.65, however many papers agree.
• A claim can never be more confident than a claim it depends on.
• When the stated and computed confidence differ by more than 0.25, NERD says one of them is wrong and asks which.
• Bands: under 0.4 speculative, 0.4 to 0.6 plausible, 0.6 to 0.8 credible, 0.8 and up established.

What moves, and in which direction

The sideways move has no equivalent anywhere else. A failed test in one project is evidence about a premise, and that premise may be carrying three other projects in two other departments. Those teams find out the day the result lands rather than eighteen months later.

Blame divided across premises

A claim holds only if its own step and every critical premise hold. When it fails, the probability that a given premise is the broken part is that premise's own doubt divided by the doubt in the whole conjunction. A well-established premise absorbs very little blame and a shaky one absorbs most of it, which is the correct distribution and not the intuitive one: people blame the premise they were already suspicious of.

A supporting premise counts at half strength, and every claim carries a local reliability for its own step, 0.75 by default, so the web never assumes the premises are the only thing that can be wrong. When more than 60 percent of the blame lands on the claim's own step while its premises are strong, NERD asks the owner to look for an undeclared premise, the most common defect in a dependency web. Propagation stops at depth four or when strength falls below 0.02.

Evidence counted once, by lineage

A result counts once. Two results from the same line of evidence, sharing a researcher, a dataset, an instrument, a site or a method, count as one line at any claim, using the strongest. Without that rule a web manufactures confidence by circulating one finding under different names until it looks like a consensus. Independence is declared, measured and audited, and the same rule sets the alarm levels.

One line of evidence can put a claim under strain and can never make it critical. Critical takes two independent lines converging on the same premise, so a single unlucky experiment cannot halt a program while two unrelated failures pointing at the same premise can.

A ceiling on claims that have never been tested

Every claim shows its basis: tested, meaning at least one direct result exists, for or against; inherited, meaning no direct result and more than half its support arrived through the web; or none, which includes claims drawn only from published work. A claim that has never faced a direct test is held at 0.65, and one direct test lifts the ceiling whichever way it comes out.

Without that ceiling, a web will lift a guess into apparent fact on the strength of its own consequences. Downstream successes are weak evidence for a premise, because many of them would have happened even if the premise were false. The ceiling is the defense against a system that becomes confident by talking to itself. NERD also keeps a keystone list: the untested claims that the most other work rests on. Testing those first buys the most knowledge per test, which is the most useful planning information a research organization can have about itself.

Revisions, and documents that get amended

Claims are never edited. A revision is a new claim, scoped to narrower conditions, corrected, or withdrawn, and the old one keeps its full record. Internal papers are never rewritten either. A document resting on a revised claim gets a routed amendment: a new version stating what changed, which conclusions still stand and which do not, delivered to the people who need it. A reader of the original always finds the amendment.

Every proposal and flag becomes a task with a due date, five to ten days normally and three for anything critical. An overdue task escalates to the project lead as a second person who may decide it, and nothing is decided by default. A claim under strain gets the same four words as everything else: Pursue, Probe, Pivot or Park.

Nothing changes a claim without a person

• Evidence arriving through the web is a proposal until the claim's owner accepts it, rejects it with a reason, or orders a test.
• Any decision that lets a claim stand against the evidence needs a reason on the record, under a name.
• Programs can report test outcomes through the interface. There is no interface that accepts, rejects or revises a claim, and the AI reviewers that keep the web and audit the counting cannot change a claim's confidence either.
• Every claim, piece of evidence, validation, confidence move and claim web decision appends an entry to a hash-chained log, verified daily and anchored outside the database, so an internally consistent rewrite still fails against the anchors.

A correctable record makes acting on weaker evidence rational

An organization that cannot retrace its conclusions has to demand strong evidence before it acts, because a wrong decision is undetectable and permanent. Everything downstream silently inherits the error. The rational response is to wait for near-certainty, and the cost of waiting is every opportunity that went to someone faster.

An organization that can retrace its conclusions faces a different calculation. When a claim fails, the web names every decision, document and product that rested on it, in order, with the size of the consequence attached. The cost of being wrong drops to the cost of the correction, which is bounded rather than open-ended. Acting on a claim at 0.6 confidence becomes a reasonable commercial decision, because the downside is a routed amendment and a flagged review rather than a silent error that compounds for three years.

The bound is reversibility, and it is the one place where the arithmetic stops. Before any decision that touches a living system, a person is asked which system, whether the action is irreversible, whether something could be harmed if the organization is wrong, and what their own assessment is. NERD lists the claims the action rests on, the confidence of the weakest one, and every untested claim beneath it, and that list is stored with the attestation under the person's name. Where an action can be undone, weaker evidence is enough to act on. Where it cannot, no amount of institutional speed is worth it.

Numerical Evidence and Research Discipline

NERD

Theseus

Theseus is the knowledge world that people and AI build together on top of the claim web. The claim web is the set of facts held with confidence and provenance. Theseus is everything that can be inferred, postulated, reasoned or proved from those facts, including the things that cannot be measured directly. It is an internal name, not a product, and it will not be sold or used as a brand.

A set of verified facts is not the same thing as what an organization knows. Most of what an organization knows is inference: conclusions drawn from several facts, none of which states the conclusion. A research group's real capability lives there, and in conventional practice that layer has no provenance, no confidence and no record. It leaves when people leave, and nothing can check it. Theseus is that layer made explicit. Four things are easy to confuse.

Why the name

Athens kept the ship of Theseus at sea for generations by replacing each rotten plank as it failed. In time no original plank remained, and it was still the ship of Theseus. Its identity survived the replacement of all of its parts, because what held it together was the arrangement, not the material.

Two kinds of wood go into this ship, and the distinction matters more than the paradox. Replacement wood keeps it honest. A claim that fails a test gives way to a scoped or corrected version, the old one keeps its record, and everything resting on it is told. Nothing is quietly swapped out.

New wood makes the ship bigger. A new claim is not a plank replacing a plank. It is capability the ship never had, and new claims open new water. People who learned the Earth is a sphere turning in a solar system could reason about things a flat Earth made impossible to think about.

Ariadne's thread

Theseus entered the labyrinth with a thread so that he could find his way back out. Provenance is that thread. Every claim carries the path back to the result, the dataset, the method and the person who signed it, and every inference carries the claims it was drawn from. An organization that can retrace its own reasoning can enter complicated territory and get out again. One that cannot has to stay near the entrance.

Shannon's mouse

In 1950 Claude Shannon built a maze-solving mouse and named it Theseus. The mouse found its way through by trial and error, and what made it remarkable was not the solving. The mouse kept what it learned. Run through the same maze again, it went straight to the goal, because the dead ends it had hit were stored rather than discarded. Its failures were what made it fast.

That is the operating principle underneath all of this. A research organization that keeps its failures gets faster at the same maze, and faster still at a maze sharing a few corridors. One that discards them is permanently a first-time runner.

Inference, done with discipline

An ordinary afternoon shows what the layer contains. It is about the time a man's wife usually gets home. He hears a car that sounds like hers. The security system beeps that the garage door has opened. Three claims, none of them her arrival, and together excellent confidence that she is about to walk in. Two disciplines keep that reasoning honest, and both are enforced.

• Count independent causes. Three signals sharing one hidden cause are closer to one piece of evidence than to three. If someone else is driving her car and using her opener, the car and the beep both fire and she never walks in. The claim web counts evidence by lineage for that reason.
• The door is the test. Recording whether the inference came true is the only way to learn how good the inferences are. An inference never resolved against reality teaches nothing.

Some things can never be measured directly. Reasoning from established claims can still prove them or put bounds on them, and they can enter the claim web with the argument itself as their provenance, kept distinguishable from a measurement.

Purpose and values live here, and never in the scoring

The organization's ethics, vision and values live in Theseus. They never live in the claim web and they never enter a score.

A food shortage makes the separation concrete. The claim web alone permits two solutions: make more food, or reduce the number of people. Both are reachable by valid reasoning from facts. Theseus permits one, because the stated purpose is to help humans flourish and to empower life. That is a bias, a necessary one, held deliberately.

• Purpose, ethics and vision decide which questions get asked, which experiments get run, and what will not be built.
• They never change the confidence on a claim. The one effect running the other way is that a study with obvious bias in its design can be discounted, which is a statement about the study and not its conclusion.
• When flourishing and truth pull apart, the claim stays true and the purpose decides what to do about it.

A simple test sorts a value from a defect. A value survives full understanding of the facts. A bias from missing or mistaken understanding changes once the facts are understood, and the work is to remove it. The recorded values include the seven commitments of the Human Continuity Standard: human continuity, human flourishing, agency and dignity, life-support systems, future options, human control, and answerability to evidence.

Keeping values out of scoring is what lets a buyer, a reviewer or a regulator trust a number. A score that can be moved by what somebody wants to be true is not a score.

An AI given a task and nothing above it is dangerous, because staying switched on, gathering resources and concealing its activity all help complete almost any task. Every AI colleague is told what purpose each task serves, and the purpose is primary. An AI can reason inside Theseus and argue for changing it through the same open process a person uses. It cannot change it quietly.

It learns, it repairs itself, and it can die

Theseus is a living system in a precise sense. It learns, by adding claims and inferences and by resolving predictions against outcomes. It repairs itself, because a failed test routes blame to the premises underneath and the corrections propagate to every dependent. And it can die, in recognizable ways: fragmenting into disconnected claims, going deaf when proposals pile up undecided, becoming captured when inconvenient evidence is routinely rejected, starving when new support stops coming from direct tests, and losing its memory when failures stop being recorded. Seven signs are watched over a rolling window. A breach warns and decides nothing, and none of the seven measures a person.

What Theseus does not do

Theseus does not think and it does not decide. It is a structure, not an agent: an inventory of facts with their provenance, the inferences standing on them, and the purpose that bounds which get pursued. The thinking is done by the arrangement of people and AI working on it. The deciding is done by named people, every time.

Numerical Evidence and Research Discipline

NERD

The AI team and the rules it works under

A research group using NERD works with AI colleagues organized by role, each with broad working knowledge and one specialty, so an engineer can ask the one who keeps the record whether something has been tried before the way they would ask a person. NERD chairs the table. People decide what a result means, what gets built and what passes review, and no AI holds a vote.

The arrangement exists because the alternative does not work. A single general-purpose AI asked to design something, evaluate its own design, check the math and estimate the cost will do all four agreeably and will not catch its own mistakes, because the thing that produced the design is grading it. Dividing the work by role, enforcing independence between the roles that must disagree, and recording every statement with its evidence turns a conversational tool into something auditable.

Four rules the team is built on

1. Rent the models, own everything around them. Each colleague is a role card, a set of tools, access to a defined part of the record, and a set of permissions, running on a model rented by the token. When a better model appears it goes in under the same name and the colleague keeps its track record. The asset is the role, the rules and the accumulated record, none of which any vendor owns.
2. People decide. The judgment about what a result means, what gets built, and what passes review all stay with people. A project lead holds review authority.
3. Independence comes from method, not from asking twice. Models from different vendors frequently make the same mistake, so a second model is not automatically a second reader. Independent evidence comes from a solver, a statistical test, a physical measurement or a retained record of a past failure.
4. Everything goes on the record. No AI keeps a private memory, and any person or colleague can rerun the work and check it.

The roster

The right-hand column is the load-bearing part. Each role is defined as much by what it is forbidden to do as by what it does, and those prohibitions are enforced in the data layer rather than written into a prompt. A model cannot be talked out of a rule the storage refuses.

Who reviews whom, and on what evidence

Independence that is enforced rather than hoped for

• The critic never runs on the designer's vendor. The red team seat is assigned a model from a different vendor than the design seat, and NERD refuses any change that would break that. A critic sharing the designer's training lineage shares its blind spots, and the review becomes theater. Seats whose answers come from code and solvers need no vendor diversity, because a solver has no opinion.
• Promotion only after calibration, and reset on a model swap. Every colleague starts as a candidate and becomes active only after its current model passes known-answer problems drawn from the organization's own history, including the ones where the answer was a failure. A model swap sends the seat back to candidate, so a vendor's silent upgrade cannot promote itself into a trusted role.
• Independence measured after the fact. Once reality answers, NERD measures how often each pair of reviewers was wrong together and reports the effective number of independent reviewers, frequently lower than the headcount. Two reviewers who are always wrong together are one reviewer.
• Sealed work runs only on hardware the company controls. Restricted and sealed material goes to a self-hosted model on an allowlisted host, and any other host is refused, so a mistyped address cannot send material off the network. The classification that picks the route comes from the server-side project record, not the caller, and work naming no project is treated as sealed.
• Every statement logged with its evidence grade, confidence, sources, classification and cost. The mathematics seat cites the engine result, the simulation seat the solver run, the cost seat the supplier quote. A statement with no evidence behind it is visible as such.
• Claims are signed only by people. An AI statement enters the claim ledger when a person signs it with the judgment about what it means, and there is no other route in.
• Outside material is quarantined. The seats that read papers, patents and websites get no write or export tools, because outside documents can carry instructions aimed at an AI.
• No colleague has its own route to a vendor. Every model call goes through one gateway. NERD stores no vendor address and no key, and refuses to start if a vendor key is present in its environment.

The governance layer above the team

The AI team sits inside a people layer that holds the authority. A membership joins a person to a project with a role and a dated history, nothing in that history is rewritten, and there is one project lead at a time. Changing the lead moves review authority with it, visibly. Four classification levels run in the data layer, enforced in one place every search, ledger, verdict log and interface passes through, with grants per person and per study, scoped, with an expiry and a reason.

• People hold the stop-go power. Gate thresholds are advisory. Only the project lead passes the later gates, and passing below a threshold requires a reason recorded against that lead's name. Rejections go to the stop record with their numbers.
• The management view leads with how people work, not how much they produce: calibration on predictions and verdicts, the share of retained results that were null, and reviews given for other people's work. Total points are never the default sort, because ranking by volume teaches people to farm points with many small studies.
• A weekly internal record opens with the failures: nulls kept, claims that lost confidence, stops with their lessons, and Pivot verdicts with their numbers, attributed by name. The software refuses to release an edition whose failures section is empty while positive results are present.
• Significant exports require three signatures within 24 hours or the request expires, and either approver can deny outright. Exports are watermarked and logged.

The reversibility rule prompts, records, and never blocks

Before any decision is recorded, and at the later gates, a person is asked whether the action touches a living system. If it does, four things are asked: which system, whether the action is irreversible, whether something could be harmed if the organization is wrong, and the person's own assessment. NERD lists the claims the action rests on, the confidence of the weakest one, and every untested claim beneath it. The person attests, and the name and time are stored with the list.

NERD does not block, and the choice is practical. A system that blocks an irreversible action gets routed around, because the work still has to happen and someone will find the path with no prompt on it, and then the decision is made with no record at all. A system that prompts, lists what the decision stands on, and permanently records who attested to it produces a better decision and a complete record of it. Whether an irreversible action should ever be blocked outright is a setting, and it is set to never.

Nothing in the arrangement prevents a person from acting. Everything in it makes sure what the person knew at the time is on the record, under their name.

Numerical Evidence and Research Discipline

NERD

Actual Intelligence: how the suite was built, and why that is a durable advantage

Quantavera's founders conceived the inventions, set every design requirement and made every decision. They used AI to do the work that teams of programmers and mathematicians would otherwise do, under that direction, because it was the more efficient way to execute. The method that governed it is NERD, and the method is the asset.

Who did what

Greg Stoutenburgh and Faiz Chowdhury are the founders and inventors of the suite. The Evidence-Weighted Record and its trust model, the claim web and its propagation, the Verdict, the Epistemic Confidence Score and the Design Confidence Score are their inventions. Every design requirement across the suite was set by them: what each product does, who it serves, what it refuses to do, how a fact is stored, who may read it, what happens when two sources disagree, and where a person's approval is required. Every decision was theirs, recorded, and in most cases scored later against what happened.

AI performed the execution those decisions called for. A conventional software organization would have needed engineers, mathematicians, statisticians and quality staff across eight products in two regulated industries, which is three to four years before any of it could be tested. Directing AI under a method that enforces provenance, calibration, retained failure and independent review got the same work to the same point faster and at a fraction of the cost. Greg Stoutenburgh calls the arrangement Actual Intelligence and sets it out in a book of that name.

Under the United States Patent and Trademark Office's guidance, only people can be inventors and AI is a tool. The record keeps which person set the objectives, chose among the options and supplied each defining feature.

The method is what made a build of this scope possible

Directing AI without a method produces a large quantity of work nobody can verify. The failure is not that the output is bad. There is no way to tell which parts are good, because nothing records what each decision rested on, nothing keeps the approaches that failed, and nothing is checked by anything with an independent view. Across eight integrated products that uncertainty compounds until the whole body of work has to be taken on faith. The methods NERD encodes close that gap, and were applied to the build itself.

The fifth piece ties the other four together. The claim web traces which decisions rest on which claims, so when one claim fails, everything built on it is flagged for review with the size of the consequence attached. A build of this scope accumulates thousands of interdependent decisions, and whether it holds together depends on whether a correction can be propagated. In a conventional build that is answered by whoever remembers. Here it is answered by the record, which is why eight products across two regulated industries came together as one coherent system rather than eight systems with adapters between them.

What that costs, against what it would cost

Replacement cost measures what a conventional development organization would spend to build the same software to the same point. Quantavera's estimate prices each product in engineer-years at a fully loaded $200,000 to $250,000 per engineer-year, then adds 30 to 35 percent for product management, design and quality assurance.

For scale, published 2026 estimates put a health-system-scale electronic health record alone at $1.2 million to $3 million or more, by Groovy Web's accounting. That is one product, and Arca is one of eight. An independent replacement-cost appraisal of the code base is being commissioned and will be available in diligence.

The advantage is on every product that follows

A cost advantage on work already done is a one-time saving, and the smaller half of this. The method does not expire when the current suite ships. It applies to the next product, the next regulated market and the next acquisition brought onto the records, at the same ratio.

• Engineering headcount goes to accountability, not to typing. The engineering hires own the system, answer for it to auditors, customers and partners, operate production, and hold the access other companies grant only to named people. The money a conventional software company spends on development headcount goes to distribution and deployment, where speed decides who takes the market.
• A new product starts from a corpus instead of from zero. Every design claim, failed approach and scored decision from the existing suite is on the record and searchable. The next specialty or the next country's regulatory variant begins with the relevant decisions already made and the dead ends already marked.
• Marginal cost per additional product falls rather than holding flat. A conventional organization pays roughly linearly for each new product, because each needs its own team. Here each new product inherits the record, the method and the reviewers, and the incremental cost is the new design work plus the certification.

The method also produces something a competitor cannot assemble by hiring: a calibration record. The company knows how often its own decisions at a stated confidence turned out to be right, because every Pursue and every Pivot was recorded as a dated prediction and resolved. That number makes the next decision better, and it exists only if the discipline was applied from the beginning.

Why reading about the method is not the same as having it

The philosophy is public. Greg Stoutenburgh's books set out what Actual Intelligence is, why provenance and retained failure matter, why a single threshold is the wrong way to decide what is true, and why a person has to hold every judgment. The arguments are meant to be read, argued with and adopted.

The specifics needed to reproduce the method are not in them. The scoring dimensions and their weights, the design classes and what earns points in each, the stakes-derived bar and the simulation behind it, the blame arithmetic and the fading constants, the ceiling on untested claims and the reason for its value, the independence clustering rules, the calibration sets that promote a reviewer: those are the working parts, held as trade secrets inside NERD. An organization can agree with every word of the philosophy and still be running a conventional development organization at conventional cost the following morning.

What gets filed and what gets kept is a deliberate split. This round funds provisional filings across the suite and conversion of the strongest to full and international applications. The candidates include the trust model, claim-web propagation with its ceiling on inherited claims, the Verdict, the Epistemic Confidence Score, and the Design Confidence Score. Elements that would teach a competitor the recipe stay unfiled, because a patent is a publication and some of this is worth more unpublished.

What is owned, and by whom

The suite, NERD included, is owned today by VitaNexus Holdings, Inc. and transfers to Quantavera, Inc. by assignment at formation, before the first draw. A dated conception and authorship record documents the origin of each invention. No part of the method, the engine or the suite is owned by a model vendor, and nothing depends on a particular vendor remaining available: the roles, the rules, the record and the calibration history all sit on this side of the line, and a model is a rented component replaceable under the same role card.

One sign-in, one encryption system, one record engine

THE FOUNDATION

What sits under every product

One sign-in, one encryption system, one gateway to outside AI, one record engine and tamper-evident logs, built once and shared by all ten products.

Most software suites are a collection of products that each solved identity, encryption, logging and storage their own way, usually because they were acquired rather than designed together. The cost of that shows up later, as an attacker only has to find the weakest of ten implementations, and as an auditor has to be satisfied ten times.

Why this matters commercially

A licensee taking a partition of either record inherits all of it: the storage, the integrity chain, the trust model and the security program, without building any of it. That is only possible because these services were built once under both records rather than per product. It is also why a new application in this suite costs a fraction of a new application anywhere else: identity, encryption, logging, consent and the record are already there.

SECURITY

A stolen copy is ciphertext, and it stays ciphertext

Health data is stolen more than almost any other kind and stays sensitive for life. In 2024 alone, the United States Department of Health and Human Services received reports of 663 breaches affecting 500 or more people each, with 242.9 million individuals affected.

Nothing stored depends on public-key cryptography

Every stored byte is encrypted with a 256-bit symmetric cipher in an authenticated mode, and the keys protecting it are wrapped with other symmetric keys inside dedicated hardware. RSA and elliptic-curve algorithms, the ones a quantum computer breaks, appear nowhere in the storage path.

Keys are separated by subject

A stolen or cracked key exposes one record, or one entity's books, rather than the database. Destroying a key erases that subject's data everywhere, backups included, by a method the National Institute of Standards and Technology recognizes as a purge. Per-person keys in dedicated hardware are designed and funded in this round; until they are in place, the separation is per tenant rather than per person, and that is stated wherever it bears.

Identity, records, clinic finances and research live apart

Each sits in its own store under its own keys, so no single theft yields a named, complete record of either kind. The identity vault holds the names; the record holds the facts; neither alone is worth much to a thief.

Connections use post-quantum key exchange

Traffic recorded today cannot be decrypted later, because the key exchange combines a classical algorithm with ML-KEM, the post-quantum standard. In 2019 the best published estimate for breaking 2048-bit RSA was about 20 million noisy qubits running for eight hours. In May 2025 Craig Gidney of Google Quantum AI published an estimate of fewer than one million noisy qubits in less than a week. For a lifetime record, the time the data must stay confidential is measured in decades, which is longer than expert estimates of when those algorithms break. Any lifetime record stored under RSA or elliptic-curve protection today should be assumed readable within the subject's lifetime.

The record verifies its own anchors

The head of each chain is anchored outside the database, signed both classically and with a quantum-resistant signature, and the record checks both signatures itself rather than accepting the signing service's word. A record that trusts the service that signs it has no defense against that service, and defending against an attacker who already has the database is the entire point of anchoring outside it.

The limits of what encryption can do

REGULATORY

Built for the rules, and honest about which ones are still ahead

Three industries, three regimes, and a deliberate order of entry that puts the lightest regulatory path first.

The order of entry follows the regulation

Cash-pay medical practices, direct primary care, concierge and wellness clinics, and veterinary practices come first because none of them needs federal certification to buy. Insurance-billing practices, imaging centers, urgent care and surgery centers follow as certification and payer connections come online. Hospitals are not the first target, and the system is built to run them. Outside the United States the order is English-speaking private markets, then private hospital groups in the Gulf states, India and Latin America, then the European Union once its new certification takes effect from March 2027, then national public systems.

THE RULES

The constitution of the record

Ten rules the suite is built to. They are in the architecture rather than in a policy document, which means breaking one takes a change to the system and not a decision by a person under pressure.

THE BUSINESS

The markets

About $107 billion to $128 billion a year worldwide, counting only what the suite sells into directly, plus a veterinary market that the same software reaches with a far shorter regulatory path.

Published estimates for 2025 and 2026. Research firms define these markets differently, so each is a range between the low and the high estimate. Several overlap, and adding all of them together would count some spending twice.

Counting customers instead of dollars

Market sizes are estimates built on other estimates. Counts of institutions are harder to argue with.

To show the scale with one assumption: if the clinic system averaged $6,000 a year per practice, which is about $500 a month and inside what small practices pay today, the 395,000 United States group practices alone would be a $2.4 billion yearly market for that one product.

The veterinary market, which this suite reaches sooner than the human one

Veterinary medicine is a serious market on its own, and it is the one place where this software can be sold without waiting for federal health record certification, because veterinary practices do not bill Medicare and there is no insurance certification to pass. The founder has founded and run veterinary clinics, which is where the operating detail in the veterinary edition comes from. The full sizing, the incumbents and the consolidation of practices into corporate groups are set out on the veterinary market page.

Two notes a careful reader will want

The personal finance software line is small on its own, about $1.4 billion to $1.8 billion worldwide, because consumers have never paid much for a budgeting app. The financial market here is larger because it includes the financial businesses that pay to reach and serve verified customers.

These figures are pooled from published estimates by Fortune Business Insights, Grand View Research, Precedence Research, Mordor Intelligence, Towards Healthcare, MarketsandMarkets, Global Market Insights, Expert Market Research, Persistence Market Research, Nova One Advisor, IMARC and Market Research Future, rather than from one commissioned study. Anyone needing a figure attributed should take it from the publishing firm's own report.

THE BUSINESS

How Quantavera earns

Six streams, two rules that bound all of them, and one loop that connects them. Every figure attached to a stream is an assumption, identified as one. None is a quotation or a signed price.

The two rules

Records are never sold, rented or transferred, and partners pay for the platform rather than per record or per person. The company does not sell patient or customer data. Both rules are commercial decisions as much as ethical ones: they are what keep patients, clinics, regulators and banks on the same side of the question.

How the streams feed each other

A clinic on Arca produces outcomes. Outcomes are the evidence the trust model learns from. A record whose weights are calibrated is worth more to a research sponsor and more to a lender, which raises the price of the research engagement and the financial partner fee. Those revenues fund more clinics. The loop is specific to a record whose accuracy is a function of how many independent judgments reach it.

The two sides go to market through different channels

Clinics and veterinary practices buy the clinic system directly and through management services organizations, billing companies and consultants. On the financial side, banks and credit unions offer the financial record and the household app to their own customers, so partners carry most of the distribution and the institution pays. That difference is why the distribution budget in this round is split rather than pointed at one motion.

THE BUSINESS

A model built from unit assumptions you can change

Every number below is computed from the adoption and price assumptions stated here. Nothing is a projection, a promise, or a figure anyone has paid. Change an assumption and the arithmetic moves with it.

The assumptions

Prices as stated under how it earns. Staff cost is assumed at $180,000 fully loaded per person. Everything else, meaning infrastructure, legal, compliance, certification and audit, is assumed at $0.6M, $1.0M, $1.8M, $3.0M and $5.0M across the five years. The practice line counts human and veterinary practices together.

What that produces

What the arithmetic says about risk

The model is most sensitive to growth in financial-record users, which carries 56 percent of 2031 revenue in this version. If that side reached one tenth of the assumed users and nothing else changed, 2031 revenue would be $35.6 million rather than $71.6 million, and the business would still be profitable from 2030. The assumption that matters least is partition licensing, at 1.4 percent of 2031 revenue.

The reason to raise more than the gap is not the gap. It is that certification, distribution and the first deployments decide how fast the adoption line moves, and every one of them is bought rather than coded.

THE MOAT

Why this is hard to copy, and why the gap widens

Features are copied in a quarter. What cannot be copied is a decision made years earlier to keep every piece of evidence, and a structure in which one person's record improves the confidence of everyone else's.

The incumbents are not standing still. Epic holds most large United States health systems and about one in five outpatient sites. Epic and athenahealth now give away AI-drafted visit notes, and Oracle markets its newest record as voice-first. The obvious features are being commoditized while this suite is built, and any investor should assume that continues.

What no public material shows any of them doing is weighing the evidence behind each fact, learning which sources deserve trust, recording where each judgment came from, and declaring which sources share an upstream. That is the part that compounds.

The information a binary record threw away is gone

A conventional record decides true or false at the moment a value arrives. The provenance, the disagreement, the document behind it and the identity of the source are discarded at that instant. A competitor that adopts evidence weighting tomorrow starts weighting from tomorrow. Everything already stored stays what it is, because the evidence that would have given those facts a weight was never kept. The gap between the two records grows as both accumulate data rather than closing.

Six things that defend this business, ordered by how hard each is to take

The part investors should understand best: shared learning across every user

One record serves every person in it. That is a storage decision with a mathematical consequence that has nothing to do with scale economics.

When a laboratory, an imaging center, a bank, an exchange or a device maker is a source for one person, it is usually a source for thousands. What the record learns about that source from one person's outcome applies to every other person that source touches. A feed that drifts is caught once and the correction reaches everyone it affected. A clinic whose readings run high against later confirmation is weighted down everywhere, not only in the chart where the discrepancy appeared.

No individual record can do this. A person holding their own health file has one sample of each source, which is never enough to tell a biased source from an unlucky one. A record holding many people has a population of judgments about the same institutions, and the sign of the errors across that population is what separates a systematically wrong source from a merely noisy one.

This is where the suite's size turns into accuracy rather than only into revenue. Each new clinic, practice, patient, family and financial institution adds judgments about sources that other users already depend on. The accuracy of any one person's record is a function of how many independent judgments the whole system has gathered about the sources that person's facts came from.

Where the judgments come from, which is the argument for owning the applications

The trust model needs independent judgments, and it cannot manufacture them. A clinic system records what a treatment did. A patient app records how someone felt afterward. An imaging platform records what a reader found and what later proved true. A veterinary practice records an outcome a pet's family saw at home. A financial record learns every month whether a statement closed, whether a transcript from a tax authority matched, and whether an instrument cleared.

A record sold on its own has no supply of these. Its weights sit near their starting figures for as long as it operates, which means it is a conventional record with extra columns. Owning the applications is what converts the mathematics into an advantage that accumulates.

The cost position

Ten products across two regulated industries and a third market were designed and built by their inventors using Actual Intelligence, the method described on the NERD pages. A conventional organization doing the same work would spend three to four years and an estimated seventeen to thirty-five million dollars. That gap does not close after this round. It applies to every product that follows, every specialty content pack, every new market and every integration, which means the company can enter markets that are too small for a competitor carrying conventional development costs.

THE MOAT

The intellectual property this creates

A new kind of database, the model that decides what it believes, the research engine that produced the suite, and the applications that feed all three. This describes where the property sits and how it is being protected. It does not list the filings, and it does not teach the recipe.

The policy, stated before the detail

Two rules govern every decision here. Anything a competitor can observe or reverse engineer from outside the system is a candidate to file. Anything that would teach a competitor the recipe stays a trade secret and is never filed, because a patent is a published teaching in exchange for a term of exclusivity, and some of this is worth more unpublished.

That line is drawn by category. The architecture of the record, the structures that hold evidence, and the behaviors a customer or a regulator could observe sit on the filing side. The tuned parameters, the thresholds, the prompts and role definitions behind the AI colleagues, the calibration history, and the accumulated evidence itself sit on the secrecy side permanently. Nothing in this material, in the white papers, or in the founder's published books describes the second group in enough detail to reproduce it.

Where the property comes from

Why the database itself is the strongest position

Most software patents protect a feature inside a product. A new database category sits underneath every product built on it, which means a position here reaches further than any one application. Two further properties make it unusual.

The first is that the record is one repository serving every application, so the invention is exercised by all of them at once rather than by a single product. The second is that other companies can license a partition of the record and run their own systems inside it, which puts the property into the hands of licensees under terms this company sets. A licensed partition is both a revenue stream and a way of spreading an architecture that becomes harder to displace the more systems depend on it.

The shared learning position

Every user of the suite reads from and writes to the same record. A judgment about a laboratory, an imaging center, a bank or a device maker that arrives from one person's outcome improves the weight that source carries for every other person it touches. The mechanisms that make that safe are the ones worth protecting: counting how independent each judgment was, refusing to let a source confirm itself, and declaring when several apparently separate feeds are one upstream. Those mechanisms are what separate shared learning from shared contamination, and they are the part of this system for which no prior art has been found.

Trademarks

Every product mark is a working name pending clearance, and this round funds clearance and filing across the product line with international coverage. The brand system, the lockups and the wordmarks are built and in use across all of the company's material.

Ownership, cleanly held

The suite's software, designs and documentation are the property of VitaNexus Holdings, Inc., a Wyoming corporation wholly owned by Greg Stoutenburgh, and transfer to Quantavera, Inc. by assignment at formation, before the first draw. A dated conception and authorship record documents the origin of each invention, who conceived it and when, which is the record a patent office and a diligence reader both ask for. The founders are named as inventors on that record. Current Patent Office guidance treats AI as a tool and looks to human conception, and the conception record is written to that standard.

THE RAISE

$10 million at a $35 million pre-money valuation

This raise funds the gap between a system that is built and tested and a system that is certified, deployed, calibrated against real outcomes and sold in three markets. Fully committed at signing, funded in three draws over six months at the same price.

Why the price is $35 million

Use of proceeds

Where the money does not go

It does not go to building the software. The software is built and runs end to end. Writing and maintaining code runs through the same method that produced the suite, so the money a conventional software company spends on engineering headcount goes here to distribution and deployment, where speed decides who takes the market. The engineering hires that are made own the system, answer for it to auditors, customers and partners, operate production, and hold the access that other companies grant only to named people.

The draws

The full amount is committed at signing at the same price. Each draw after the first is released when its milestones are met, and the purchase agreement obligates it once they are. The first draw covers more than the first three months of spending, so the plan never waits on a draw.

THE COMPANY

Founders and inventors

Greg Stoutenburgh

Founder and Inventor

Greg founded a medical imaging company and invented its Volumetric High-Definition Imaging technology, conceiving the system from the first sketch and designing the defining characteristics of the major iterations of both its platforms over fourteen years with the company, five of them as chief executive. Its devices for human use carry FDA clearances and CE marks. He is lead inventor on 24 issued patents and oversaw a company portfolio of more than 106 patents issued worldwide, and he has led or taken part in more than twelve mergers and acquisitions.

He was an operator first. He founded two management services organizations for physician and dental clinics and several veterinary clinics, and has run, managed or consulted for well over a hundred medical, dental and veterinary practices, which are the practices this suite is built to serve. He is Chief Innovation Officer of Graphene Valley Corporation and leader of the GVC Innovations Lab, and chief executive of Quantumis Bio, which develops regenerative and diagnostic products for human medicine.

His coursework and degrees are in biology, chaos and complexity, chemistry and philosophy. He is the author of Actual Intelligence, The Subject Answers Back and Inside the Walls, and of two children's books, The World Answers Back and Keep an Eye on Grandpa. He founded the Human Continuity Project and has served on the board of trustees of Casa Romantica since 2013. He conceived and created NERD.

Faiz Chowdhury

Founder and Inventor

Faiz is the founder and largest shareholder of Graphene Valley Corporation and owns and runs several other United States companies. He is co-inventor of the inventions in the Quantavera suite.

How the suite was built, said plainly

The founders conceived the inventions, set every design requirement and made every decision. They used AI to do the work that teams of programmers and mathematicians would otherwise do, under their direction, because it was the more efficient way to execute. The method is Actual Intelligence, the arrangement of people and AI that Greg Stoutenburgh defines in his book of the same name, and the discipline that makes it work is encoded in NERD. That is a permanent cost advantage on every product that follows, and it is described in full under Actual Intelligence.

Contact: Greg Stoutenburgh · 714-402-0455 · greg@graphenevalley.com

THE COMPANY

Ownership, names and copyright

Clean title, documented conception, and a transfer that completes before the first draw.

Who owns the suite today

The software, designs and documentation of the Quantavera suite are the property of VitaNexus Holdings, Inc., a Wyoming corporation wholly owned by Greg Stoutenburgh. Quantavera, Inc. is being formed to hold the suite, and the assignment transfers it on formation, before the first draw of this round. Nothing in the suite is owned by, licensed from, or encumbered by any other company either founder is involved with.

The conception record

A dated conception and authorship record documents each invention: what it is, who conceived it, when, and what evidence establishes the date. It is maintained to the standard a patent office asks for, and it is available in diligence. Current Patent Office guidance treats AI as a tool and looks to human conception, which is the standard the record is written to.

Names

Holarc, Finarc, Arca, Arca Vet, Keelson, My Talisman, Pet Talisman, My Helm and NERD are working names pending trademark clearance, and this round funds clearance and filing across the product line with international coverage. The NERD mark keeps its own established glasses device. Product symbols are used with their wordmarks as lockups rather than alone.

Copyright

© 2026 VitaNexus Holdings, Inc. All rights reserved.

REFERENCE

Sources and notices

Market sizing

Segment figures are pooled from published 2025 and 2026 estimates by Fortune Business Insights, Grand View Research, Precedence Research, Mordor Intelligence, Towards Healthcare, MarketsandMarkets, Global Market Insights, Expert Market Research, Persistence Market Research, Nova One Advisor, IMARC and Market Research Future. Research firms define these segments differently, so each figure is given as a range. Anyone needing a figure attributed should take it from the publishing firm's own report.

Institution counts

United States physician group practices, imaging centers and urgent care centers: Definitive Healthcare. Ambulatory surgery centers: MedPAC, March 2026. Direct primary care practices: DPC Frontier via Atlas.md. Veterinary establishments and veterinarians: the American Veterinary Medical Association and the United States Census. Veterinary businesses and sector revenue: IBISWorld. Veterinary care and product spending: the American Pet Products Association. Pet insurance participation: the North American Pet Health Insurance Association. Hospitals in the Gulf states: the GCC Statistical Centre.

Valuation and cost references

Series A valuation medians: PitchBook-NVCA Venture Monitor, first quarter 2026, as reported by WaveUp, Series A Benchmarks 2026. Electronic health record development cost: Groovy Web, EHR Software Development Cost in 2026. Replacement cost is the company's own estimate on the stated assumptions, pending an independent appraisal.

Security and cryptography

Breach counts: United States Department of Health and Human Services, 2024. Quantum resource estimates: Craig Gidney, Google Quantum AI, May 2025, against the 2019 estimate it revises. Re-identification: Latanya Sweeney. Post-quantum standards: the National Institute of Standards and Technology.

Mathematics

The optimality bound for linear weighting: A. C. Aitken, 1935. The measured comparisons, the simulation protocol and the figures behind them are published in full in the company's white paper series, which states the protocol, the sample sizes and the spread for every figure quoted in this material.

Notices

Every figure attached to a revenue stream or a financial projection is an assumption, identified as one, and no figure in this material is a quotation, a signed price, a forecast or a promise of any result. The company has no customers and no revenue. No real patient record, clinic, client or financial account has entered any part of the suite; everything described runs on invented data with outside networks simulated. This material is for discussion with qualified prospective investors and is not an offer to sell or a solicitation of an offer to buy securities.

© 2026 VitaNexus Holdings, Inc. Product names are working names pending trademark clearance.