Pocket: an alert app that shows its work

A working prototype of a personal health alert app. Your phone watches your heart-rate readings, fixed rules decide how urgent a change is, and a clinician you choose can review the wording.

Where it stands Prototype, not released. It is not in the App Store, it has not been clinically validated, and it has been run only on made-up data and a phone simulator. It is not a medical device and it does not diagnose. In an emergency, call 911.

What it does

Your iPhone reads the heart-rate readings your phone or watch writes to Apple Health.
It compares them with your own usual range at that time of day, and with the limits written in your own health record.
Fixed rules set the urgency. A language model never sets or lowers it. The model only writes the plain wording, and that wording is checked against the readings before you see it.
Your Mac runs the model (Gemma 4) so the phone does not have to. If the Mac is off, the phone still applies the same rules and words the alert with Apple's on-device model or, failing that, a fixed sentence.
With no recent readings it says no recent readings. It never says everything is normal without data.

Where your data goes

Your readings and record stay on your phone and your Mac. Nothing is sent to us. The one thing the app fetches from the internet is a signed review record, by its receipt id, and only when you ask it to.

Asking a clinician to look

You can hold an alert for review. The app writes a packet file: the alert level, the AI draft, what the draft was written from, and a fingerprint of your record. It has no name, no contact detail and no date of birth, and the note you type is refused if it looks like it contains one. The packet is marked unsigned until a clinician signs it. You decide who receives the file.

If you are the clinician

Open /provider and verify your NPI.
Choose Open a packet file. The file is read in your browser and checked there. It is not uploaded. A packet that was changed after the person made it is refused.
Read the AI draft and what it was written from. Sign or decline with your own key.
Give the receipt id back to the person. Their app fetches the public record and checks the signature itself.

What is stored on our side: the decision text, its hash and your signature. Not the readings, not the person's note. What a signature proves: the key bound to that NPI signed exactly this text. It is a review of an AI draft, not care for the person and not medical advice to them.

What is not true yet

No public release and no App Store listing.
No clinical validation and no study. No real watch data has been run through it.
No clinician has reviewed a real person's alert. Nothing is charged for anything here.

Questions or a clinician who wants to try the review flow: the pilot page.