Technical overview
A standards-native record, two equally useful views, a reasoning layer, and a trust plane.
Guardian Angel is built from commodity, interoperable components. Its novelty is not in any single layer but in their composition: a patient-controlled longitudinal record at the center, symmetric clinician and patient views, an agent runtime that reasons over the record, and a governance plane that mediates every read and every action.
Data model
FHIR-native, multi-modal, and provenance-aware by construction.
Standard FHIR resources
Patient, Encounter, Observation, Condition, MedicationStatement, AllergyIntolerance, Procedure, DiagnosticReport. Sourced from EHR connectors, normalized at ingest, never overwritten on conflict.
Continuous observations
Wearable and phone-derived streams represented as time-series Observations with explicit confidence and sampling metadata. Aggregated into clinically meaningful summaries by the reasoning layer rather than dumped into the clinician view.
DICOM references with image-derived signals
Imaging studies referenced rather than copied, with structured findings, radiologist impressions, and AI-derived measurements stored alongside the pointer.
Variant-level and report-level genomic data
Standard genomic FHIR profiles plus pointers to source variant files. Patient-actionable findings surfaced explicitly; secondary findings flagged for consent.
Patient-entered context
Diet, exercise, sleep, mood, exposures. First-class but provenance-distinguished from clinical observations. Used by the reasoning layer; surfaced to clinicians only when relevant.
Care and communication preferences
Goals of care, decision-making style, language, channels, alert thresholds. Stored in the record so they travel with the patient across institutions and countries.
Agent topology
One reasoning layer with four explicit responsibilities.
The agent runtime is not a single monolithic prompt. It is a small set of specialized reasoners coordinated by an orchestrator, each grounded in the record and operating under the trust plane.
Detects cross-visit patterns
Identifies drifts, regressions, and inflections in measurements and conditions across the full longitudinal record. Outputs are framed as hypotheses with confidence, not diagnoses.
Role-aware rendering
Produces patient-facing and clinician-facing renderings of the same underlying record. The two views are deliberately commensurable: what one party sees is auditable against what the other sees.
Guideline-cited recommendations
Recommendations are tied to specific guideline sources and patient-specific evidence in the record. Every recommendation carries a citation trail; ungrounded recommendations are suppressed.
Tool use and escalation
Coordinates non-cognitive actions: notifications, scheduling handoffs, secure messages to clinicians, escalation paths when patient-side events exceed thresholds.
Security & identity
Trust is a continuous plane, not a perimeter.
Patient-controlled identity with verified linkages
Patient identity is anchored to the patient, with verified linkages to institutional identifiers (MRNs, payer IDs) maintained as references, not as authoritative identity.
OAuth 2.0 + SMART on FHIR scopes
Every read and every write is scoped, time-bounded, and revocable. Clinician access is scoped by clinical relationship; family delegate access is scoped by the patient.
Computable consent
Consents are stored as machine-readable artifacts and enforced at the data layer. Research-grade and clinical-grade consents are distinct and individually revocable.
Append-only audit log
Every read, write, and agent action is recorded with actor, scope, purpose, and outcome. The patient can inspect the log. Tamper-evident by design.
Human-in-the-loop boundaries
Defined thresholds trigger clinician notification rather than autonomous action. The agent's authority to act without a human is explicitly bounded and patient-configurable.
Runtime
Cloud-side or on-device, chosen per workflow and per jurisdiction.
Cloud-side
Population-scale reasoning, durable backup
- Best for cross-institution data assembly
- Best for guideline updates and shared reasoning improvements
- Required for population-level research and recruitment
- Backup-of-record across device loss
On-device
Sovereignty, latency, privacy
- Best for sensitive reasoning the patient prefers to keep local
- Best for low-latency conversational interaction
- Useful for jurisdictions with strict data residency requirements
- Apple Silicon / mobile NPUs now make frontier-class inference local
Most deployments will be hybrid. The architecture is neutral on this choice: the record and the reasoning layer are designed to run in either mode, and the trust plane enforces the same guarantees in both.
Data provenance
Every fact carries its source.
AI reasoning over patient-controlled records depends on knowing what is authoritative. Guardian Angel tags every datum with provenance and treats provenance as a first-class clinical signal.
Patient-entered, device-captured, EHR-sourced, clinician-validated
The four primary provenance classes. The reasoning layer treats each differently: patient-entered context informs but does not override; clinician-validated facts are load-bearing for downstream recommendations.
Measurement quality, not just measurement value
Wearable observations carry sampling rate, device class, and confidence metadata. Manual entries carry timing and free-text context.
Derived data points reference their inputs
Agent-derived summaries, alerts, and trajectory findings carry pointers to the underlying observations and the guideline references that grounded them.
Integration
The EHR remains the operational system of record. Guardian Angel sits beside it.
SMART on FHIR app launch and bulk patient access
Where the EHR exposes SMART on FHIR, the Guardian Angel reads on the patient's behalf. Where the EHR exposes bulk patient access under the 21st Century Cures Act, longitudinal ingest is routine.
Structured handoff back to the EHR
Patient-reported outcomes, preference updates, and consented research data flow back to the EHR through standardized structured exchange where the provider system supports it.
Clinician view embeddable inside the EHR
For clinicians who cannot or will not leave their EHR, the clinician view of the Guardian Angel is itself a SMART on FHIR app launchable in-context. The shared-view property is preserved.
Claims as a parallel ingest channel
Payer claims data fills gaps in clinical observation and provides cross-institution event detection that EHRs alone cannot offer.