Stance
Guardian Angel should be built as patient-centered infrastructure, not as a product.
A patient-controlled record sits at the intersection of clinical safety, informational self-determination, regulatory accountability, and durable public-interest infrastructure. The right governance posture is explicit, conservative on safety, and ambitious on access.
Compared with what. Guardian Angel should be evaluated against the healthcare system as it actually functions today, not against an idealized counterfactual. The bar for replacement is the lived experience of the current EHR, not a perfect agent that never errs.
Trust & safety
The architecture is the policy.
Trust is not a slogan; it is enforced at the data layer, the agent layer, and the workflow layer simultaneously.
Every recommendation cites the underlying record
Agent outputs include pointers to the specific observations, conditions, and guideline statements that grounded them. Unsupported recommendations are suppressed, not softened.
Defined thresholds, defined humans
Each clinical scenario has prespecified thresholds for clinician notification, including who is notified and what falls back if the primary contact is unreachable. Escalation paths are visible to the patient.
Patient, agent, and clinician disagreements are recorded
When the agent and clinician disagree, or when the patient declines a recommendation, the disagreement is captured with reasoning. These are valuable signals for the system, not failures to suppress.
Errors are auditable and reportable
Agent errors, recommendation failures, and missed findings are logged, categorized, and made available for safety review on a defined cadence. Patients can flag suspected errors and trigger review.
No generation outside the record
The agent does not introduce clinical facts that are not in the record or in a cited external source. Generated explanations are constrained to summarization, translation, and grounded reasoning.
Consent
Computable, granular, revocable.
Per-purpose and per-recipient
Consent is not a single binary. Clinical care, research, family delegation, employer-adjacent benefits, and downstream data sharing are independently configurable.
Machine-readable, enforced at the data layer
Consent receipts are first-class artifacts. Authorization checks happen at every read and write, not via after-the-fact policy review.
Revocation propagates
When the patient revokes a consent, downstream systems that received data under that consent are notified, with audit trail. Future access stops; past access is recorded.
Family delegation as a first-class consent class
Patients can delegate participation to a family member or other trusted party, with scope and duration controls, and with the delegation itself visible in the audit log.
Liability
An open question that the project takes seriously.
When an AI agent is a co-deliberator with the clinician on a shared record, the existing liability framework was not designed for the configuration. This is a problem the project intends to work through with regulators, payers, and clinical partners, not around them.
The clinician remains the clinical decision-maker
Guardian Angel is an assistant, not a substitute. The clinician's professional liability is unchanged when acting on agent-surfaced findings, just as it is unchanged when acting on findings surfaced by any other decision-support tool.
Patient-side liability needs new framing
When the agent advises the patient directly — particularly in the absence of a clinician interaction — the liability framework is genuinely unsettled. The project will publish a position paper and seek formal regulatory input.
Coverage will need to evolve
Professional liability insurance for AI-assisted care is in early form. The project will work with insurers, clinical societies, and policymakers to develop coverage that fits the actual configuration.
Regulatory positioning
The functional claim, not the marketing claim, determines the regulatory pathway.
FDA software-as-a-medical-device (SaMD) considerations
Where Guardian Angel surfaces findings that inform clinical decisions, FDA SaMD framing applies. The project intends to design for the highest applicable scrutiny rather than the lowest, and to engage FDA early on the agent's intended use statements.
EU MDR and the AI Act
European deployment will be designed against MDR classification rules and the EU AI Act risk tiers. The patient-controlled record itself is not a medical device; specific reasoning features may be.
Israeli Ministry of Health alignment
Israeli deployment will be designed in alignment with Israeli MoH digital health and AI guidance, with attention to the integrated payer-provider context.
HIPAA, GDPR, and equivalents
Privacy regimes are treated as architectural constraints, not after-the-fact compliance overlays. The trust plane enforces them at the data layer.
Equity
Patient-controlled cannot mean only-the-privileged.
Designed for low-resource contexts from the start
The patient view is designed to work on low-end devices, in low-bandwidth conditions, and across primary spoken languages. Frontier features degrade gracefully rather than requiring premium hardware.
Delegation expands access; it does not gate it
Family delegation is the most important equity feature: patients with low digital fluency, cognitive limitations, or competing demands can still benefit through a trusted delegate.
Free at the point of access, where possible
The cost model is being designed to avoid creating a new class of patients whose access depends on private subscription. Public-interest funding and integrated-system deployment are first-choice paths.
Reasoning is monitored for demographic performance gaps
Recommendation quality, summarization accuracy, and trajectory detection are evaluated across patient demographics. Performance gaps are treated as defects, not characteristics.
Operating model
Public-interest by design.
The default operating model is closer to public-interest infrastructure than to a conventional health-tech product. Sustainability will come from a mix of integrated health-system deployment, research funding, and philanthropic support, with governance structured to keep the patient interest primary even as the project scales.
Where commercial deployment is appropriate — for example, as a service offered through an integrated health system — the commercial terms remain compatible with patient ownership of the record and with portability across institutions and countries.
The governance log, advisory composition, and architecture decisions are intended to be public from the outset.
What we are not doing
The list of explicit non-goals matters as much as the list of goals.
Autonomous diagnosis or treatment
Guardian Angel does not diagnose or prescribe without a clinician. It surfaces, summarizes, explains, and escalates.
An EHR replacement for billing or operations
The institutional EHR continues to do what it does well. Guardian Angel does not attempt to take over revenue cycle, scheduling, or compliance documentation.
A data-monetization platform
The patient owns the record, including its derived products. Aggregate research uses are consented per study, not by default.
A replacement for the clinician
The clinician's role is unchanged in clinical authority and clinical responsibility. The agent expands the clinician's reach; it does not substitute for it.