A precision longevity platform, holding data that can never be reissued
Genetics, proteomics, blood analytics and continuous wearable data, cross-referenced into one picture of a person's biology, delivered as structured non-diagnostic guidance.
- 4 data types, 3 clocks
- 3 properties that break ordinary security
- 5 commercial models, one entitlement layer
- 1 link between sample and person
- 0 ways to reissue if lost
What the platform does
Wearables made biological data abundant and meaningless at the same time. A watch produces thousands of data points a day and almost no understanding, so people are measured more than they have ever been and know themselves no better. The platform does the harder thing, which is interpretation.
It reads four kinds of biology. A genetic test from a saliva sample covering hundreds of thousands of markers. Proteomic and blood analysis from a dried blood spot returned by post. And continuous activity, sleep and heart rate from whichever wearable somebody already owns.
It cross-references them. A marker suggesting a tendency means one thing on its own and something different alongside a blood result and three months of sleep data. That combination is the product. Four dashboards side by side is what everybody else already has.
It produces something readable. Structured reports across sport, nutrition, prevention and longevity, each with scores and marker-level detail, written as guidance rather than as findings about conditions.
And it runs the business around it. Kit ordering, shipping, sample tracking, laboratory turnaround, digital delivery, and a commercial layer covering one-off kits, family packs, subscriptions, add-ons and reservations.
- Client
- A consumer genomics and longevity company. Named under NDA.
- Sector
- Healthcare and life sciences, consumer longevity
- Product
- Consumer platform combining genetic testing, laboratory analytics and wearable data
- Our scope
- Platform architecture, multi-source ingestion, interpretation and reporting, wearable integrations, kit and laboratory workflow, commercial and entitlement layer, security architecture
The one fact that shaped everything
This platform holds the only category of personal data that cannot be reissued.
A leaked password is changed by the afternoon. A leaked card is cancelled. A leaked address is inconvenient. There is no equivalent action available for a genome, at any price, for the rest of somebody's life.
A person's genetic data discloses a great deal about their parents, their siblings and their children. None of those people signed up, consented, or know the platform exists.
Strip the name, the email and the date of birth and what remains still points at one individual. Anonymisation in the ordinary sense is not available.
The design question is not how to recover from a breach. It is how to be worth less to somebody who achieves one.
The four decisions that mattered
If you read nothing else on this page, read this.
Reaching one does not hand over the other, and the raw data is read by almost nothing.
A genetic marker, a blood panel from March and a heart rate from four minutes ago are not three points on one timeline.
A courier, a warehouse and a laboratory each handle something traceable to an account rather than to a person.
Structured output, centrally held instructions, and explanations grounded in the markers rather than in a model's fluency.
The biology and the person are held apart
The instinct with sensitive data is to protect it harder. Stronger encryption, tighter access, better monitoring. All of that is necessary here and none of it is sufficient, because every one of those controls is designed around a threat model where a breach is survivable.
The most valuable thing an attacker could take is not the genetic data on its own, and not the identity on its own. It is the two joined together. A marker set with no name attached is of limited use to almost anybody. A name and an email is worth very little. The pair is worth a great deal, permanently, to a person who cannot ever undo it.
What we did
The biological data and the identity are separated at rest. They are stored apart under different access, so reaching one does not hand over the other, and the join is a deliberate operation rather than a property of the schema.
Encryption under managed keys. Keys are held in a managed key service, rotated on a schedule, and kept separate from the data they protect. Access to a database is not access to the contents of it.
The raw marker set is read by almost nothing. Interpretation reads it once and produces a structured report. Everything downstream reads the report rather than the markers, which means the largest and most sensitive object on the platform sits behind a single narrow path.
Access is scoped and recorded. Components hold only the permissions they need, no administrative credential lives in the application, and access to biological data is logged with actor and reason rather than granted as a standing role.
A successful attack is worth less than it would otherwise be. Which is the only meaningful objective when changing the compromised thing is not an option.
The blast radius has a shape. Data at rest, keys, identity and interpretation are four separate problems, and none of them assumes the others held.
Downstream features do not accumulate exposure. A new screen reads a report, so adding product surface does not widen the number of places raw genetic data can be reached from.
Access to the most sensitive object is an event, not a permission, which is what makes it reviewable rather than merely restricted.
Four sources on three clocks
The four inputs are not four versions of the same thing. They differ in format, in meaning, and most importantly in how often they change.
Genetics is read once and true for life. Proteomic and blood results are a measurement taken on a date, valid around that date and decreasingly relevant afterwards. Wearable data changes every few seconds and is only interesting as a trend.
Treating them as three points on one timeline is how a platform produces a confident statement about a person that none of its inputs actually support. A genetic tendency combined with a blood result from eight months ago and last night's sleep is not a finding. It is three facts of very different ages presented as though they were simultaneous.
What we did
Each reading keeps the date it was true and the confidence attached to it. The interpretation layer knows how old every input is rather than assuming currency, so a stale blood panel is weighted as a stale blood panel.
One biological profile per person, normalised from all four sources, so interpretation reasons across them rather than about each in turn. Downstream reads one shape.
Wearables are normalised at the edge. Whichever ecosystem somebody's device belongs to, the platform receives activity, sleep and heart rate in one form, so the interpretation engine has no idea which brand produced a number and does not need one.
Cross-referencing is the output, not a feature of it. A marker that suggests something reads differently alongside a blood result and three months of behaviour, and the report is written from the combination rather than assembled from four sections.
An insight can draw on all four at once, which is the thing a wearable app on its own structurally cannot do.
Adding a fifth source is an adapter. The interpretation layer reads one profile, so a new device ecosystem or a new panel is an ingestion problem rather than a rewrite.
Age is visible to the thing making the judgement, so the platform can say a result is old rather than quietly treating it as current.
A person's picture improves over time without being rebuilt. Genetics never changes, so every new blood panel and every month of wearable data makes the same underlying test more useful.
The sample travels under an identifier
The product runs on physical objects. A kit is bought, shipped to a home, used, posted to a laboratory, processed, and returned as digital results. That introduces a failure with no software equivalent. Almost every mistake in software is recoverable. Returning one person's genome to another person is not, and nothing downstream would notice.
A courier, a warehouse and a laboratory all handle this sample, and none of them needs to know whose it is.
What we did
The link between kit and human is made once, by the person. A kit ships carrying an identifier rather than a name, and registration by the account holder is the single moment the two are joined.
The laboratory works from the identifier. It processes a sample and returns a result against a reference, and never receives the person behind it. Which is a privacy control and also a considerable simplification of what has to be shared with an external partner.
Every step is a state. Ordered, shipped, registered, received, processed, returned. A kit that was never registered is visible as such rather than sitting in a drawer while somebody waits for a result that was never coming.
A result with no matching registration is refused rather than filed. Every other failure in the chain is a delay. That one is a person reading a stranger's biology and believing it is their own.
The physical and digital halves stay in step, so a customer can see where their kit is rather than sending an email asking.
External partners handle less. The laboratory receives what it needs to do the science and nothing about who the science is about.
Failure has a shape. Kits fail, samples fail, post goes missing, and each of those has a defined path rather than becoming an exception somebody handles by hand.
The unrecoverable failure has a check in front of it, rather than relying on nothing going wrong across a chain that includes two organisations and a postal service.
The boundary is enforced, not reviewed
A language model handed genetic markers and blood results will happily write something that reads like a doctor. Fluent, confident, specific, and phrased as a finding about a named condition in a named person. Nothing errors. The text is well written. And the platform has crossed a line that is regulatory rather than editorial, on a report that has already been delivered.
The tension is real. Guidance vague enough to be certainly safe is also useless. The product has to be specific enough to change what somebody does next week, and never phrased as a finding about a condition.
What we did
The output has a shape. Reports are generated into fixed sections with scores and marker-level detail, rather than as free prose. A structure the model must fill is a boundary it cannot wander past, and it is the reason the same report is comparable between two people.
The instructions are held centrally. One place defines how the platform is permitted to speak, so tightening it tightens every surface at once rather than one feature at a time, and improving it does not require a release.
Explanations are grounded rather than invented. What a marker means is written from the marker set and the reference material behind it, so a claim can be traced to the science it came from rather than to a model's fluency.
The boundary belongs to the people qualified to set it. The platform's job was to make it something the software enforces rather than something a reviewer has to catch, on every report, forever.
Guidance is specific enough to act on and stays inside the line, which is the whole product rather than a constraint on it.
Tightening the boundary is one change, not a sweep through every feature that generates text.
A report can be defended. Marker-level detail and traceable explanation mean a question about why something was said has an answer.
Volume stops being a risk multiplier. A platform that relies on review does not scale past the number of reports a person can read.
The commercial layer: five models, one entitlement
The business does not run on one revenue model. It runs on a one-off kit, multi-kit family packs, a recurring subscription in monthly and annual forms, optional analysis add-ons, and reservations with a deferred balance for a premium test. That is an entitlement problem wearing a payments costume.
Entitlement is derived from purchases rather than set alongside them. A subscription that lapses removes access without anybody remembering to, and a reservation that completes grants it without a support action.
Card details never reach the platform. Payment runs through the provider's own hosted flow, so the platform holds a reference rather than an instrument.
Kits, entitlements and results are joined by the same account, which is why decision three matters commercially as well as clinically. A kit that cannot be tied to a purchase is a kit nobody can be given results for.
Five revenue models run through one system rather than five, so a pricing change is configuration and a new pack is data. And a person moves from purchase to access without a human in between, which for a consumer product is the difference between a working funnel and a support queue.
Which criteria this platform is judged on
Two of the five trust services criteria carry the weight here, and the second is unusual enough to be worth stating carefully.
Confidentiality is the obvious one and it is the whole page. What makes it different from an ordinary confidentiality argument is that the usual escape hatch is closed. There is no anonymised copy that is safe to be relaxed about, because the data identifies by itself. So the controls are about reducing what a breach yields: separation of biology from identity, encryption under managed keys held apart from the data, a single narrow read path to the raw markers, and access recorded as an event rather than granted as a role.
Privacy is the unusual one. The criterion concerns the people the data is about and what say they have over it. On this platform the data is about more people than have accounts, because a genome discloses a great deal about parents, siblings and children who never consented to anything. That is not a compliance technicality. It is a design constraint, and it is the reason the platform holds as little as it can, joins it as late as it can, and treats deletion as a real operation rather than a flag on a row.
On the standards themselves
The client operates under a regulated quality regime. Those certifications are the client's. They were audited for them, they hold the evidence, and they are the ones entitled to reference them. We are not, and this page does not.
What we can say is what the platform was built to do inside that regime: biological data held apart from the identity it belongs to; encryption under keys stored separately from the data; one narrow read path to the raw markers; access recorded as an event rather than granted as a role; deletion treated as a real operation across every store that holds a person's biology. Those are engineering decisions, they are verifiable, and they are what a quality audit examines.
The control set was designed against the trust services criteria rather than mapped to them afterwards. That is a statement about how the platform was built, not a claim to hold an attestation.
The constraints we designed around
A consumer platform sitting on top of laboratories, device ecosystems and regulated testing meets constraints set by other people.
Every wearable ecosystem is a different opinion about the same body
The challenge. Users bring whatever device they already own, and each ecosystem has its own interface, its own data model, its own idea of what a sleep stage is, and its own view on how often it will let you ask. Access also expires on their schedule rather than yours.
What we did. One adapter per ecosystem, normalising into one internal shape, with connection health treated as a state rather than an error. A connection that has expired is visible with a reconnect action rather than silently producing no data.
Whatever device somebody owns becomes part of one interpreted picture. And a person whose watch stopped syncing three weeks ago finds out from the platform rather than from a gap in their own history.
The laboratory sets the clock, not the software
The challenge. Turnaround is a physical process with a physical duration. Nothing in software makes a sequencing run faster, and a customer who has posted a saliva sample and heard nothing for two weeks assumes something has gone wrong.
What we did. Made the state visible at every step rather than only at the end, with expected windows rather than promises, so waiting is informed rather than silent.
The support load from a long process comes almost entirely from uncertainty rather than from duration. A visible state removes most of it without changing the science.
A genetic report is read once and referred to for years
The challenge. This is not a dashboard somebody checks daily. It is a document a person may return to in five years, after the science has moved, after markers have been reclassified, and after the platform has changed.
What we did. Kept the marker-level detail behind the summary rather than only the conclusion, and kept the report regenerable from the stored analysis rather than frozen as a rendered artefact.
A report improves as interpretation improves, without the person retesting. The genetics never changes, so the same sample keeps getting more valuable, which is a rare property in a consumer product and worth designing for deliberately.
Deletion has to mean something
The challenge. A person who asks for their genetic data to be deleted is not asking for a row to be flagged. And a platform holding data that identifies by itself cannot fall back on the argument that what remains is anonymous.
What we did. Treated deletion as a real operation across the stores that hold biological data, the identity that joins to it, and the derived report, rather than as a status change on an account.
A request has an answer that is true. Which matters more here than in almost any other consumer category, because the thing being deleted is the one thing the person can never get back if it is not.
The impact, depending on your job
If you run the business
Trust is the entire purchase decision. Nobody posts their saliva to a company they are unsure about. Every security decision on this page is a commercial one before it is a technical one.
The asset appreciates. Genetics is read once and never changes, so every improvement to interpretation makes every existing customer's test more valuable without anybody buying anything. That only works if the raw analysis was stored rather than only the report.
Five revenue models through one entitlement layer means a pricing change is configuration rather than an engineering project.
If you run engineering
The separation of biology from identity is the part worth your attention, because it is the response to a threat model where recovery does not exist. Reaching one store does not yield the pair, and the raw marker set sits behind one narrow read path rather than being available to anything that needs a number.
Then the alignment problem. Four sources on three clocks, each reading carrying the date it was true, so the interpretation layer knows how old the things it is reasoning about are.
If you run a delivery team
Most of what is on this page came from deciding where complexity lives. One adapter per wearable ecosystem. One profile shape downstream. Every step of the physical workflow a state rather than an assumption. Report generation into a fixed structure rather than free prose.
A structured output is easier to test, easier to compare and easier to regenerate than a paragraph, and it is what makes the boundary enforceable rather than reviewable.
If you own the numbers
Reports regenerate rather than retest. Improving interpretation costs compute, not another sample and another laboratory run.
The laboratory is the cost floor, so software efficiency shows up in support load and turnaround visibility rather than in unit cost.
Card details never reach the platform, which removes an audit scope permanently rather than managing one.
Deletion is an operation with a defined cost, rather than a legal exposure with an unknown one.
Talk to the client, not just to us
Everything on this page is our account of our own work. If you are seriously evaluating us, we will arrange a reference call with a client who has been through a build like this one, and you can ask them the questions you would rather not ask us.
Technologies we built with
We name the layers rather than the suppliers on the health data path, because a supplier map is our client's exposure rather than our credential. Full detail available under NDA.
More case studies
View all case studiesBuilding a platform holding data that cannot be reissued?
Tell us what you're building, and we'll tell you honestly how we'd approach it.