Consumer products people love, and trust with what matters most.
We build consumer health and wellness products where the honest data is the entire input: guidance drawn from a person's own history, privacy designed in at the moment data is written, and the engineering that turns a two-week motivation spike into a habit that lasts.
The constraint
In wellness the honest data is the entire input. People write things down in these products that they have not said out loud, and they only do that in a space they believe is private. So a privacy failure is not a breach with a remediation plan. It quietly turns every future entry into a performance, and the personalisation engine starts learning from a curated version of a person. The product does not break. It becomes a content library with a name in the header, which is the thing it existed to be better than.
Two of the consumer products we have built, chosen because each one turned on a constraint the category does not usually acknowledge.
Bonds, a relationship wellness app for two people
Two partners share one account, and each keeps a private space the other cannot see. That is the product. But a couple-level average over private answers is a lookup rather than an aggregate: know your own number and you know theirs. A design that is completely safe across a thousand users behaves differently across two, and it does not look different at review time, because it is the same design.
So privacy is classified when data is written rather than filtered when it is displayed, which means a screen that forgets to filter does not receive the records and hide them, it does not receive them. Couple-level figures show trend and direction rather than a number.
And AI context is scoped to the partner asking, so one partner cannot reach the other's private material by asking the coach about it. That closes the most obvious side channel in any product with a conversational interface over a shared dataset.
A precision longevity platform
A leaked password is changed by the afternoon. There is no equivalent action available for a genome, at any price, for the rest of somebody's life. It is also not only theirs, because it discloses a great deal about parents, siblings and children who never consented to anything. And it identifies by itself, so anonymisation in the ordinary sense is not available.
That changes the question from how to recover from a breach to how to be worth less to somebody who achieves one. The biological data and the identity it belongs to are held apart, encrypted under keys managed separately from the data they protect, and the raw marker set is read by the interpretation step and almost nothing else. Everything downstream reads a report.
The wearable side is a clock problem. Four data types on three different clocks, where genetics never changes, a blood panel is true around a date, and a watch changes every few seconds, and treating them as three points on one timeline produces a confident statement about a person that none of the inputs support.
These are two of the consumer platforms we have worked on. The full set is in our case studies, including work we cannot name.
What we would expect to deal with on your product
Not a service list. Four problems that show up on most consumer wellness products, and the decision we made when each showed up on ours.
Personalisation that runs at question time puts a multi-second wait in front of the smallest, most frequent interactions, exactly the ones a daily habit depends on, and it gets slower and more expensive in direct proportion to how well the product is doing. So the work happens ahead of need and the morning open is a database read rather than an inference.
Sending a user's full history to a model with every question fails on three counts at once. Cost and latency scale with tenure, so the most engaged users get the worst experience. Answer quality degrades as the relevant signal is buried in months of routine entries. And far more intimate material leaves the platform than any single question justifies. A compact derived profile, rebuilt in the background, is the same input at a fixed size.
A model given a description of a frightening situation will produce fluent, specific, plausible advice, and a person with nobody else to ask at two in the morning will act on it. There is no error state for a well written response to the wrong kind of message, so the decision about what kind of message this is has to be made before generation rather than reviewed after it.
A notification is granted once and revoked permanently. Too few and the habit does not form, which is recoverable. Too many and the user turns them off at the operating system level, which is close to unrecoverable, because the product cannot ask again through the channel it just lost.
Privacy, and what it actually costs to get right
In this category privacy is not a risk control sitting beside the product. It is the input. Honest data is the only data worth personalising from, and people are only honest in a space they trust, so the privacy design and the product quality are the same thing.
Classification at write rather than filtering at read, so a feature nobody has written yet inherits the boundary by default rather than being audited into compliance.
Enforcement below the application, so a screen that forgets to filter does not receive the records at all.
AI context scoped to the person asking, which closes the side channel a conversational interface opens over a shared dataset.
Notifications that carry a pointer rather than content, because a lock screen is the least controllable surface in a mobile product, and in a shared-account product the person most likely to be looking at it is the one who must not.
Statistics over private inputs constrained so an individual value cannot be reconstructed from them.
The most sensitive material travelling the shortest distance it can, and leaving without a name attached.
We build to the relevant data protection standards, and we don't claim certifications we don't hold. That restraint is a credential in a category where the data is this personal.
Retention, and why it is an engineering problem here
Wellness products drop off steeply after the first fortnight. Motivation carries two weeks. After that only habit does, and most products have nothing in place for the handover.
So the daily ask is sized for the worst week rather than the best one. An exercise that needs a good evening only happens on good evenings, and the weeks that matter most are rarely the good ones.
Reinforcement sits on consistency rather than volume, and accumulated progress is made visible, because it is the one motivator that strengthens over time while every other one decays.
And a streak that occasionally eats a day is worse than no streak, because it teaches people the number is not real. That is a concurrency problem before it is a product one, and it is why shared state is written through a single path rather than from two devices at once.
Which trust services criteria this work is judged on
Privacy, which is the criterion this category lives on. It concerns the people the data is about and what say they have over it, and in a shared-account product it includes the boundary between two people inside one account.
Processing integrity, which is the one nobody expects in a consumer app. It asks whether the system does what it claims, completely and accurately, and a shared counter that silently loses a day fails that test. Here it is not a cosmetic bug, because the counter is the reinforcement mechanism.
Confidentiality, in the separation between what is shared and what is private inside a single account.
The boundary, stated plainly. The control set is designed against the criteria rather than mapped to them afterwards. That is a statement about how a platform was built, not a claim to hold an attestation, and where a client needs one, the work is theirs to complete with an auditor. We don't claim certifications we don't hold.
What the platforms actually do
Structural facts about the builds rather than adjectives. Every one is checkable from the product.
How you'd work with us
Pick the level of ownership that suits you.
Staff augmentation
Add senior consumer-product engineers to your team.
Dedicated team
A committed team that runs like your own.
Full delivery
Hand over the build and we deliver it end to end.
Frequently asked questions
How do you build real personalisation?
Not by sending a person's history to a model with every question. A compact derived profile is rebuilt in the background as new entries arrive, so guidance draws on the whole history at a fixed size and a fixed cost, and the morning open is a database read rather than an inference. The most engaged users get the best experience instead of the slowest one.
How do you protect intimate data?
By classifying it when it is written rather than filtering it when it is displayed, and enforcing that below the application, so a screen that forgets to filter does not receive the records at all. AI context is scoped to the person asking, notifications carry a pointer rather than content, and the most sensitive material travels the shortest distance it can, leaving without a name attached.
Can you integrate wearables?
Yes, from whichever device somebody already owns. Each ecosystem's data is normalised into one internal shape, with the time a reading was true kept separate from the time it arrived, so the interpretation layer works with one clean signal rather than seven vendor formats.
How do you design for retention?
Around the fortnight problem. Motivation carries two weeks and only habit carries after that, so the daily ask is sized for the worst week rather than the best one, reinforcement sits on consistency rather than volume, and accumulated progress stays visible because it is the one motivator that strengthens over time.
Building a consumer product people will trust with what matters most?
Tell us what you're building, and we'll tell you honestly how we'd approach it.