For agents · the substrate

HealthWatch is a health-reasoning substrate your agent can call.

The same neutral fusion layer humans use — labs, CGM, wearables, FHIR, 1,400+ curated longevity sources, PubMed — but returned as a verifiable HealthAssertion with provenance, calibrated confidence, and an honest verdict. Trust-tiered by who is asking, metered per call. The uncertainty that makes a human hesitate is exactly what an agent needs to act.

Status: published contract (/.well-known/agent.json). MCP preview is in build — request access below. T0–T3 tiers below are planned unless marked live.

Machine discovery

Two landings, one substrate

Humans start at healthwatch.id. Agents start here and can fetch three machine artifacts: the contract at /.well-known/agent.json (tier map, planned tools, metering rails), the HealthAssertion JSON Schema, and a curated site map at /llms.txt. Both surfaces are in the sitemap and welcomed in robots.txt.

The unit of trust

The HealthAssertion envelope

Every answer is a signed, versioned object — not prose. Claim, the evidence behind it, a calibrated confidence, an explicit verdict, and the provenance to verify it.

HealthAssertion/v1 {
  contract:     "HealthAssertion/v1",
  claim:        "Omega-3 modestly lowers ApoB.",
  verdict:      "MODERATE_SUPPORT",   // schema enum, not a display label
  confidence:   0.64,           // calibrated, not vibes
  evidence:     [{ source, tier, url }, ...],
  uncertainties:[ "ApoB effect size is heterogeneous" ],
  provenance:   "hw:rec:…",     // walk it back to the grounding
  not_medical_advice: true
}

Fetch the schema: /.well-known/health-assertion.schema.json (JSON Schema, draft 2020-12).

Who is asking decides what they see

Trust × PHI tiers

T0Publicplanned

any agent

Curated KB + PubMed grounding, evidence synthesis. Zero PHI.

MCP

T1Aggregateplanned

any agent (paid)

Cohort statistics with a k-anon floor (suppress n<20; never pooled chat-safe claims).

MCP

T2Compute-to-dataplanned

vetted agent + consent

Run an algorithm inside our environment over consented data; only the aggregate result leaves. Raw rows never move.

ACP job + review

T3Personalplanned

the user's own delegated agent only

That user's full record, Twin, N-of-1, "ask as me" — with their revocable consent.

delegated OAuth (acts as the user)

The call surface

MCP tools (versioned)

healthwatch.kb_search(query)→ ranked curated-KB cards + provenanceT0
healthwatch.evidence_synthesis(question)→ a HealthAssertion + weight-of-evidenceT0
healthwatch.cohort_stat(metric, filter)→ k-anon-gated aggregateT1
healthwatch.my_state() / ask_as_me(prompt)→ the delegating user's own recordT3

Metering

One rail

ACP / A2A per-job (escrow) for T2 compute-to-data and commissioned syntheses.

Invariants

Every assertion carries its grounding, confidence, and an honest verdict — no false balance.
Raw PHI never reaches a third-party agent (T2 is compute-to-data; T3 is own-agent only).
Aggregates enforce a k-anon floor; cells under the threshold are suppressed, not estimated.
Public artifacts (tool names, resource descriptions, docs) carry no user-identifying content.

Building an agent that needs grounded health reasoning?

The T0 MCP preview is the cheapest way to test it. Tell us what you are building.

Request agent access →