Your data. Your environment. Your terms.
A private environment inside your own walls, where your data works in contained bubbles. Questions go in. Answers come out. Records stay.
Today, fidelity is all or nothing. So plans choose nothing.
Why plans stay partial
Put a merged record in the core and it touches every decision, audit and liability at once. No plan can underwrite learning the consequences in production, so staying partial is the rational choice.
Who uses the data instead
Meanwhile, vendors pull extracts, brokers pool thinner copies, and sponsors buy answers elsewhere. Your plan carries the obligation. Most of the value is built somewhere else.
Many bubbles. One record. Nothing bleeds between.
A bubble is four things: the slice of data in it, its purpose, who is in it, and what may leave.
Never, by your rule. A device maker is never in a bubble that holds prior-auth data.
Find out before you bet.
This is what the environment is for: take one decision you already make. Inside a bubble, replay last year's cases against the merged record and see what would have changed. Nothing in production moves. Then decide.
The gate
One gate, one policy per bubble. It enforces which uses run and what may leave, and records both. Every byte that crosses is logged.
Why it is safe to look
The merged record is not a finding. Only the controls you choose to run produce one. Payment look-backs run under counsel, with the intent to fix what they find.
Why it is cheap
The environment is for a replay that costs a bubble and a question, not a new program. If the answer is bad, you learned it for the price of a test. If it is good, you know what it would do before deciding.
What your environment can host.
Outside parties never receive records. They send questions, models or their own data in, and receive answers. You approve each bubble.
// Your own uses
Fraud, care management, utilization, prior auth and risk. Run them where they pay. Try them first where the outcome is unknown.
// Existing vendors
Today’s opaque extracts become governed bubbles. You see what each vendor works on and what leaves.
// Residents
Vendors compute inside instead of taking data out. Questions go in. Results come out. Records stay.
// Evidence buyers
Pharma and device sponsors bring a study question about a real population. You approve the study and run the computation.
// Provers
Device and digital-health makers bring member-consented data in, join it to outcomes and run coverage evidence inside.
// Models
AI is not the headline. It is the heaviest beneficiary. The model comes to the data. Results leave. Data does not.
One thing to agree per request: the request.
Today every sponsored study is its own contract. Here, the durable terms are agreed once.
Standing terms
You set where computation happens, what may leave a bubble, logging, the small-count rule, liability and the price schedule. Each outside party sets conduct, what it may bring in, which reviewed results it receives and publication.
The request
The question. The population. Which bubble. What comes out. The fee.
What stays per request, on purpose: the ethics or privacy-board decision, your yes or no on the science and the sponsor, and any house rule.
HARROW: the merged record the payer owns.
A payer's record of itself lives in fragments: claims with one vendor, eligibility with another, prior years in a TPA's extract. Each copy is partial, and where they overlap they disagree. HARROW brings those fragments together into one record the payer owns, every value with its receipt, over the systems already running, inside a boundary the payer or its sponsor controls.
Every value keeps its source, the raw bytes it came from, and a hash you can recompute. Where sources disagree, both values stay; a use that needs one picks by a named rule, on the record. When a source corrects a value later, HARROW follows it to every answer that used the old one. Deterministic rules, no model in the decision path; unresolved exceptions route to human review with the machine evidence intact.
briefing on request · synthetic data only · no PHI anywhere
Receipts prove lineage and reproducibility. They do not prove clinical truth or an audit outcome.
You own it. That is what makes a bubble possible.
Computation that happens inside your boundary, under your control, on your decision, is you using your data. Nobody is handed a record.
Payer-owned data
The merged record is your asset. It resides in your infrastructure under your control. Zkeleton operates on it. Zkeleton does not hold it.
Payer-owned VPC
The system runs inside your virtual private cloud. Zkeleton operates there as a contractor, not as a landlord holding your data elsewhere.
Payer does nothing new
The environment stands beside the core, never through it. Nothing is replaced. Your decision systems stay where they are.
One-sided upside
Upside accrues to you: stronger fraud, risk and operational decisions. The transformation work and architectural burden stay with Zkeleton.
We are not building an exchange network. Exchange networks aggregate clinical data through shared pipes in a vendor cloud. Zkeleton runs inside your own boundary. No shared pipes. No vendor cloud. Records stay under your control.
Everyone uses your data except you. Zkeleton lets you use all of it, a contained piece at a time, and be the market instead of the thing being marketed.