The same person, the same vault, anywhere
Most health apps trap your data inside them. Xanadu flips it: the data and the identity belong to the person, and the apps are just doors onto the same vault.
One identity
Sign in once. Your Xanadu identity is yours, portable across every app.
One vault
Your record lives on your device first. Every app reads the same vault.
Your consent
Nothing is shared or leased unless you say yes, in plain terms, with a receipt.
Sever anytime
Leave any app and keep your identity and data. One switch stops every lease.
Pick an app to explore
The Xanadu core and five example partner apps. Same core, same vault, a different front door for each audience. Tap each one.
Your health, off the cloud
The basic Xanadu core, built for cord-cutters. Your whole health record lives on your own device: no Big Tech, no surveillance, no account in someone else’s cloud. Every partner app is built on this same core.
- Off-cloud by default: your record stays on your device
- Bring in your provider records, labs, and pharmacy from MyChart and other portals
- Add your wearables and devices, all in one private record
- Lease only if you choose, and keep 80% of every payment
This is the core. Every app reads from this same vault.
Safer pregnancies, on the family’s terms
A partner app for maternal and newborn programs. The pregnancy, the birth, and the newborn’s first months in one timeline the family owns, and keeps after the program ends.
- Track pregnancy and newborn data in one place
- Share with the care team by consent, not by default
- The family keeps the same vault when the program is over
Same identity, same vault as the core app, with a maternal-care front door.
Community health, community trust
A partner app for a community health program. Built for places where trust in the system has been broken before, so the member owns the record, not the program.
- Connect clinic and community sources into one record
- Members own their data; the program never holds the keys
- Plain-language consent and a receipt for every share
Same identity, same vault. Leave the program, keep your record.
Your words, your data
A partner app for voice and AI health conversations. Speak a note after a visit and it flows into your vault, not someone else’s cloud. When you want an AI’s help, you share a de-identified summary, on your terms.
- Voice notes and transcripts land in your vault, not a silo
- Share a de-identified summary with your local or favorite AI, or a partner app with AI
- No name, no contact, and no exact dates leave your device
- You consent to every use, and can revoke it
Same identity, same vault, for a different kind of health data.
Your celiac diagnosis and diet, on your terms
A partner app for people living with celiac disease. It keeps your diagnosis and gluten-free needs as health data you own, so you can share them, only by your consent, with the people and apps you choose, including the menu and diet apps that help you eat well.
- Celiac disease stored as a standard health record (FHIR Condition)
- Your gluten allergy stored as a standard record (FHIR AllergyIntolerance)
- Share it, by your consent, with other apps that help with menus and diets
- Every share leaves a receipt, and you can revoke anytime
- Backed by your full Xanadu record: labs, conditions, and more
Same identity, same vault. Your diagnosis and preferences travel with you.
Real-world evidence, on the participant’s terms
A research app for a clinical study, as an app or a web portal. For example, a double-blind study monitoring mothers and babies before and after delivery, with a randomized control group. Participants opt in without ever exposing their identity first, and the study never touches an identified person.
- Blind, two-way match: the study sees feasibility, never you, until you consent
- Supports double-blind designs with a randomized control group
- De-identified, time-boxed, revocable lease, with a receipt
- Three views in one platform: participant, site admin, research analyst
Same identity, same vault. The study rides on Xanadu; it never owns the data.
How it all connects
You decide which real-world data to bring into your vault, your provider or EMR record, wearables, labs, and pharmacy, all easy to connect and manage in the app. Together they build a rich, longitudinal real-world-evidence (RWE) record on your device. The richer your record, the better you align with the studies you could choose to join, if you share your de-identified data.
Two-way arrows are apps that read and write your vault; one-way arrows feed data in or share it out. Scroll sideways on a small screen →
Follow one person across all of it
Meet Jane, a new mother who cut the cord on Big Tech. One identity, one vault, six apps. Tap each step.
Act 1 · Jane takes control
Jane cut the cord on Big Tech years ago. When she learns she is pregnant, she wants her health on her own terms, so she sets up the Xanadu core and imports her records. Her Xanadu Score climbs from Getting Started to Growing. Nothing has left her phone.
🔒 Vault created on Jane’s deviceAct 2 · She’s expecting
Her OB practice offers the Maternal Health app. Jane signs in with the Xanadu identity she already has, no new account, and her pregnancy, delivery, and her newborn’s first weeks build into one timeline she owns. Same vault, a maternal-care front door.
🔑 Same identity, same vault, new appAct 3 · Her clinic joins in
Jane’s community clinic runs the Community Health app. The same record follows her there, no re-upload and no second copy living on someone else’s server. If she ever leaves either program, she keeps everything.
🔑 One record, no second copyAct 4 · A study for her baby
Jane is invited to a double-blind study monitoring mothers and babies before and after delivery, with a randomized control group. She opts in through a blind match: the study sees only that she fits, never who she is, until she consents. A de-identified, time-boxed lease is granted, and she can sever it at any moment.
🛡️ Consented, de-identified, revocable leaseAct 5 · She asks for help, privately
After a late-night feeding worry, Jane speaks a note into the Voice & AI app instead of typing, and it lands in her vault. When she wants an AI’s take, she shares a de-identified summary, no name, no contact, no exact dates, with her local or favorite AI of her choice, or her favorite partner app that has AI capabilities.
🎤 De-identified summary, her choice of AIAct 6 · She owns her diagnosis
Jane has celiac disease. In the Celiac & Gluten app she keeps her diagnosis as a standard health record (a FHIR Condition) that she owns, so she can share it, only by her consent, with whoever needs it: a clinic, a caregiver, or an app she trusts. Back in the core app, one timeline shows it all, every touch under her control.
🍽️ New data type, same sovereigntyThe research app, in three views
One double-blind study, one platform, three roles, and not one of them ever needs a central pool of identified data.
Participant
The person decides everything, in plain language.
- Opt in with a blind match: the study cannot see you until you say yes
- In a double-blind study, neither you nor the site staff knows your group
- See what is shared, and sever the lease anytime, deleted within 72 hours
- Full provenance and a receipt are tracked for every share of your journey, and for every revoke
Site administrator
Runs enrollment, consent, and randomization without becoming a data honeypot.
- Enroll participants and manage consent within the IRB-approved protocol
- Blinding and the control group are preserved by the platform, not by spreadsheets
- No central store of identified records to secure, breach, or subpoena
Research analyst
Works with consented, de-identified cohort data, never an identified person.
- Compare treatment versus control without ever seeing identities
- Receive only de-identified, consented, time-boxed data
- The sponsor’s study data flows one way and never returns to a participant’s vault
Want an app for your organization?
Maternal care, community health, voice and AI, diet and nutrition, a clinical study, or something we have not built yet. If your people deserve to own their health data, there is a Xanadu app for them.
This is an interactive concept demo built on synthetic data, for an app and partner apps launching in 2026. The apps shown are illustrative examples; not all represent live or signed partnerships. Xanadu never sells your data, and your data never leaves your device unless you choose to share or lease it, de-identified, with a receipt.