Platform · Private preview
The sovereign data + AI backend for health apps.
Bring your front end, your LLM, your prompts. We bring the patient-owned vault, privacy-safe AI, and compliance. Ship in weeks, not years.
The north star
Xanadu is the place a person owns their data and decides everything that happens to it.
Why Xanadu is different
Control all of your data, from anywhere. Even completely offline.
Big-tech health apps bring your data together, but on their cloud, on their terms. They don't let users keep it off the cloud, de-identify it for research they control, or share in its value. Xanadu does -- and your app inherits all of it.
Members keep records on their own device, no cloud required. The only thing that ever leaves is de-identified data they choose to share, with a receipt.
Load from files, downloads, or wearables across their full history, even from devices competitors can't reach.
Everything normalized to FHIR. Clean, portable, usable the moment it arrives. No data plumbing for your team to build.
Members opt in to research on their terms. PHI stripped to HIPAA Safe Harbor before anything leaves. You get the research channel; we handle the compliance.
For builders
You build the experience. We handle the hard part.
Think of it as the Stripe for health data: the secure backend every health app is built on, and never a competitor to the apps built on it.
Your front end, your brand, your chosen AI, your patient relationship. You stay the face; we stay invisible.
The encrypted, sovereign vault, record connection, de-identification, privacy-safe AI, multi-tenant isolation, and compliance.
And it pays you back: when your users opt into a data lease, you share in the revenue. The more your app helps them connect and consent, the more you both earn.
Built for enterprise trust
SOC 2 Type II and HITRUST readiness by design · HIPAA BAA on the backend · WA MHMDA and CCPA/CPRA compliant by design · built on ONC/CMS interoperability standards.
Formal certification follows as we scale; the architecture is built for it from day one.
Your data, any AI · Bring your own storage
Cut the cord. Members take their data to any AI.
Members export a de-identified summary (no PHI) and use it with any AI they choose. Identity stays on the device, so you and we never see it. Plug in what you want, unplug anytime.
The summary is de-identified on the member's device, no name or contact, before it goes anywhere.
Members can connect their own AI, on their terms. An opt-in choice, never the default, never silent.
Members store on their own device, their own cloud, or Xanadu's encrypted storage. Your app works the same either way.
Xanadu never sends member data to an AI on its own. The member chooses, every time.
Early access. Rolling out to supported devices. Talk to us about your platform.
The marketplace
One vault. Many apps. Real distribution.
Patients shop for apps inside Xanadu and grant or revoke with one tap. For builders, that's distribution to people who already own their data.
Use Xanadu standalone, or add apps. Partner apps are one way to use it, not the only way.
Many apps, one vault, through grants the patient controls. Apps plug in; they never re-collect.
We run the neutral control plane and store only. We don't build a competing app. The Stripe and AWS model.
Research marketplace
Research, on the patient's terms.
Reach consented, de-identified, continuously-updated cohorts for real-world evidence, without ever touching an identified person. The patient is invited, chooses each study, is paid, and can revoke anytime.
Anonymous by default. A member with a rare condition who wants the right researchers to find them makes that choice themselves, on their terms, with a receipt. The trust model rare-disease communities have been waiting for.
You see de-identified cohorts and counts, never identified people. Check study feasibility before you commit.
Every lease is receipted, revocable, and deleted when the study ends. Never re-identified, never re-shared.
Members are anonymous by default and can choose to be discoverable for the research they want to be found for. Rare disease →
Early access. The consented research marketplace is rolling out. Talk to us about a study or a research partnership. The research page →
How it works
One idea, end to end.
Records flow into a sovereign, encrypted vault they own. Normalized to FHIR.
One free screen to see and control every connection, grant, lease, and audit event.
Use it standalone, or add apps from the store with scoped, revocable grants.
Data is de-identified before any AI sees it, and the AI never keeps it. Opt-in leases pay the patient.
Three ways Xanadu creates value.
License the vault, privacy-safe AI, and compliance. Ship faster.
List your app and reach patients already shopping for one.
Own your data, control it, earn from it. The patient side →
Builder & investor FAQ
The questions we get most.
Sovereign-vault infrastructure that health apps build on. The patient owns an encrypted vault; your app plugs in and keeps its own brand, users, and experience. Think Stripe for health data: the secure backend, never a competitor to the apps on it.
No. The patient holds the data and the keys. Your app receives clean, consented, structured data and never holds the raw PHI, or the liability that comes with it.
The patient authorizes your app with one tap, and can revoke that access anytime. Records flow in through standardized, FHIR-based channels; your app reads the scopes the patient granted, nothing more.
Platform licensing plus per-member pricing to the apps that build on Xanadu, with an optional, patient-controlled research lease. Specific rates are shared in a 1:1.
Three things: 8 U.S. patents pending on the core; an architecture where the patient holds the keys, so there is nothing to breach or sell; and a network effect, where every app that builds on Xanadu makes the vault more valuable. A platform, not a feature.
They own the account and the keys, they are walled gardens, and they increasingly compete with the apps on their own platforms. Xanadu is neutral rails: the patient holds the keys, and the vault follows them across iPhone, Android, providers, and apps. You build on infrastructure, not on a landlord who may become your competitor.
The earlier attempts died for two reasons that no longer hold: there was no way to get data in without hand-entry, and people would not hand their records to a big-tech custodian. Today the interoperability rails exist, patient-access APIs and approved TEFCA/QHIN networks, plus the health data already on people's phones, so records flow in automatically. And we do not custody the data or the keys, so there is no honeypot and nothing to sell. It is a platform others pay to build on, not a consumer loss-leader.
Data is encrypted on the patient's device, with a HIPAA BAA on the backend. Controls are built to SOC 2 Type II and HITRUST readiness, with WA MHMDA and CCPA/CPRA compliance by design, on ONC and CMS interoperability standards. Formal certification follows as we scale; the architecture is built for it from day one.
Through the founding design-partner track. Book a call or join the early-access list below as a developer or partner, and we will set up a scoping call.
Why we build this
Healthcare data failures hurt real families.
Our founder lost his wife seven days after she delivered their third daughter, because warning signs in her data never reached the people who could act. Patient data ownership isn't a checkbox here. It's the reason the architecture puts the patient in control of everything.
Build a sovereign, AI-powered health app on Xanadu.
Or join the early-access list: