The iceberg model of personal data

1. The Tip Is the Whole Product

Open any patient's relationship with their own care and you will find the same three questions, asked over and over, by patients and by the families supporting them: When is my next appointment? What did the doctor say? What am I taking? Those three questions map to three surfaces — appointments, documents, prescriptions — and those three surfaces are the part of the iceberg above the waterline. They are what a person sees, touches, and judges the whole system by.

This is easy to underrate. The deep capabilities — clinical retrieval across years of records, conversational warmth, a 3D anatomy viewer, sovereign on-device inference — are more impressive to demonstrate. But they are not the daily hook. The daily hook is the tip. If the three surfaces a person touches every day feel seamless, they trust that the whole iceberg is competent. If those three feel clunky, no amount of brilliance below the waterline saves the relationship.

So the tip is not a starter feature to get past on the way to the real product. The tip is the product. Everything else is what the product makes possible.

2. What Sits Below the Waterline

Beneath those three surfaces sits the larger body of the iceberg — the services that only become possible once a complete, structured, patient-controlled record exists. None of them are the daily hook. All of them are the reason the daily hook matters.

The pattern of the iceberg is exact: a small, coherent, high-frequency tip resting on a large, latent mass that the person reaches only when they need it. The mistake most health software makes is to build outward across that mass feature by feature — an appointment tracker here, a medication list there, a chatbot bolted across the top — so that each piece speaks its own vocabulary and the whole thing drifts apart under its own weight. The iceberg breaks up. The pieces float off.

LeptonX builds the other way. We build downward from the tip, on a single foundation, so the mass stays attached.

3. Why the Iceberg Holds Together: First Particles™

LeptonX takes its name from the lepton — a fundamental particle of physics, an object with no known substructure. The name states the method. You cannot go lower than a particle, and that is where we begin.

First principles says: reason rigorously, from foundations. First Particles goes one level deeper — decompose every capability to its smallest deterministic, inspectable unit before any language model is ever invoked, then rebuild upward from those units. A particle is the smallest piece of an answer that is independently true, citable, and inspectable. Before the system ever speaks, a question has already been broken into particle-level operations — deterministic lookups and retrievals that can be read, verified, and traced. The model is invoked last, over material already made trustworthy, never first, over a pile of raw data it must interpret on faith.

That single inversion — compile and decompose first, generate last — is why the iceberg holds together. Three named concepts carry it:

Concept	What it means
Compiled Patient Knowledge (CPK)	Every document, fact, and embedding is compiled and indexed locally, per patient, at ingest. Compilation happens once; retrieval afterward is instantaneous. The system queries compiled knowledge — never the raw vendor corpus at the moment a person is waiting.
Particle Taxonomy®	Compiled knowledge is decomposed into irreducible units — particles — each independently queryable, citable, and inspectable. Document particles, structured-data particles, and conversational-memory particles are distinct types that recombine with precision.
First Particles™	The founding design philosophy: every capability is reduced to its smallest deterministic unit before any model runs. It is the rule that governs how CPK is built and how the Taxonomy is drawn.

These are not marketing terms layered over a conventional stack. They are the actual primitives. You do not trust the system because we say so. You trust it because you can read the queries it runs.

4. The Discipline That Makes It Coherent

A philosophy becomes a product through a small number of commitments that hold across every service — the three at the tip and everything below. These are what keep the iceberg from fracturing.

4.1 Compile at ingest, retrieve in place

Raw records — typically FHIR R4 bundles drawn from a person's own portals — are transformed at the moment of ingest into typed, patient-scoped, locally-resident artifacts. The system never runs similarity search across raw bundles while a person waits. It queries compiled knowledge that already carries its citations. This is the difference between answering from a library you have read and catalogued, and answering from a pile of paper you are seeing for the first time.

4.2 Scope at storage, isolate by patient

Every particle is scoped to exactly one patient at the moment it is stored. No query, retrieval, or generated answer on behalf of one patient can be influenced by another patient's data. This patient isolation is an architectural guarantee enforced in storage, not a runtime filter that can be forgotten.

4.3 Mistake-proof every layer (poka-yoke)

Wherever a wrong operation is possible, the design makes it impossible rather than merely discouraged. Borrowed from manufacturing, poka-yoke means the unsafe path cannot be taken, not that staff are reminded to avoid it. Defense is layered: if one guard is bypassed, another stands behind it.

4.4 Stay sovereign

The person's data, the compute that processes it, and the model that reasons over it all reside under the person's physical control. No protected health information leaves the hardware. This is the moat and the promise at once. A competitor can build a slick appointment tracker. It cannot replicate sovereign, on-device intelligence that connects appointments to lab trends to medication history in real time, locally, without surveillance.

Because every service draws from the same compiled, patient-scoped, mistake-proofed particles, the services cannot drift apart. The medication view and the document view are not two products that must be reconciled — they are two readings of the same underlying particles. Coherence is inherited, not engineered after the fact. That is the property that keeps the whole iceberg moving as one body.

5. The Line That Never Moves: Record-Bound Speech

The single most important discipline is also the simplest to state: if the record does not say it, the system does not say it. We call this Chart-Bound, or Record-Bound, Speech. It is the rule that turns a powerful language model into a safe navigator rather than an unsupervised interpreter. The system turns complex medical information into plain-language understanding without adding medical conclusions.

This doctrine is enforced in three reinforcing layers, in keeping with the poka-yoke commitment: a system-level constraint that binds every response generated; a domain deny-list that blocks speculative outcome language unless it appears verbatim in the source; and a router-level guard that refuses to invent clinical content when no grounded source material is present. If diagnostic terms such as recurrence, progression, or metastasis appear, they are used only because they appear in the record — never because they were inferred.

Workup language stays workup language. When a record describes several possibilities under evaluation, the system preserves that uncertainty rather than collapsing it into a verdict. This is the line between navigation and diagnosis, and LeptonX stands firmly on the navigation side of it — at the tip and everywhere below.

6. Reaching Below the Waterline: A New Service, Same Particles

The strongest test of a discipline is what happens when you ask it for something new. The Family Update — a structured, family-facing summary for relatives supporting a loved one through complex, ongoing treatment — is exactly such a test. It is a service from deep below the waterline. It required almost no new philosophy.

Families want clear, compassionate updates: what is happening, what changed, what is coming next, and how they can help. The naive build is an open-ended medical summary generated by a model — precisely the unsafe path LeptonX refuses. Instead, the Family Update is assembled from particles that already exist.

6.1 Same three categories, recombined

The Family Update is anchored to the same three pillars at the tip — Documents & Lab Results, Medications, and Appointments. It invents no new taxonomy. Recent appointment summaries, flagged labs, and repeat trends come from the Document particles. Active lists and medication-burden questions come from the Medication particles. Upcoming and recent visits worth a family's awareness come from the Appointment particles. A submerged service drawn entirely from the visible tip.

6.2 Same boundary, inherited intact

Record-Bound Speech carries over without modification. For labs, the framework is deterministic wherever possible — read the structured value, state the marker, the value, whether it was above or below range, and the listed reference range; then stop. For medications, it organizes the list into questions for a pharmacist or physician but never decides whether a medication is necessary. For trends, the safest output is a trend summary plus suggested questions, never an interpretation of clinical meaning.

6.3 Why this is the proof

The Family Update needed no new safety model, no new vocabulary, no new data path. It needed only that existing particles be read through a new lens — the family's. That is what coherence looks like in practice: a genuinely new, valuable service that snaps into place because the foundation was decomposed correctly the first time. Every future service below the waterline — the in-hospital advocate, automated form-fill, pharmacy support, the consent-gated third-party layer — reaches the surface the same way.

7. The Output Standard

Whatever the service — a single document question or a full family update — the standard for what the system produces is constant:

• Summarize what the record shows.
• Explain it in plain, calm language.
• Separate confirmed facts from open items.
• Identify reasonable questions for the care team.
• Avoid unsupported conclusions — always.

The output should feel human, calm, and useful. It should help a person or a family understand what is happening without creating fear, confusion, or false certainty. That last clause is the whole discipline compressed into five words: false certainty is the enemy, and record-bound, particle-built services are how LeptonX eliminates it.

8. Conclusion

The iceberg model is not a metaphor for scope. It is a claim about construction. The three surfaces a person touches every day are the visible tip; the rich system of services beneath them is the point. But the tip and the mass are only one iceberg if they are built from the same material — the same compiled, patient-scoped, record-bound particles, under the same mistake-proofed boundaries, on hardware the person controls.

Build it that way and coherence is inherited rather than chased. The three daily pillars, the family update, and every service still below the waterline all turn out to be readings of the same underlying particles — which is exactly why they hold together as one body rather than drifting apart as a field of features.

Sovereign personal healthcare is where we began because it is the hardest place to begin. The method that holds here will hold elsewhere. First Particles™.

Back to Notes & Whitepapers