Ametti is in early private testing, and features arrive in stages. This page describes the design the product is built on, and we mark the line between shipped and planned wherever it matters.
The vault
Your record lives in an encrypted vault on your own device, locked with keys that only you hold. When the vault syncs between your devices, the servers involved store only encrypted data they cannot read. We cannot see your records. Neither can anyone who compromises a server, because there is nothing readable to take.
There are no passwords to invent and no cryptography homework. You unlock Ametti the way you unlock your phone, and a recovery kit you set up once protects you if a device is lost.
Bringing records in
A record is only useful if getting everything into it is nearly effortless, so filling the vault is Ametti's first job. Photograph the papers in the binder. Drop in the PDFs and files you have collected. Import the records you can download from patient portals. Ametti structures what arrives into clean timeline entries, and always keeps the original document attached to what was extracted from it.
Scanning and importing your own documents works anywhere in the world. Portal imports and provider connections arrive region by region, and the honest status of each path lives on the coverage page.
One timeline, with sources
Everything in the vault becomes a single timeline: visits, diagnoses, medications, lab results, procedures, vaccinations, documents. You can browse it by time or by category, and search all of it, privately, on your device.
Every fact in the timeline shows how it entered the record, in one of three tiers:
- Source verified. Fetched or imported directly from a provider system, unchanged.
- Document derived. Extracted by AI from a document you added, with the original always attached for checking.
- Noted by you. Something you recorded yourself, clearly labeled as yours.
The tiers are visible everywhere, including in anything you share. That visibility is what lets a doctor rely on the record.
Originals, corrections, and provenance
Medical records contain errors, and errors in records can be dangerous. Ametti's answer rests on one rule: original records are never altered. What a doctor wrote stays exactly as written, with its source and date attached.
When you find something wrong or missing, you add a correction or comment as a note of your own. Your note is preserved alongside the original, visibly labeled as coming from you, with its own date. A reader always sees both the source's account and yours, and never has to wonder whether a record was quietly edited.
Ahead of us: a step where a clinician can review and confirm a patient note, so that a verified correction becomes part of the record's trusted provenance. This is direction, and it is not built yet; we mark the line between shipped and planned deliberately.
Understanding your record
Ametti explains what is in your record in plain language: what a result means, how it compares to its reference range, and how it has moved over time in your own history. Before an appointment, it can gather what has happened since the last visit into a summary and a list of questions worth asking.
Explanations are grounded strictly in your own record, and every statement cites the entries it came from. Ametti organizes and explains; it does not diagnose, and it does not direct treatment. Those decisions belong with you and your doctors.
Export and delete
The vault is yours, and the way out is always open. You can export your complete record at any time: in standard structured formats that other health systems and tools understand, and as human-readable files anyone can open. There is no lock-in by design, because a record you cannot take with you would repeat the original problem.
Deleting is equally real. Your data exists encrypted under your keys, and when you delete your vault, it is gone.