diff --git a/README.md b/README.md index f0f168074..1a6994b5f 100644 --- a/README.md +++ b/README.md @@ -28,14 +28,19 @@ HealthLog is a self-hosted health tracking app (PWA + native iOS client) that runs from a single `docker compose up` on a NAS, homelab, or small VPS. It brings weight, blood pressure, pulse, blood glucose, body composition, sleep, mood, menstrual cycle, and medications onto one timeline — synced from the devices you already own — and keeps everything encrypted at rest on hardware you control. No vendor cloud, no subscription, no telemetry. +HealthLog is a personal health record-keeping and wellness tool. It is not a medical device and does not diagnose, treat, cure, or prevent any disease — it helps you log, visualise, and export your own data, and leaves clinical judgement to a clinician. + Try the [live demo](https://demo.healthlog.dev) to see a working install — sign in with `demo` / `demo123demo123`. ## Highlights -- **Every vital on one timeline.** Weight, blood pressure, pulse, glucose, body composition, sleep, SpO₂, mood, and cycle tracking — charted with trends, moving averages, and clinical reference ranges (ESH 2023, ADA 2024), overridable with the targets your clinician set. +- **Every vital on one timeline.** Weight, blood pressure, pulse, glucose, body composition, sleep, SpO₂, respiratory rate, mood, and cycle tracking — charted with trends, moving averages, and clinical reference ranges (ESH 2023, ADA 2024), overridable with the targets your clinician set. +- **Clinical signals, opt-in and additive.** Validated mental-wellbeing self-checks (PHQ-9, GAD-7) that sit beside mood tracking with calm crisis-resource handling, grip strength, a 0–10 pain score, waist and body measurements, and a longevity lab panel — each added through one signal registry, so a new signal wires into charts, correlations, the coach, the FHIR map, and the API at once. +- **Records and the documents you're handed.** Structured allergies and family history (encrypted), lab values you key in or scan, and inbound documents — discharge letters and reports — read to extract the facts they state (values, codes, dates) for you to review and confirm. HealthLog transcribes what a document says; it never interprets or diagnoses from it. (Immunization records are deliberately out of scope.) +- **Context that explains the numbers.** An opt-in environmental module folds weather, daylight, and temperature in as influence signals (winter darkness against mood, heat against blood pressure) using a home location you set, so a pattern has somewhere to point. - **Your devices, one server.** Withings, WHOOP, Oura and Polar sync over OAuth2, Fitbit connects experimentally over the Fitbit Web API, an Apple Health `export.zip` folds your full history in, and the native iOS app streams HealthKit live. A per-metric source priority decides which reading is canonical when wearables overlap. - **Medication tracking that tells the truth.** Flexible schedules (weekly injections, weekday-only, intervals, PRN, cyclic), a configurable intake window per dose, and a traceable dose history where every slot reads taken, late, skipped, or missed — the same ledger the compliance rate is computed from, so the percentage can never disagree with the timeline. -- **AI insights you own.** Daily briefing, health scores, correlations, and a conversational coach grounded in your own measurements, with proactive check-ins. Bring your own OpenAI or Anthropic key, or point at a local endpoint (Ollama, LM Studio, vLLM) so nothing leaves your network. +- **AI insights you own.** Daily briefing, health scores, correlations, and a conversational coach grounded in your own measurements, with calm proactive check-ins it suppresses when there's nothing genuine to say. The coach describes your data, never diagnoses. Bring your own OpenAI or Anthropic key, or point at a local endpoint (Ollama, LM Studio, vLLM) so nothing leaves your network. - **Clinician-ready output.** A doctor-report PDF generated client-side, a read-only HL7 FHIR R4 API, and scoped, time-limited share links you revoke after the visit. - **Private by construction.** AES-256-GCM encryption at rest with zero-downtime key rotation, passkey login, server-side sessions, strict CSP — and no third-party tracking anywhere. - **Built to be lived in.** Installable PWA with offline support, medication reminders over APNs, Telegram, ntfy, and Web Push, a sub-second dashboard on years of imported history, English and German end to end. diff --git a/docs/api/mcp-capabilities.md b/docs/api/mcp-capabilities.md index 8c0b6dd8e..644cc8fa9 100644 --- a/docs/api/mcp-capabilities.md +++ b/docs/api/mcp-capabilities.md @@ -28,7 +28,10 @@ them up front): 4. **Data and context only.** The server ships facts; it never returns a diagnosis, clinical verdict, risk score, or treatment change. The assistant narrates the facts and leaves clinical judgement to the - user's clinician. + user's clinician. This mirrors HealthLog's project-wide self-description + standard: the app is a personal health record-keeping and wellness tool, + not a medical device, and nothing it surfaces — here or in the UI — + diagnoses or treats. Discover before fetching: call `list_metrics` (or read the `healthlog://measurements/inventory` resource) first to see what exists, @@ -95,6 +98,19 @@ Every read tool is annotated read-only / non-destructive / idempotent / closed-world — the read-only guarantee is structural (only read tools are registered for a read session), and the annotation merely advertises it. +The v1.25 clinical-signal additions reach the assistant through these same +tools rather than new tool names: respiratory rate, grip strength, the 0–10 +pain score, and waist / body measurements appear via `list_metrics` → +`get_metric_series` / `get_metrics`, and the longevity lab markers via +`get_labs`. A new signal is declared once in the in-app signal registry and +shows up across the metric tools, correlations, and the FHIR map together, +so the MCP surface never advertises a signal the record can't return. The +opt-in mental-wellbeing instruments (PHQ-9, GAD-7), the structured records +(allergies, family history), and the inbound-document store are deliberately +**not** exposed over MCP: the instrument answers are kept out of the +assistant by design, and the document pipeline extracts facts for the user +to confirm in-app rather than streaming them to a model. + ## Resources Read-only context the assistant can attach alongside tool results. Like diff --git a/docs/integrations/ai-providers.md b/docs/integrations/ai-providers.md index 1b1600b7e..2cdb85c7b 100644 --- a/docs/integrations/ai-providers.md +++ b/docs/integrations/ai-providers.md @@ -198,6 +198,30 @@ The Coach drawer surfaces a "Local" badge when generation resolves to the local provider, so users who pinned a local endpoint can see at a glance that their context stayed on the host. +## What the Coach is — and isn't + +The Coach is an informational assistant that works from your own +logged data. It is not a doctor, what it says is not medical advice, +and it does not diagnose, prescribe, or change treatment — those +boundaries are written into its system prompt as safety contracts, not +left to chance. It describes patterns observationally ("your resting +heart rate has been rising over 14 days"), never as a verdict about a +named condition, and it defers diagnosis, dose, and drug-interaction +questions to a healthcare professional. This is HealthLog's +project-wide self-description standard: a personal health +record-keeping and wellness tool, not a medical device. The same +non-diagnostic framing governs the daily briefing, the insights, and +every surface that turns your data into words. + +The Coach can also reach out proactively — a calm, once-a-day morning +check-in when there is something genuine to surface (a recovery trend +easing off, blood pressure running a touch high). The nudge is warm +and localized, references the focus by category rather than quoting +your own words back, and stays silent when there is nothing real to +say or when you have engaged the Coach recently. It is an invitation, +never a streak-guilt prompt, and it inherits the same non-diagnostic +boundaries as the chat. + ## Caching contract Two caches sit in front of every provider call so generation budgets diff --git a/docs/self-hosting/getting-started.md b/docs/self-hosting/getting-started.md index 03135bd6f..6e59c8a7f 100644 --- a/docs/self-hosting/getting-started.md +++ b/docs/self-hosting/getting-started.md @@ -16,6 +16,10 @@ already installed, longer if a TLS-fronted public hostname is in scope hold a 1.5 GB upload in `/tmp` while it parses. - **Outbound HTTPS** to `ghcr.io` (image pulls) plus whichever integration endpoints you plan to enable (Withings, OpenAI, etc.). + The opt-in environmental-context module additionally reaches + `api.open-meteo.com` for weather and daylight; it stays off until you + enable it and set a home location, and every outbound call goes + through the SSRF-guarded egress wrapper. - **Optional but recommended:** a reverse proxy that terminates TLS and forwards to `http://localhost:3000` (Caddy, Traefik, Nginx Proxy Manager, Coolify, or bare Nginx — see `reverse-proxy.md`).