The biomarker-native financial planning platform for the decumulation decades.

Executive summary

Action-title claim · pyramid principle · rule of three.

HIFP wins by owning the biomarker-informed planning decision at the point of trust — the concierge physician + the direct consumer — with an actuarially grounded Planning Agent at the user surface, and a published Advice-Boundary Architecture no competitor can replicate at speed.

Raise. SAFE seed → Series A pivot with organic-to-A as documented fallback. $2M target / $1.5M floor / $15M cap. Founder living-standard floor: $250K/founder/year + health insurance built into SAFE. Series A target Q1–Q2 2027. 16-week compressed MVP (down from 12-month baseline).

Ratification gates before external distribution: Karen general-counsel briefing (Ledger §3.24) · Friday 2026-09-11 GTM tier ratification (§3.42) · Anthropic + OpenAI AUP enterprise-terms confirmation post-NDA (Red Team T3 PASS-preliminary-strong pending final-close).

§1 · Mission — User Primacy

Not a marketing line. The mission-level constraint that governs every product, partnership, and pricing decision.

HIFP exists to make the individual the primary and sole beneficiary of their own financial-planning surface, in perpetuity, across every partnership, integration, and commercial arrangement HIFP enters into.

User Primacy was elevated 2026-09-07 from Ethical Framework §1 Commitment #1 to canonical mission status (Ledger §3.17). It operationalizes as five non-negotiable constraints:

1. User owns their data end-to-end. Per-source consent, per-source revocation, cryptographic evidence of deletion (post-Karen R&D per §3.27). Apple-privacy-policy standard is the design target. Data-scope architecture never produces a carrier-ready export.
2. User's interest is HIFP's only fiduciary duty. No sub-agency to any partner (employer, concierge chain, consumer-wellness partner, insurance carrier). Where HIFP contracts with a buyer other than the user, the contract explicitly names user-primacy as a term.
3. User-visible transparency on what HIFP does and does not do. Advice-Boundary language in every planning output; Planning Agent responses cite data provenance; AI-involvement disclosure per Anthropic AUP requirements.
4. User controls partnership data flow. No standing data-sharing arrangement with any partner. Carrier access is user-controlled per-request. Contractual firewall against underwriting-side data flow in every partner MSA.
5. User can leave with their data at any time. Full-export mechanism; portability guaranteed; no dark-pattern retention.

Why User Primacy is mission-level, not policy-level. The Ethical Framework Boundary-Integrity and Transparency-with-Agency commitments (§8) presuppose User Primacy — without it, they are procedural but not principled. Elevating User Primacy to mission-tier makes it the constraint every future product, partnership, and pricing decision measures against, not a checklist item that gets renegotiated per partnership.

§2 · Governing thought

The one sentence that governs every downstream decision.

Health is the earliest, most decision-relevant signal in a household's financial trajectory; wealth is the mechanism of action. HIFP wins by owning the surface where the signal becomes the action.

Three consequences follow:

1. Biomarker + wearable + medical-record data are the earliest available leading indicators of decumulation-phase financial-decision quality — LTC-purchase timing, retirement-age optimization, safe-withdrawal-rate, coverage-gap identification, housing-timing, long-term-care reserve requirements. Population life-tables + financial-planning software systematically under-serve HNW users approaching decumulation because they cannot ingest and interpret this signal.
2. The user is the actor; HIFP is the surface. Every HIFP output empowers the user to have a better conversation with their physician, their advisor, their household, or their employer — not to bypass those relationships. This is the "empower the individual to have the conversation" framing Fatima + Sindhu + Brandon confirmed 2026-09-07 (Ledger §7.11 ratified implicit as v4 thesis-level update).
3. The moat is neither the model nor the data — it is the architecture that keeps the surface trusted. Any competitor with an LLM API and a Function-shape data feed can ship a v0.1. The compounding moat is Advice-Boundary + Coverage Navigator IP + Ethical Framework + partner-channel credibility — architectural choices that take years to accrete and cannot be transpiled.

§3 · The problem HIFP solves

Concrete decision-quality gaps in the current market.

A 62-year-old HNW couple with $4M investable assets and 8 dated Function panels between them has more financial-decision-quality data than their advisor, their physician, or their employer can currently ingest, interpret, or turn into action.

3.1 · LTC timing decisions are undersold and mistimed

Genworth 2025: assisted living $74K/yr, nursing home $115K–$130K/yr, home care $80K/yr. Fidelity 2026: $185,500/individual + $371,000/couple in retiree healthcare costs (up 7.5% YoY). Boldin, eMoney, RightCapital model these as line items but do NOT ingest the biomarker signals that would tighten the LTC-purchase-timing window from a 15-year band to a 3-year band. A 62-year-old with strong biomarkers + no family dementia history + Oura data showing HRV stability has a materially different LTC-timing decision than the flat-line default assumes.

3.2 · Coverage gaps compound silently across household + employer + carrier combinations

Long-term-care insurance persistency is ~25% at 30-year mark (industry average). Medicare Advantage plans cover Galleri MCED with copay in earliest MA plans (Priority Health, Jan 2026); reimbursement begins 2028 per Nancy Gardner Sewell Medicare MCED Coverage Act (Feb 2026). Employer-provided disability + supplemental health interact with private coverage in ways households do not model. Coverage Navigator surface (§7.15 ratified 2026-09-07) fills this gap without becoming a carrier BD channel.

3.3 · The trust asymmetry is severe and existing tools do not solve it

Concierge medicine serves ~500K–1M US patients through chains (MDVIP ~450K across 1,300–1,400 physicians · One Medical Premium via Amazon · Executive Health Group · PartnerMD ~50K across 12+ markets · independent DPC ~4–6M more). These HNW patients have (a) longitudinal biomarker data already being collected, (b) an existing consent relationship with a physician who sees them 4–8 times a year, and (c) documented willingness to pay $2K–$25K/year in cash for cash-pay medicine. That trust asymmetry does not exist in the RIA / advisor channel — HIFP wins by meeting users where trust already lives.

3.4 · Why now

Convergence of five signals: (a) biomarker labs at $199–$599/yr entry-point (Superpower founding tier $199 through Aug 31 2026 → $349/yr · Function $365/yr · HLI Genomics for All $599); (b) frontier LLMs able to reason about longitudinal multi-source health + financial data; (c) SMART-on-FHIR adoption across concierge chains; (d) Aura/Oura filed S-1 (Sept 2026, $11–16B range) signaling wearable-longevity IPO market; (e) Fidelity + Genworth 2026 cost updates surfacing decumulation-cost inflation to a broader HNW audience.

§4 · The product

Dual-surface consumer platform. AI-native at the user layer, actuarial under the hood. Three flagship product primitives at MVP.

4.1 · Planning Agent

Scoped tool-use LLM agent that computes stratified planning scenarios given household inputs (biomarker + wearable + medical-record + financial-baseline data). Bounded tool calls to the Planning Engine (Monte Carlo scenario runner + LTC-onset model + safe-withdrawal-rate calculator + coverage-gap analyzer). Advice-Boundary Classifier passes or blocks every rendered response. Anthropic Fable 5.1 primary production model (Source Log VERIFIED 2026-09-07); OpenAI GPT-5 fallback; both providers PASS-preliminary-strong on AUP compliance (see §12.3).

4.2 · Plan-Delta monitor

Continuous surveillance of user's biomarker + wearable + record data streams. When a material trajectory shift is detected (HRV decline, Function panel abnormality, cognition-screen inflection), the monitor re-runs the plan and surfaces "three decisions worth revisiting" — never a specific investment or clinical recommendation, always a decision reframe. This is the compound value proposition: annual planning tools miss inflection points; Plan-Delta catches them.

4.3 · Coverage Navigator

User-side advocacy surface (not carrier BD channel). Three functions: (a) portability warnings when user's employer benefits or private coverage transitions, (b) coverage-gap identification across household + employer + Medicare + supplemental, (c) comparative-quote question-asking prompts so users can walk into carrier conversations with informed questions. Explicitly NOT: fiduciary; not investment advice; not carrier data-flow channel. See life-insurance judo memo Option C for architectural rationale.

4.4 · Foundational primitives

• Household plan surface with per-user Plan-Delta + joint scenarios (housing-timing, cognition-decline joint modeling, LTC purchase optimization across two lives)
• Shareable coverage-navigator summary (single-page, no-auth teaser view) — Loop B enabler for T2a practice-referral viral loop
• Practice-side aggregated cohort dashboard + pre-visit brief — physician sees cohort trajectories, NOT individual patient outputs unless user shares
• AI-generated advisor brief — user exports HIFP output to their existing eMoney-using RIA at user discretion
• Household + share-role expansion (3→8 roles per POC Task #18 shipped 2026-09-03)

4.5 · What ships at MVP vs H1 vs Y2+

MVP (16 weeks compressed). Planning Agent + Plan-Delta + Coverage Navigator + Household + shareable summary + Stripe billing (locked 2026-09-07 as Hustle Plan Lane 1 enabler) + T1 employer-tier product + T2a concierge SMART-on-FHIR integration for chain 1.

H1 additions. T3 Employer Standard SKU · T2b partner-integration surface (Function/Neko/Aura co-branded) · b.well individual-access aggregator · full household mode expansion · practice-portal integrations for chains 2–4.

Y2+ Variants (documented, pre-architected, not raise story). Variant A RIA OEM · Variant B reinsurer institutional data-product · Variant D F500 executive-benefit at scale.

§5 · The market

Aggregate TAM at play — T1 hyper-focus + T3 leak-capture combined.

5.1 · Aggregate employer TAM (T1 + T3 combined)

5.2 · Concierge / DPC TAM

Total US concierge / DPC universe ~1,500 practices, ~5–8M patient lives. Serviceable in 3-year window 200–400 practices, ~1.5–3M patients. Landable Y3 base case 30 practices, ~75K patients.

5.3 · Consumer-Wellness Partnership channel reach

Function 350K members + Neko growing + Aura/Oura 5M members + biomarker-labs long tail + wearables. 500K partner-acquired users at base case; 1M+ at premium case. Compounding zero-marginal-CAC after Y1 partnership investment.

5.4 · D2C HNW household universe

~5M US households with $1M–$25M investable assets. HIFP reaches D2C only through T2b partner channels — no standalone D2C GTM motion (see §6.3 rationale).

§6 · Go-to-market — four-lane structure

T1 alone is arithmetically viable but structurally fragile. T2s exist for smoothness and multiple; T3 exists to capture marketing leakage.

6.1 · T1 · Employer (hyper-focus)

Segment. Self-funded employers with F500-shape long-term-equity comp mix (Salesforce-shape). ~500–1,000 US employers.

Value proposition. Talent retention lift on RSU-vesting curve · executive-perk tier for C-suite differentiated recruiting · productivity + healthcare cost impact (financial-stress reduction ~15–25% claim) · differentiated benefit no competitor combines biomarker + financial + household.

Commercial mechanic. Executive-to-executive BD, 12–18-month sales cycle, benefits-consultant channel (Mercer, Willis Towers Watson, Aon) as accelerator. Family-attach as first-class Employer mechanic (ratified 2026-09-07). $4–6 PMPM base / premium.

Y3 target. 30 employers × 20K avg lives × $48 = ~$29M ARR (base). 60% of Y3 ARR mix.

6.2 · T2a · Concierge practices (active direct-license)

Segment. Concierge / DPC / boutique practices — MDVIP, One Medical Premium (via Amazon), Executive Health Group, PartnerMD, independent DPC networks. ~1,500 practices; 200–400 serviceable via clinical-network warm intros.

Value proposition. Patient churn reduction 2–4 percentage points · differentiated service without physician time · "we handle your whole life" brand positioning · rev-share on premium tier.

Commercial mechanic. CMO + VP Membership targeted, 60–90-day sales cycle, Fatima + Sindhu clinical-network warm intros. $120/patient/year base.

Y3 target. 30 practices × 2,500 avg patients × $120 = ~$9M ARR (base). 19% of Y3 mix. Structural role: revenue smoothness between T1 closes + clinical-network credibility moat + adversarial-test-corpus surface.

6.3 · T2b · Partner-channel D2C with viral bump

Segment. HNW consumers reached through Consumer-Wellness Partnership channels — not standalone D2C.

Three-loop stack:

• Loop A · Family-attach (T1 mechanic, in-employer expansion; coefficient 0.6 bounded)
• Loop B · Practice-referral (T2a mechanic; coefficient 0.01–0.03, small but true viral)
• Loop C · Consumer-Wellness Partnership channel — PRIMARY engine

Loop C partner sub-classes (priority-ordered):

Commercial mechanic. Rev-share to partner 10–20% of HIFP subscription revenue for customer lifetime. Effective blended CAC $50–80 (vs D2C's $200+). Freemium → premium $15–25/mo.

Y3 target. 500K partner-acquired users × 6% conversion × $240/yr = ~$7M ARR (base). 14% of Y3 mix but ≥50% of total-user-count metric that drives Series B/C consumer-platform multiples (25–40× ARR vs 10–15× enterprise SaaS).

What T2b is NOT. Not standalone D2C. Not viral fintech-app. Not alternative to T1. Kill criterion: if T2b requires paid CAC, kill the lane.

6.4 · T3 · Employer overflow (leak-capture doctrine)

Segment. Broader employer inbound — fully-insured F500, non-LTE F1000, mid-market self-funded 1K–5K, government self-insurers, union benefit trusts. ~15,000 employers.

Value proposition. 60–70% of T1's feature depth at ~60% of T1's base PMPM (~$30/life/year vs T1's $48). Standardized SKU, no customization. Same clinical + financial bar. Fast onboarding (30-day inside-sales vs T1's 6–9-month integration).

Y3 target. 20 employers × 8K avg lives × $30 = ~$5M ARR (base). 10% of Y3 mix nominal.

Design principle. T3 is a doctrine, not a lane. Formalizing it removes decision cost, prevents attention drift, captures 5–10% of ARR upside for essentially zero incremental effort.

6.5 · Consolidated Y3 mix — three consistently-computed cases

Series B / C valuation implications (25–40× ARR consumer-platform multiple):

• Downside: $40M ARR × 25× = ~$1B Series B pre-money
• Base: $57M ARR × 25–30× = $1.4B–$1.7B Series B / early Series C
• Premium: $142M ARR × 25–40× = $3.5B–$5.7B Series C valuation range

Top-5 concentration at base: ~25% (vs T1-only's ~55%). Total user count at base: ~1M+.

§7 · The moat

Four compounding moats, none transpilable at speed.

1. Advice-Boundary Architecture. Model-output classifier + Boundary-Integrity mechanic + Ethical Framework enforcement. Publishing the whitepaper is category-defining. Any competitor with an LLM API can ship v0.1 of "biomarker planning" — they cannot ship the boundary architecture without independently reasoning through the classifier design, adversarial test corpus, and physician-in-the-loop mechanic. Estimated replication time: 12–18 months.
2. Coverage Navigator IP. Data-scope architecture + contractual firewall + partner-category-reshape from insurance-partner to Coverage-Navigator is a category-defining posture that most competitors will fumble because the tempting insurance-BD lane is too economically obvious. HIFP's structural refusal to route data toward carrier underwriting decisions is the moat. Provisional filings queued ($15–25K budget, 4 provisionals).
3. Consumer-Wellness Partnership rev-share channel compounding. Once Function ships the integration, they promote HIFP in perpetuity at ~zero marginal cost. Y1 partnership work produces Y2–Y5 near-free acquisition. Business Plan models T2b CAC as declining over time — unlike enterprise sales CAC.
4. Clinician-network credibility from T2a. Landing 20+ concierge practices in Y1 gives HIFP a clinician-adjudicated credibility story no benefit-consultant-led competitor (Alight, Fidelity Health) can match. The adversarial-test-corpus workflow requires this direct clinical relationship anyway; T2a monetizes it.

7.5 · Publication sequencing (IP note)

Advice-Boundary Whitepaper v1 is IP-gated by publication-sequencing constraint. Do NOT publish before provisional filings land. Sequence: v4 kit → NDA-covered market-signal lunches → IP counsel provisional filings → external whitepaper publication → investor conversations. Per Ledger §3.23 (IP strategy adopted by non-dissent 2026-09-07).

§8 · Ethical framework — three commitments

Skeleton adopted 2026-09-07 (Ledger §3.17). Full v0.1 owed by Sindhu within 14 days.

1. User Primacy — elevated to mission-level statement (§1 above)
2. Boundary Integrity — Advice-Boundary Classifier + question-asking-quality standard (Ledger §3.32 Fatima "best financial planners" principle) + physician-in-the-loop at T2a + fiduciary-in-the-loop at Y2 RIA embed
3. Transparency with Agency — Apple-privacy-policy-standard consent + per-source revocation + AI-involvement disclosure + delete-forever design (post-Karen R&D) + user data portability

§9 · Regulatory posture — three-tier frame

Adopted 2026-09-07 as v4 principle (Ledger §3.28). Federal · state · zip layers simultaneously — a design-tier constraint alongside product architecture.

9.1 · Federal tier

HIPAA (BAA rule 45 CFR §164.502(e) VERIFIED) · HIPAA right of access 45 CFR §164.524 · GINA (health insurance + employment only; DOES NOT cover life/DI/LTC per Florida HB 1189 legislative history) · CPRA/CCPA (state but broad) · GDPR/UK-GDPR (non-blocking; US-only at MVP).

9.2 · State tier

WA MHMDA (RCW 19.373, effective March 31 2024, private right of action via WA Consumer Protection Act — VERIFIED) · IL GIPA (410 ILCS 513, statutory damages $2,500 negligent / $15,000 intentional per violation — VERIFIED) · Florida HB 1189 (life/DI/LTC genetic-info restriction, effective Jan 1 2021 — VERIFIED, first state to extend GINA-style protection to those lines) · NAIC AI Model Bulletin (25 states adopted as of July 2026, 8 in progress — VERIFIED) · CA/CO/NY/TX operating under their own AI-in-insurance frameworks.

9.3 · Zip tier

Climate + insurability + local-market conditions that materially affect household-level planning (California wildfire zones, Florida hurricane / flood, Louisiana / North Carolina insurance-market compression). Zip-level intelligence surfaces in Coverage Navigator; not primary but non-optional for Y2 GTM expansion.

§10 · The team

Founder trio + planned advisor board + founding-eng recruiting motion pre-SAFE.

10.1 · Brandon Stauber — CPO/CTO through Series A

Currently. Director, Partner Innovation Engineering at Salesforce (April 2021–present) · Salesforce Agentforce Partner Innovation Lab lead. Dual Salesforce Certified Architect (System + Application) + Salesforce AI Associate. 2× founder-operator with exits (iNetEvents 1999→2004 · The Wine Spies 2007→2012). Regulated-industry technical architect with prior Health Cloud + EHR/EMR integration precedent.

Closes: (1) product ownership from POC through Series A; (2) regulated-consumer-AI ship credibility (retires the "can the team ship a regulated AI product?" DD question); (3) chain-side technical integration (SMART-on-FHIR expertise + Salesforce partner-ecosystem BD network); (4) prior-startup operating history.

10.2 · Sindhu Pandit MD MBA — CCO of HIFP

CCO adopted by non-dissent 2026-09-07, modifiable if Sindhu decides differently. COFO surfaced as alt-framing.

Currently. VP, Clinical Product Strategy at Hyro (conversational AI in healthcare) — title precision confirmed 2026-09-08. Formerly Clinical Leader at Salesforce Global Health & Life Sciences.

Closes: (1) clinical concept validity — conceived the biomarker-informed planning thesis end-to-end; (2) physician-community access — Hyro + prior Salesforce H&LS clinical relationships + boutique-practice pipeline; (3) concept-to-clinical-validation execution — active author on stratified back-tests + adversarial-test-set clinical adjudication; (4) Ethical Framework v0.1 authorship.

10.3 · Fatima Paruk MD — prospective CEO

Currently. Senior health-leadership at Oracle (LinkedIn stale). Formerly SVP & CHO Salesforce Global H&LS · McKinsey Clinical CoE lead · Microsoft H&LS CMIO · Allscripts CMO.

Closes: (1) health-strategic distribution — network reaches MDVIP + One Medical Health + Executive Health Group + PartnerMD at buyer level; (2) CEO gravitas + investor room (health/longevity-strategic warm-lane); (3) F500 CHRO + regulatory-counsel relationships (unblocks Variant D + Karen briefing).

10.4 · Advisor board (in formation)

Brainstorm candidates surfaced 2026-09-07 (Ledger §3.29): Michelle Feinstein (Fatima intro) · Dan Conners (NVIDIA partnerships, Fatima intro) · David / David Ventures (Sindhu intro). Karen (Sindhu's ex-Salesforce GC, retired) engaged as general counsel briefer (§3.24) — not advisor slot per se, but load-bearing pre-external gate. Kristen Valdes (Founder & CEO of b.well Connected Health) as consent-model expert consultation + potential b.well partnership discussion (§3.25) post-Karen — attribution corrected 2026-09-08 (earlier drafts erroneously said "now at Datavant" per whisper mistranscription; Kristen is still at b.well; see §3.46 for a separate unnamed Datavant reference Sindhu mentioned in same passage, and §3.47 for Datavant as exploratory consent-architecture reference).

Committed advisor slots (planned): Medical Lead (0.5% equity) at Series A close; ASA-LTC actuary hire is Series A hire, not advisor.

10.5 · Founding engineering (recruiting motion begins pre-SAFE)

Per Ledger §6.1 reclassification. No named candidates yet (Michelle Feinstein + Dan Conners went to advisor-board brainstorm). Recruiting motion starts pre-SAFE close so early hires can start day-1 post-close. Target profile: full-stack + SMART-on-FHIR familiarity + LLM tool-use experience + regulated-industry background helpful.

§11 · Funding + timeline

SAFE seed → Series A pivot with organic fallback. Living-standard floor built into SAFE. 16-week compressed MVP.

11.1 · The raise

• SAFE seed: $2M target / $1.5M floor / $15M cap post-money
• Series A target: Q1–Q2 2027, $7–9M raise, led by health/longevity-strategic lane (a16z Bio + Health, ARCH Venture, GV, Lux Capital) with AI-forward generalist warm-lane parallel (Sequoia AI-application, Radical, Bond, Lightspeed AI)
• Founder living-standard floor built into SAFE: $250K/founder/year + health insurance (Ledger §7.13 sub-part c, ratified 2026-09-07)
• Advisor-only fallback: any founder unable to go full-time at SAFE close stays as advisor
• Monthly founder-life-and-commitment check-in as standing meeting

11.2 · Founder full-time transition timing (informational)

• Brandon: full-time within 4 weeks of SAFE close
• Fatima: transitions when SAFE-covered seat funded — pulls forward from 2027-07-01
• Sindhu: April 30 2027 cliff + annually thereafter (Hyro-side)

11.3 · 16-week compressed MVP

Down from 12-month baseline. Weeks 1–4: T1 employer-tier product · Planning Agent v1 · Advice-Boundary Classifier · Stripe billing. Weeks 5–8: Plan-Delta monitor · Household surface · Shareable summary primitive. Weeks 9–12: T2a concierge chain 1 SMART-on-FHIR · practice cohort dashboard · pre-visit brief. Weeks 13–16: Adversarial test set live · counsel + ethical-framework review pass · launch-ready.

§12 · Priced risks + mitigations

Eight priced risks. Three extinction-class fully resolved; one existential (T20 reverse-judo underwriting) resolved via A+B+C.

12.1 · Reverse-judo underwriting risk (T20) RESOLVED 2026-09-07

Threat. Carriers using HIFP-shape aggregated health + financial data during underwriting to price up, exclude conditions, or deny coverage.

Mitigation (ratified 2026-09-07 · life-insurance judo memo v0.1):

• A. Data-scope architecture — HIFP never produces carrier-ready export
• B. Contractual firewall — carrier access user-controlled per-request; underwriting-side data flow prohibited in every partner MSA
• C. Category reshape — retired "insurance partner"; replaced by "Coverage Navigator / Benefits Navigator" (user-side advocacy, not carrier BD)
• D. Policy engagement — deferred to H1

Standing constraint. Insurance-data-outbound veto. Underwriting-partner path rejected outright. Category-defining refusal, not a negotiation point.

12.2 · Regulatory exposure Karen-gated

See §9. Karen general-counsel briefing gates final PASS on regulatory-language sections.

12.3 · Frontier-LLM AUP exposure (T3)

Split evidentiary standards — do not label as equivalent:

• Anthropic AUP VERIFIED (direct) — WebFetch of anthropic.com/legal/aup succeeded 2026-09-08. Finance + Healthcare are named "High-Risk Use Cases" requiring HITL + AI-involvement disclosure. HIFP satisfies both natively via Advice-Boundary Classifier (decision-surfacing frame, not tailored-advice) + Boundary-Integrity mechanic (physician-in-the-loop at T2a, fiduciary-in-the-loop at Y2 RIA embed) + explicit AI branding. Wellness advice (sleep/stress/nutrition/exercise) explicitly excluded from healthcare high-risk — HIFP has product-design latitude here. Status: PASS-preliminary-strong.
• OpenAI AUP VERIFIED-VIA-SECONDARY — direct fetch 403 to unauthenticated; analysis via Baker Donelson + strac.io + intuitionlabs.ai + governancedocs.com. Substantively similar tailored-advice restriction indicated but not confirmed verbatim from source. Status: PASS-preliminary-secondary. Direct enterprise-sales verification owed post-Karen NDA to close to PASS-final.

Combined status: Primary production model (Anthropic Fable 5.1) is stronger-verified; fallback (OpenAI GPT-5) is weaker-verified but AUP-adjacent-consistent per secondary sources. Do not conflate the two evidentiary standards in Q&A or external materials.

Final-close gates: Karen briefing pressure-test + Anthropic + OpenAI enterprise-terms via direct sales post-NDA (not blocking; Series-A-close item).

12.4 · Concentration + sales-cycle lumpiness — mitigated by T2a + T2b + T3 diversification

Per §6. T1-only concentration risk resolved by 60/19/14/10 mix.

12.5 · Founder-contingency risks — documented

Per Founder Contingency Analysis v0.1. 2-of-3 scenarios modeled with new-CEO network-recovery lever.

12.6 · IP risk — publication sequencing

Advice-Boundary Whitepaper publish-before-provisional risk mitigated by IP counsel RFP + provisional filings BEFORE any external publication. §3.23 adopted 2026-09-07.

12.7 · Wearable-longevity IPO ecosystem competitive risk NEW · added 2026-09-08

Threat. Aura/Oura filed S-1 Sept 2026 at $11–16B range with 5M members and $1.4B TTM revenue. Post-IPO capitalization enables three competitive moves that put HIFP at risk in the biomarker + planning intersection: (a) move up-stack into biomarker-plus-financial-planning intersection directly; (b) acquire a biomarker lab (Function at $2.5B or Neko at $700M+ Series C) for full-stack coverage; (c) partner with a fintech (Wealthfront, Personal Capital / Empower, Robinhood) to launch a competing offering under a trusted-consumer-brand.

The §3.4 "why now" convergence signal that Aura's IPO represents cuts both ways — it validates the market and creates the most credible potential competitor simultaneously. Executive Summary's "no incumbent worth naming" claim survives today but has a plausible 12–24-month expiration window if Aura moves aggressively post-IPO.

Mitigations (three layers):

1. Architectural — not replicable by acquisition. HIFP's user-primacy + clinician-mediated architecture is structural. A wearable company acquiring a biomarker lab and bolting on a fintech creates a data-aggregation product; it does not create a Coverage Navigator + Advice-Boundary + physician-in-the-loop system. Replication requires 12–18 months of independent architectural work (see §7 moat argument).
2. Positioning — reframe Aura as channel, not competitor. T2b Loop C explicitly positions Aura/Oura as a P1 channel partner (not competitor). If Aura signs the partnership before considering up-stack expansion, the competitive move is much harder to make later. This makes the P1 wearable partnership strategically load-bearing, not just tactically opportunistic — worth accelerating.
3. Optionality — if Aura moves up-stack anyway, HIFP shifts positioning to Aura-as-data-source. HIFP does not need to defeat Aura; HIFP needs to be the credible planning-decision layer that Aura customers use. Loss condition is Aura owning the intersection outright; win condition is Aura's members flowing to HIFP through partnership or direct signup.

Watch triggers: (a) Aura acquires or partners with Function/Neko/HLI; (b) Aura hires C-level fintech / financial-planning leadership; (c) Aura's post-IPO roadmap includes any "financial planning" or "life planning" language.

12.8 · Sindhu IP-assignment / moonlighting exposure NEW · added 2026-09-08

Threat. Sindhu Pandit is HIFP's concept originator (§10.2) — currently VP, Clinical Product Strategy at Hyro (conversational AI in healthcare). Hyro's technology domain (conversational AI in healthcare) is adjacent to HIFP's biomarker-informed planning surface — same broad category, arguably overlapping. Sindhu's transition to full-time HIFP is April 30 2027 cliff + annually thereafter (Ledger §7.13 sub-part d), which is after the targeted Series A close (Q1–Q2 2027).

This creates two coupled institutional-investor diligence flags for a16z Bio + Health, ARCH, GV, Lux (all named as targets):

• Invention-assignment risk. Standard employment agreements at healthcare-AI companies (Hyro shape) include invention-assignment clauses that can attach IP claim to the employer for adjacent-industry inventions conceived during employment. If HIFP's biomarker-informed planning thesis "conceived end-to-end" by Sindhu occurred during her Hyro tenure, Hyro could claim partial or full IP ownership under standard assignment scope.
• Founder-timing dependency. Concept-originator founder not full-time until after institutional lead investor commits capital is a standard concentration risk. Investors underwrite the founder-team as-of-close; a critical founder not yet operationally committed weakens diligence position.

Mitigations (four-part):

1. Karen briefing input. Ledger §3.24 Karen general-counsel briefing must include Hyro employment-agreement review — specific scope of invention-assignment clause + whether adjacent-industry carve-outs exist. Karen's plaintiff-attorney adversarial lens is exactly the right pressure-test here.
2. IP counsel inventorship-timeline opinion letter. IP counsel (§3.23 RFP owed) provides opinion letter documenting Sindhu's contribution timeline — pre-Hyro-employment ideation (if any) vs post-Hyro contributions vs contributions timed to non-employment hours. This becomes standard due-diligence artifact.
3. Provisional filings identify inventorship chain. Provisional filings (§7.5 IP strategy) must document inventor list + assignment chain explicitly, cleanly, and before any external publication.
4. Transition-earlier optionality. If institutional investors flag the founder-timing concentration risk during Series A pitch, Sindhu's Hyro transition can be pulled forward. Advisor-only fallback is a weaker lever than transition-earlier in this scenario — trio should discuss whether it's on the table.

Distinct from §12.5 founder-contingency. §12.5 covers 2-of-3 scenarios (founder can't participate); §12.8 covers "founder participates but with IP/timing exposure." Both required in investor DD story.

§13 · What HIFP will not do

Anti-value is as important as value. Structural refusals, not negotiation positions.

1. HIFP is not a fiduciary. No investment advice, no asset management, no discretionary trading, no client-money custody, no RIA registration required or sought.
2. HIFP does not sell insurance. No carrier BD channel. No commissions. Coverage Navigator is user-side advocacy only.
3. HIFP does not clinically intervene. No clinical decision support in physician EMR. No prescription. No diagnosis. Biomarker interpretation is scoped to planning trajectory, not treatment recommendation.
4. HIFP does not share user data with employers at individual granularity. Data-scope architecture prevents this by design.
5. HIFP does not route data toward carrier underwriting. Insurance-data-outbound veto is standing (§12.1).
6. HIFP does not become white-labeled at T2a. Practice offers HIFP branded as HIFP (this is the credibility mechanic).
7. HIFP does not run paid D2C acquisition. Partner-channel D2C only; if T2b requires paid CAC, kill the lane (§6.3 kill criterion).
8. HIFP does not pursue T3 outbound. T3 is inbound-only leak-capture; if it consumes >5% of team time, retreat (§6.4 rule D).

§14 · Roadmap / variants (Y2–Y3 optionality)

Documented, pre-architected, not raise story.

• Variant A · RIA OEM (Y2). RIA embeds HIFP output into eMoney via consumption-only API on behalf of a specific client. Advisor pays per-patient license; sees no model.
• Variant B · Reinsurer institutional data-product (Y3). Reinsurer licenses the calibrated LTC-onset model (not individual data) for underwriting; separate contracting entity, separable asset. This is NOT a carrier data-flow route — the model itself is the product, not user data.
• Variant D · F500 executive-benefit at scale (Y2). Fortune 500 CHRO enrolls 200 named executives as executive-benefit. Executives onboard through employer-branded HIFP landing page.
• Contingency Variant C · B2B-only pivot (fallback). Documented in Founder Contingency Analysis v0.1.
• Brand-name decision — deferred to SAFE-close prep with "unless elevated" escape hatch (Ledger §7.1). Options: Longview, Thrive Forward, Ayupaya, or new.
• HALO tuck-in optionality — Lumiant/HALO at 7 employees mid-2026; $5–15M cash + stock likely acquires post-Series-A. Watch, do not initiate.

Appendix A · Chiron/MasterCard analog

Industry cautionary reference. Surfaced 2026-09-07 as v4 POV appendix inclusion.

Chiron/MasterCard partnership (2018–19) attempted to combine payment-transaction data with health-benefit-utilization signals to create integrated wellness + financial-decision surface. Failed on trust asymmetry: MasterCard's brand carried financial-transaction custodial trust but not health-trust; Chiron carried health-brand but not financial-transaction depth; combined offering was rejected by consumers as surveillance-shaped rather than advocacy-shaped.

Applicable lesson for HIFP. The trust asymmetry problem is real and directional: health-brand credibility CAN extend into financial planning if the surface is user-primacy-first (Ethical Framework §1) and clinician-mediated (T2a channel); financial-brand credibility struggles to extend into health because financial custody carries surveillance connotation. HIFP's health-first + user-primacy design starts on the correct side of the asymmetry. Do NOT enter carrier-BD or payment-processor-BD channels that would re-create the Chiron/MasterCard pattern.

Appendix B · Ethical Framework v0.1 skeleton

Adopted 2026-09-07. Three commitments, no fourth added per trio decision.

1. User Primacy (elevated to mission-level statement §1 above)
2. Boundary Integrity — every HIFP output respects the Advice-Boundary Classifier; question-asking-quality standard per top-quartile-financial-planner benchmark; physician + fiduciary in the loop where advice-shaped output would occur
3. Transparency with Agency — Apple-privacy-policy-standard consent + per-source revocation + AI-involvement disclosure + delete-forever design + user data portability

Gap audit summary

For v4 kit planning. What gates on what · what's owed · what landed cleanly.

5 [GATE] items — gate on external event before section can finalize

1. §6 GTM full section — Friday 2026-09-11 trio ratification of Ledger §3.42
2. §6.2 T2a — same Friday gate (partial re-open of Monday's Consumer-Wellness Partnerships reshape)
3. §9 Regulatory posture — Karen general-counsel briefing (Ledger §3.24)
4. §12.2 Regulatory exposure — same Karen gate
5. §12.3 AUP T3 — Karen briefing final-close (currently PASS-preliminary-strong)

11 [GAP] items — owed input or downstream artifact

Blocking or highest-leverage:

1. §10.3 · Fatima's exact Oracle title + preferred bio phrasing (blocked-on-direct-call, blocks team section polish across all v4 artifacts)
2. §1 + §8 · Full Ethical Framework v0.1 (Sindhu owns, 14-day target from 09-07)
3. §4.4 + §4.5 · Product Design v4 three primitive specs (shareable summary + T2b partner-integration surface + T3 Standard SKU)

Downstream but shape-affecting:

4. §6.5 · Business Plan v4 lane sensitivity + CAC-declining model + Y4–Y5 projection
5. §12.6 · Q&A v4 preemptives (T20 A+B+C narrative + T3 PASS-preliminary-strong + "why not T1-only" + "isn't D2C fintech hard")
6. §5.4 · Named investor targets by lane
7. §7.5 · IP counsel RFP + provisional filing schedule

Lower priority / discovery mode:

8. §8 · "Best financial planners" question-quality operationalization (advisor panel vs written corpus)
9. §11.3 · Founding-eng recruiting + hiring plan detail
10. Employer variant exploration under self-funded primary (Ledger §3.34)
11. Practice-portal integration count clarity (SMART-on-FHIR variance per PartnerMD)

Downstream v4-kit artifact spec (what this POV enables)

Content that landed cleanly (no [GAP] or [GATE])

§1 Mission (User Primacy) · §2 Governing thought · §3 Problem statement · §4.1–4.3 Product primitives · §5.1–5.3 Market sizing · §6.1 T1 detail · §6.3 T2b detail (three loops + six sub-classes) · §6.4 T3 leak-capture doctrine · §7 Four moats · §9 Three-tier regulatory frame (pre-Karen) · §10.1 Brandon bio · §10.2 Sindhu bio · §11 Funding structure + timeline · §12.1 T20 reverse-judo resolution · §13 Anti-value · §14 Y2–Y3 variants · Appendix A Chiron/MasterCard · Appendix B Ethical Framework skeleton.