§0 · The promise
Six numbers that define the whole system
Tracking lip healing means asking a patient to photograph her face, repeatedly. Six promises make that safe by construction rather than by policy — each hangs on the phone below; click any tag for its basis.
§1 · One photo's journey
From the bathroom mirror to your desk in seven steps
Follow a single lip photo. The boundary between step 3 and step 4 is the one that matters: everything before it happens on the patient's own device, and nothing crosses it until the receiving room has proven itself. What arrives at step 6 is not a face — it is a score: colour retention, dryness, flaking, swelling, plus a flag when healing strays from the expected arc.
§2 · What healing looks like
The lip arc: six weeks of colour, on one curve
Lip pigment dives after the first week — the "ghost phase" — then blooms back by day 30. The model scores every photo against this expected shape, so the dive reads as on schedule, and only true deviations surface to you. Typical windows; every patient varies.
Why the arc matters at the chair. Most "the colour is gone!" messages arrive during days 7–21 — exactly when the curve says colour should look gone. When the system knows the arc, that message becomes a scheduled reassurance instead of an urgent callback. (Clinical-norm approximation, not medical advice — source K14.)
§3 · Under the hood
What the machine is actually made of
Six layers, one job each. Three of them carry the privacy weight: masking runs entirely on the phone, the sealed room is a cloud computer whose memory is encrypted against the cloud operator itself, and the proof system is two independent signatures any third party can check. Patients never have to trust a logo — they can verify a receipt.
§4 · The guarantees, tested
Where each promise actually lives — and who can honestly make it
Green means the guarantee holds by construction; hatched means it holds only with the right contracts; red means that option simply cannot make the promise. The convenient managed AI services — the ones a vendor demo reaches for first — fail the sealed-room and residency columns, which is why the image lane is self-hosted. The paperwork row (Amendment 13, the healthcare agreement) is a contract matter: technology makes the guarantees possible; agreements make them binding.
§5 · How it gets better
Your corrections teach the model — and the curve says you only label a quarter
When a score is wrong, you correct it; the corrections fine-tune the model, and each version is hashed so the ledger can name exactly what scored each photo. On the measured benchmark, labeling 12.5% of photos reached IoU 0.80 and 25% reached 0.83 — within reach of labeling everything. Budget your clinicians for roughly a quarter of the corpus, chosen by the system, not the whole pile.
§6 · What it costs
Why the pilot is cheap and the 100× jump needs no redesign
The sealed room bills by the second and sleeps between batches, so the whole confidential lane is about $165 a month at pilot scale and $7.3 per thousand photos at half a million a month. The lever is throughput — how fast one machine chews through photos — an engineering tuning target, not an architecture change.