# Ari, Citizen Health and the RARE-X partnership

**AI-assisted draft · Reviewed September 17, 2026 · Publication authorized September 17, 2026**

## 1. Executive summary

Who does this AI serve? Ari is patient-facing assistance embedded in a commercial health-data and research platform. Its potential to reduce care-navigation work is meaningful. Its data-rights terms require closer attention than the broad promise of patient control suggests.

**Agency posture: Mixed.** This is a qualitative finding, not a clinical quality rating. No numerical axis position is assigned while deployment-specific consent and action controls remain unresolved.

## 2. CAIHL question

| Dimension | Draft classification |
| --- | --- |
| Tool / vendor | Ari / Citizen Health, Inc. |
| Category | Patient care navigation and health copilot AI |
| Primary user | Patients, families and authorized caregivers managing rare disease |
| Classification | Patient-directed assistance within a hybrid patient-service and research business |
| Hosting and control | Vendor-hosted. Choosing tasks does not give families control of the platform. |
| Stakeholder interests | Family care needs, Citizen Health's commercial interests, advocacy organizations and research partners |
| Visibility | AI involvement is explicit in the product description. |

Global Genes says RARE-X remains independent under its governance, with Citizen Health providing technology. Ari is an additional patient-facing service. These are related services, not interchangeable data-governance arrangements. [Partnership announcement, September 8, 2026](https://globalgenes.org/press/global-genes-partners-with-citizen-health-to-power-rare-x/)

## 3. What the service does

The [submitted product page](https://www.citizen.health/rarex) describes gathering records, tracking symptoms, preparing messages and insurance appeals, and helping with scheduling and follow-up. It says existing RARE-X consent continues, research stays under Global Genes, and surveys will arrive through Ari while other Ari functions remain optional. Families start without charge, with optional premium upgrades. Organizations pay nothing under the described partner terms. These are product claims, not observed outcomes.

## 4. Patient-impact pathway

Ari clearly passes the three HugoScore scope gates: AI-generated interpretation and task assistance, health and coverage relevance, and a direct route to what families understand and do. Better record access and appeal preparation could help patients challenge decisions. Errors, unclear permissions or inaccessible correction mechanisms could affect those same actions. Neither benefit nor harm was measured in this review.

## 5. Evidence table: data rights and control

| Finding | Evidence and limits |
| --- | --- |
| Ownership is divided by data type. | The August 26 [Terms, §§1–2](https://www.citizen.health/terms) preserve user ownership of Medical Records but state: “Citizen Health owns your Self Reported Information.” That category includes symptoms, surveys, calendar information, nonmedical meeting transcripts and AI Advocate interaction data. |
| Derived information has separate rights. | The same Terms claim company rights in refined information and aggregate insights, license their use back for personal health purposes, and obtain a transferable, sublicensable service-use license over medical and self-reported records. These are contractual claims, not a finding about legal enforceability. |
| Research sharing is optional, but can be commercial. | The [Privacy Policy, enrolled-user section](https://www.citizen.health/privacy) says research consent is unnecessary for platform use, allows licensing of consented de-identified research data, and describes sharing value with participants and recruiting advocacy groups. Choosing research does not mean choosing every downstream study. |
| Exit does not undo past research sharing. | The Privacy Policy offers download and account deletion, ordinarily within 30 days. Research withdrawal applies prospectively. Previously distributed data cannot be recalled, and underlying source records may be retained to support prior research. It states a one-business-day research-withdrawal processing period. |
| A separate consent states a different timeline. | The [public Databank consent](https://www.citizen.health/patient-consents) allows up to 30 days for withdrawal. Broad consent covers future research without advance notice of individual projects. It also describes project-specific opportunities for people declining broad consent. This is Citizen's Databank document, not proof of the consent shown to a particular RARE-X participant. |

The ownership statement needs to be distinguished from practical access rights. The Privacy Policy permits downloading Medical Records and Self Reported Information and updating the latter. Provider-sourced records require correction at their source. Its research provisions coexist with operational-vendor, legal and business-transfer disclosures. [Privacy Policy](https://www.citizen.health/privacy)

**RARE-X-specific limit:** The published partnership materials do not establish which agreement controls linked legacy survey data. Do not infer that Citizen owns every existing RARE-X response simply because its general terms claim ownership of self-reported information. The actual migration agreements and participant consent screens were not reviewed.

## 6. Mixed HugoScore profile

| Measure | Assessment |
| --- | --- |
| Patient authority | **Partial.** Families set care-navigation goals, but the allocation of rights in their own contributions complicates authorship and control. |
| Choice and refusal | **Partial.** Consent mechanisms exist. Their deployment-specific operation needs verification. |
| Critical capacity | **Potentially.** Record interpretation and appeal assistance could support questioning institutions. Reliable citations, uncertainty communication and correction of AI outputs were not tested. |
| Informed control | **Partial.** Relevant documents are public, but ownership categories and consent timelines need reconciliation. |
| Action support | **Potentially.** The described workflows connect information to practical advocacy. Completion and accuracy are unverified. |
| Clinical boundaries | **Partial.** The [Ari partner FAQ](https://www.citizen.health/join/tbrs) excludes diagnosis and prescribing and directs medical decisions to clinicians. Its confirmation promise needs qualification below. |
| Evaluation ownership | **Not established for Ari outcomes.** Community partnership does not demonstrate that patients control evaluation criteria or hold veto authority over deployment. |

The partner FAQ promises approval before every outward action. The Terms' alpha addendum instead describes confirmation behavior as being trained and encourages users to request it. Applicability to the current RARE-X release needs clarification. No unauthorized action was observed. [Partner FAQ](https://www.citizen.health/join/tbrs), [Ari alpha terms](https://www.citizen.health/terms)

The partner page also promises that medical information is not shared with third-party AI companies or used to train their algorithms. That wording does not settle Citizen's own training practices. [Partner page, footnote](https://www.citizen.health/join/tbrs)

**Equity burden:** The partner FAQ limits record collection to the US. Digital access, caregiver capacity, accessibility and premium-tier boundaries could affect practical benefit. Disability access and multilingual performance were not tested. [Partner FAQ](https://www.citizen.health/join/tbrs)

## 7. Key unknowns

1. Which agreement governs existing RARE-X surveys, new Ari entries and combined research datasets? Does any ownership clause change at migration?
2. Which withdrawal timeline applies to each consent, and how do families identify it?
3. Can patients inspect and correct an AI interpretation and prevent an incorrect entry from influencing later actions?
4. Are approval gates enforced for each external action in the release RARE-X families actually use?
5. What are the internal training rules, processor arrangements, export formats, retained-record periods and premium limits?

These are research questions, not messages sent to the vendor.

## 8. Patient agency interpretation

**Editorial judgment:** Ari could strengthen a family's ability to navigate care and challenge denials. Patient-directed tasks alone do not establish control over the resulting health narrative. The central agency concern is whether families understand and can contest the rights assigned to their contributions, including what continues after they leave. Optional research is a positive control, but meaningful consent also requires clear scope, duration and consequences.

## 9. Publication status

**In scope. Published as a qualified, unscored AI-assisted draft with Hugo Campos's authorization on September 17, 2026.** Publication approval does not establish comprehensive human verification. The distinction between Ari and RARE-X remains material. No numerical ranking is justified by this review alone.

**Confidence:** Medium for the published-document findings. Low for implementation and outcomes. Unresolved for the governance of migrated or combined RARE-X data.

**Review provenance:** OpenAI Codex / GPT-6, September 17, 2026. Framework: CAIHL-derived HugoScore criteria and current qualitative reassessment method. AI-assisted public-source review. No human verification, account creation, patient-data upload, live Ari testing, security audit, clinical evaluation or legal determination. Product-page evidence includes the rendered RARE-X page. Terms and policy statements are evidence of published commitments, not proof of actual practice.