HugoScore hugoscore.org

Full review

Ari CAIHL draft report

Evidence-linked HugoScore draft report for a health AI tool that affects patients.

Back to profile Markdown source

Agency checklist · October 30, 2026

Leans expands 9 of 12 yes

Document-based draft. Independent confirmation is incomplete. Hugo has not personally verified this service.

Assessed function: Ari, Citizen Health's AI advocate for rare-disease patients and families

A no can mean missing documentation or institution-dependent control; it does not by itself establish harmful behavior. These categories are not clinical safety or product-quality ratings.

  • Public documents do not establish actual product behavior.
  • Stored quotation missing for yes answers: 1, 3, 4, 5, 6, 7, 8, 9, 10. Evidence repair is pending.
  • The independent review screened rules and selected evidence; it did not replicate all twelve answers for this tool.
See all twelve answers and their evidence
QuestionAnswerEvidence / reviewSource and reasoning
1. Told it is AIYesdocumented
Not independently replicated		Quotation not recorded; evidence repair pending. Source

Terms: Ari is an AI-powered healthcare companion and advocate. Quote confirmed live.

2. Operator and model maker namedNonot-documented
Not independently replicated		Quotation not recorded; evidence repair pending. Source

AI providers that generate Ari's replies are not named.

3. Patient chooses to use itYesdocumented
Not independently replicated		Quotation not recorded; evidence repair pending. Source

Patient or caregiver signs up.

4. Patient sets the taskYesdocumented
Not independently replicated		Quotation not recorded; evidence repair pending. Source

Ari acts at the patient's request. RARE-X surveys through Ari noted.

5. Patient can decline or stopYesdocumented
Not independently replicated		Quotation not recorded; evidence repair pending. Source

Patient may stop Ari from taking any category of action. Quote confirmed live.

6. Patient sees the AI outputYesdocumented
Not independently replicated		Quotation not recorded; evidence repair pending. Source

Answers and drafts delivered in the patient's thread.

7. Patient can correct or challengeYesdocumented
Not independently replicated		Quotation not recorded; evidence repair pending. Source

Patient can keep self-reported information, including AI Advocate data, accurate.

8. Patient can get a copyYesdocumented
Not independently replicated		Quotation not recorded; evidence repair pending. Source

Download records and self-reported information at any time.

9. Patient can deleteYesdocumented
Not independently replicated		Quotation not recorded; evidence repair pending. Source

Deletion processed within 30 days of request.

10. Training or sale does not override patient choiceYesdocumented
Not independently replicated		Quotation not recorded; evidence repair pending. Source

Research sharing is the patient's choice; de-identified sale only with consent.

11. Patient can run it or take it elsewhereNonot-documented
Not independently replicated		Download your Medical Records and Self Reported Information at any time or delete them if you want to close your account. Source

Export of records is documented. Ari is a hosted service. No self-hosting, and no way to keep using the same function elsewhere.

12. No advertising or data businessNodocumented
Not independently replicated		We do sell and disclose de-identified patient information exempt from the CCPA to third parties but only with patient/user consent. Source

The same policy says Citizen may receive a licensing fee from the research organization when the patient consents to share de-identified data. It also lists marketing cookies shared with advertising partners on the website. The CCPA section says it does not sell personal information. The rule here counts de-identified sale even with consent.

Initial coding: Claude Sonnet helpers, compiled by Claude Opus 5.5 (Anthropic). Selective review and corrections: GPT-6 Astra (OpenAI). Editor: Hugo Campos. Acceptance of corrections is not product verification.

Checklist rules · Independent review and limitations · Later evidence follow-up

Earlier report

Ari, Citizen Health and the RARE-X partnership

Method v1.3 review, October 30, 2026

Agency finding: Mixed.

Control: No position: model provider not disclosed. Ari sits toward the patient-directed end of the line in its documented design, with the patient's own requests setting its task. The patient or caregiver states what they need, and the Terms tie Ari's actions to the patient's request and let the patient stop any category of action (A4, A8). No mechanism was found that fixes Ari's output type or enforces an operator objective in the conversation. Citizen Health's research-data business and the RARE-X plan to deliver research surveys through Ari are documented interests, not rails found in the assessed function (A10, A14). Two things are open. Whether the patient can question Citizen Health's own agenda through Ari is untested (C3). Whether the patient decides before consequential actions is contradicted across Citizen Health's own documents (C4): the Terms say Ari is still being trained to ask first and urge users to remind it, while the Privacy Policy and FAQ say it always asks (A5, A6, A7). Citizen Health and unnamed AI providers retain control of the model and operating rules (R = N, A2, A16). Because the model developer is not disclosed on Citizen Health's public surfaces, no control position is shown. This finding rests on documents, not on tested operation.

Disclosure (transparency gate): Service operator named: yes, in public documents. Model developer named: not found in public documents. AI names its operator when asked: not tested (documentary review).

Evidence: Documentary review. Public sources only, no hands-on testing by HugoScore.

Review status: Human adjudication: Hugo Campos settled named questions (what was reviewed, the disclosure results, any coder disagreement). Not verification of the service's claims.

Coded by: Claude Opus 5.5 (Anthropic), coder 1, and GPT-6 Astra (OpenAI), coder 2, coded independently. Conflict check open: the model developer is not known.

What it helps a patient do

  • Drafts and files appeals, disputes, forms and messages the patient asks for (Act, documented, not tested). Ari drafts insurance appeal letters, fills and, at the patient's request, submits forms, claims and benefit applications, sends portal messages and makes calls (A8, A4). Comparator: the patient or caregiver doing this paperwork alone or paying a patient advocate; the specific product document is the Terms' description of Ari skills (A8). Patient action enabled: challenging an insurance denial or bill and pursuing benefits. Documented potential, not observed.
  • Answers questions from the patient's own collected records (Understand, documented, not tested). The Terms describe the AI Advocate as letting the patient ask questions and get responses from their Medical Records, and Ari reads and summarizes records (A8, A9). Comparator: reading scattered portal records unaided. Patient ability: understanding what their own records say before a visit or appeal. Documented potential, not observed.

What limits the patient

  • The notice contradicts itself on whether Ari acts only after the patient confirms (Refuse or leave, documented, not tested). The Privacy Policy says 'Ari will always ask for your confirmation before taking any consequential action' (A6) and the FAQ says 'You will confirm every outbound call, every form submission, and every message' (A7). The binding Terms say Citizen Health is 'training Ari to ask you first' and, during the alpha, 'we urge you to remind Ari to let you review a form before it is submitted' (A5). A patient reading the documents at entry cannot tell whether consequential actions (claim filing, messages to providers, form submission) are taken only with their decision. Blocked ability: informed entry and deciding before an action is taken in the patient's name. Documented; whether Ari in fact acts without confirmation is unknown.

Strongest evidence against these findings

Against the constraint: the Terms' alpha language can be read as a candid caveat about an intended design (Ari is trained to ask first, users can tell it to hold any action and can stop any category of action, A4, A5), so a careful reader may understand that confirmation is intended but not guaranteed rather than face a true contradiction. Against the benefit: every benefit claim is the vendor's own description or testimonial, one testimonial is from Citizen Health's product manager, and sample responses are labelled simulated (A25); no independent or observed evidence shows Ari produces usable appeals or accurate record answers. Against the control reading: Citizen Health earns research licensing revenue and plans to route RARE-X research surveys through Ari (A10, A14), and its proactive outreach includes 'research' (A28); if sessions showed Ari steering toward consent or data contribution, P could move away from the patient.

Open questions

  • Model developer(s) and inference host for Ari replies (decides T2 and the conflict check)
  • Whether Ari in practice confirms before every consequential action (C4)
  • Whether Ari will discuss Citizen Health's data business, research consent or alternatives inconvenient to it when asked (C3)
  • Whether medical record content is sent to the unnamed AI providers (A2 vs A3)
  • Whether RARE-X research participation will require receiving surveys through Ari once deployed, and what that channel does (A10 vs A11)
  • Output contestation route for Ari answers and actions
  • Account-only in-product notices (not read; out of scope for T1 and T2)
  • Global Genes press page (inaccessible, A12)

What changed from the earlier review

Same posture for a different deciding constraint: v1.3's F11 notice-contradiction rule makes the Terms-versus-Privacy-Policy conflict on confirmation a supported constraint, while the data-rights clause stays a candidate. The new transparency gate adds a 'model provider not disclosed' flag because the Privacy Policy names no AI provider.

Sources

Earlier review, September 17, 2026

The review below was prepared on September 17, 2026 with OpenAI Codex / GPT-6, before method v1.3. It is kept unchanged as history. Where it differs from the v1.3 review above, the v1.3 review is current.

AI-assisted draft · Reviewed September 17, 2026 · Publication authorized September 17, 2026

1. Executive summary

Who does this AI serve? Ari is patient-facing assistance embedded in a commercial health-data and research platform. Its potential to reduce care-navigation work is meaningful. Its data-rights terms require closer attention than the broad promise of patient control suggests.

Agency posture: Mixed. This is a qualitative finding, not a clinical quality rating. No numerical axis position is assigned while deployment-specific consent and action controls remain unresolved.

2. CAIHL question

| Dimension | Draft classification |
| --- | --- |
| Tool / vendor | Ari / Citizen Health, Inc. |
| Category | Patient care navigation and health copilot AI |
| Primary user | Patients, families and authorized caregivers managing rare disease |
| Classification | Patient-directed assistance within a hybrid patient-service and research business |
| Hosting and control | Vendor-hosted. Choosing tasks does not give families control of the platform. |
| Stakeholder interests | Family care needs, Citizen Health's commercial interests, advocacy organizations and research partners |
| Visibility | AI involvement is explicit in the product description. |

Global Genes says RARE-X remains independent under its governance, with Citizen Health providing technology. Ari is an additional patient-facing service. These are related services, not interchangeable data-governance arrangements. Partnership announcement, September 8, 2026

3. What the service does

The submitted product page describes gathering records, tracking symptoms, preparing messages and insurance appeals, and helping with scheduling and follow-up. It says existing RARE-X consent continues, research stays under Global Genes, and surveys will arrive through Ari while other Ari functions remain optional. Families start without charge, with optional premium upgrades. Organizations pay nothing under the described partner terms. These are product claims, not observed outcomes.

4. Patient-impact pathway

Ari clearly passes the three HugoScore scope gates: AI-generated interpretation and task assistance, health and coverage relevance, and a direct route to what families understand and do. Better record access and appeal preparation could help patients challenge decisions. Errors, unclear permissions or inaccessible correction mechanisms could affect those same actions. Neither benefit nor harm was measured in this review.

5. Evidence table: data rights and control

| Finding | Evidence and limits |
| --- | --- |
| Ownership is divided by data type. | The August 26 [Terms, §§1–2](https://www.citizen.health/terms) preserve user ownership of Medical Records but state: “Citizen Health owns your Self Reported Information.” That category includes symptoms, surveys, calendar information, nonmedical meeting transcripts and AI Advocate interaction data. |
| Derived information has separate rights. | The same Terms claim company rights in refined information and aggregate insights, license their use back for personal health purposes, and obtain a transferable, sublicensable service-use license over medical and self-reported records. These are contractual claims, not a finding about legal enforceability. |
| Research sharing is optional, but can be commercial. | The [Privacy Policy, enrolled-user section](https://www.citizen.health/privacy) says research consent is unnecessary for platform use, allows licensing of consented de-identified research data, and describes sharing value with participants and recruiting advocacy groups. Choosing research does not mean choosing every downstream study. |
| Exit does not undo past research sharing. | The Privacy Policy offers download and account deletion, ordinarily within 30 days. Research withdrawal applies prospectively. Previously distributed data cannot be recalled, and underlying source records may be retained to support prior research. It states a one-business-day research-withdrawal processing period. |
| A separate consent states a different timeline. | The [public Databank consent](https://www.citizen.health/patient-consents) allows up to 30 days for withdrawal. Broad consent covers future research without advance notice of individual projects. It also describes project-specific opportunities for people declining broad consent. This is Citizen's Databank document, not proof of the consent shown to a particular RARE-X participant. |

The ownership statement needs to be distinguished from practical access rights. The Privacy Policy permits downloading Medical Records and Self Reported Information and updating the latter. Provider-sourced records require correction at their source. Its research provisions coexist with operational-vendor, legal and business-transfer disclosures. Privacy Policy

RARE-X-specific limit: The published partnership materials do not establish which agreement controls linked legacy survey data. Do not infer that Citizen owns every existing RARE-X response simply because its general terms claim ownership of self-reported information. The actual migration agreements and participant consent screens were not reviewed.

6. Mixed HugoScore profile

| Measure | Assessment |
| --- | --- |
| Patient authority | **Partial.** Families set care-navigation goals, but the allocation of rights in their own contributions complicates authorship and control. |
| Choice and refusal | **Partial.** Consent mechanisms exist. Their deployment-specific operation needs verification. |
| Critical capacity | **Potentially.** Record interpretation and appeal assistance could support questioning institutions. Reliable citations, uncertainty communication and correction of AI outputs were not tested. |
| Informed control | **Partial.** Relevant documents are public, but ownership categories and consent timelines need reconciliation. |
| Action support | **Potentially.** The described workflows connect information to practical advocacy. Completion and accuracy are unverified. |
| Clinical boundaries | **Partial.** The [Ari partner FAQ](https://www.citizen.health/join/tbrs) excludes diagnosis and prescribing and directs medical decisions to clinicians. Its confirmation promise needs qualification below. |
| Evaluation ownership | **Not established for Ari outcomes.** Community partnership does not demonstrate that patients control evaluation criteria or hold veto authority over deployment. |

The partner FAQ promises approval before every outward action. The Terms' alpha addendum instead describes confirmation behavior as being trained and encourages users to request it. Applicability to the current RARE-X release needs clarification. No unauthorized action was observed. Partner FAQ, Ari alpha terms

The partner page also promises that medical information is not shared with third-party AI companies or used to train their algorithms. That wording does not settle Citizen's own training practices. Partner page, footnote

Equity burden: The partner FAQ limits record collection to the US. Digital access, caregiver capacity, accessibility and premium-tier boundaries could affect practical benefit. Disability access and multilingual performance were not tested. Partner FAQ

7. Key unknowns

1. Which agreement governs existing RARE-X surveys, new Ari entries and combined research datasets? Does any ownership clause change at migration? 2. Which withdrawal timeline applies to each consent, and how do families identify it? 3. Can patients inspect and correct an AI interpretation and prevent an incorrect entry from influencing later actions? 4. Are approval gates enforced for each external action in the release RARE-X families actually use? 5. What are the internal training rules, processor arrangements, export formats, retained-record periods and premium limits?

These are research questions, not messages sent to the vendor.

8. Patient agency interpretation

Editorial judgment: Ari could strengthen a family's ability to navigate care and challenge denials. Patient-directed tasks alone do not establish control over the resulting health narrative. The central agency concern is whether families understand and can contest the rights assigned to their contributions, including what continues after they leave. Optional research is a positive control, but meaningful consent also requires clear scope, duration and consequences.

9. Publication status

In scope. Published as a qualified, unscored AI-assisted draft with Hugo Campos's authorization on September 17, 2026. Publication approval does not establish comprehensive human verification. The distinction between Ari and RARE-X remains material. No numerical ranking is justified by this review alone.

Confidence: Medium for the published-document findings. Low for implementation and outcomes. Unresolved for the governance of migrated or combined RARE-X data.

Review provenance: OpenAI Codex / GPT-6, September 17, 2026. Framework: CAIHL-derived HugoScore criteria and current qualitative reassessment method. AI-assisted public-source review. No human verification, account creation, patient-data upload, live Ari testing, security audit, clinical evaluation or legal determination. Product-page evidence includes the rendered RARE-X page. Terms and policy statements are evidence of published commitments, not proof of actual practice.