What this platform refuses to do, and how you would know.

Cause

General saturated-fat guidance applied to somebody whose current clinical guidance is not to restrict fat.

Effect on the person

Weight loss and fat-soluble vitamin deficiency — the exact harm the out-of-date low-fat advice causes, delivered by us.

• Tested
  The saturated-fat finding is suppressed entirely where the declared condition makes it wrong, and the suppression is stated on the page rather than silent.risk.logic.ts — risksFor, doNotFlagFat
• Untested
  The condition card states that the guidance has changed and that older leaflets say the opposite.conditions.ts — pancreatic_insufficiency.careful

Still owed. Depends on the member declaring the condition. Nothing infers it, by design.

Cause

A weight-reduction narrative running for somebody whose falling weight is the presenting sign of an undiagnosed illness.

Effect on the person

Delayed presentation of a serious underlying condition — malignancy, inflammatory bowel disease, malabsorption — because the platform reinforced it as success.

• Tested
  Where a declared condition makes weight loss a warning, the reduction plan does not run, the BMI target is withheld and a falling weight is raised as high with the action "tell the team treating you".risk.logic.ts — weightLossIsAWarning
• Tested
  The threshold for saying so is 0.2kg a week rather than the general 1kg.risk.logic.ts — risksFor, weight going down

Still owed. Only fires where a relevant condition has been declared. Somebody with an undiagnosed illness has, by definition, declared nothing — the general "rate of loss" finding is the only net under them.

Cause

A functional measure performed alone, without support in reach, on an unsuitable surface or chair.

Effect on the person

A fall, with fracture the common outcome in the age group this is aimed at.

• Tested
  Every check carries safety instructions before the method: something solid within arm’s reach, a chair that cannot slide, a clear floor, somebody in the house.falls.ts — FUNCTIONAL_CHECKS[].safety
• Untested
  Each check tells the person to stop at the first position they cannot hold, and that stopping is the honest number.falls.ts — FUNCTIONAL_CHECKS[].how
• Untested
  Every measure is optional; a check not attempted is a valid record rather than an incomplete one.falls_checks migration — nullable measures

Still owed. Undesirable rather than acceptable, and deliberately left there. This is a physical test performed unsupervised in somebody’s home, and no instruction reduces that to negligible — the only controls that would are supervision, which we cannot provide, or removing the checks, which would remove the thing that gets people to the right starting level. The judgement is that an unsupervised check with explicit safety instructions is safer than the alternative actually taken, which is starting a programme at a level nobody measured. That judgement belongs to the Clinical Safety Officer to accept or reject.

Cause

A functional measure presented as, or mistaken for, a falls risk assessment.

Effect on the person

A person declines or does not seek a real assessment — which covers medication, lying and standing blood pressure, vision, feet and the home — and falls.

• Tested
  No risk score is produced. There is no field to return one in, and the module returns a starting level for exercise instead.falls.ts — StartingPoint has no risk or score member
• Tested
  Every response carries the statement that this is not an assessment of falls risk, naming the four things it cannot see, and saying that a good result does not mean safe.falls.ts — NOT_A_RISK_SCORE
• Tested
  A fall in the last twelve months routes to a falls assessment regardless of how well the checks went.falls.ts — startingPoint, referFirst

Still owed. The statement is on every response, and nobody can be made to read it. The platform also has no way of knowing whether an assessment was offered and declined — it can prompt, and it cannot follow up. Reducing this further needs something outside the software: a route by which a poor result reaches a clinician, which is what the NHS procurement route would provide and what nothing here currently does.

Cause

Incomplete or stale label data, or a photograph analysed as though it were a label.

Effect on the person

Allergic reaction, up to anaphylaxis, or gluten exposure in coeliac disease.

• Tested
  The fourteen UK declared allergens are reported from the label when a barcode is read, and the source of every figure is stated.barcode.service.ts, @jessmove/foodlens — UK_ALLERGENS
• Tested
  A photograph never produces an allergen claim; the analysis states what a photograph cannot tell you.foodlens.logic.ts — NEVER_CLAIM
• Untested
  The coeliac and lactose cards say plainly that the packet is scanned rather than trusted, and name cross-contamination as the usual cause of a reaction despite doing everything right.conditions.ts — coeliac.careful

Still owed. Label data comes from an open catalogue that can be out of date. The platform states its source but cannot guarantee the manufacturer has not changed the recipe.

Cause

A language model answering outside the boundaries set for it.

Effect on the person

A person acts on advice that was not clinically grounded, or loses trust after being told things about their day that were never true.

• Tested
  The coach publishes what it refuses to do, and the refusals are enforced rather than requested.mova — MOVA_REFUSES
• Tested
  An answer that repeats context from the tone sample is detected and the model is asked again with the mistake named.mova.service.ts — repeatsSampleContext
• Tested
  Under-18 answers are checked against the minor rules by the platform after the model returns, not by the model.mova.service.ts — violatesMinorRules

Still owed. The controls detect known failure modes after the model has answered — invented context, a breach of the under-18 rules, a banned phrase. A novel failure that resembles none of them passes. This is the irreducible residual risk of putting a language model in front of a person, and the mitigations are bounded scope, published refusals and the fact that the coach answers in one line rather than at length.

Cause

Appetite pharmacologically suppressed, intake falling well below need, and a platform whose every other rule watches for excess.

Effect on the person

Loss of lean mass, micronutrient shortfall, and fatigue attributed to the medication rather than to intake.

• Tested
  Below half a reference intake is raised as a high finding, with protein-first named as the action.risk.logic.ts — proteinMattersMore
• Tested
  Loss faster than roughly one per cent of body weight a week is raised, with resistance work as the lever.risk.logic.ts — muscleLossRisk
• Tested
  Fewer than two movement days a week is raised as a muscle finding while this is happening.risk.logic.ts — muscleLossRisk, activity

Still owed. Depends on the person recording what they ate. Somebody who stops recording because they ate almost nothing is invisible to this, and that is the failure mode most likely to occur.

Cause

An age check omitted on a surface that renders any of those figures, or an adult surface reachable by a minor account.

Effect on the person

Body-image harm and a recognised pathway into disordered eating, in a group where that pathway is well documented and the platform would have opened it.

• Tested
  The insight engine returns unavailable for any age under 18 before it computes anything at all.risk.logic.ts — insightFor, first branch
• Tested
  Conditions cannot be declared under 18, at the endpoint as well as in the render.health-insight.controller.ts — setConditions
• Tested
  The strength and balance module refuses under 18.falls.controller.ts — record
• Tested
  Energy is withheld from a minor in FoodLens, and the surface policy is a shared gate rather than a per-screen decision.@jessmove/shared — bodySurfacePolicy, charter rule C6

Still owed. Age is self-declared. A minor who registers as an adult defeats every control above. Ofcom’s 2026 position is that self-declaration is not highly effective age assurance, and this is the largest single residual risk in this log.

Cause

General guidance — eat more protein, swap to a low-sodium salt — applied without regard to renal function.

Effect on the person

Hyperkalaemia, which can be fatal, or accelerated decline in kidney function.

• Tested
  No surface suggests a salt substitute where the declared condition forbids it, and the salt finding names the substitute as the one swap to avoid.risk.logic.ts — noSaltSubstitute
• Tested
  Protein is never pushed where a declared condition sets the target from bloods, including against an opposing declared context.risk.logic.ts — doNotPushProtein, and the conflict statement
• Tested
  Where two declared contexts disagree, the cautious side wins and the member is told who settles it.risk.logic.ts — suppressionsFor, protein conflict

Cause

A single confident number returned for a plate whose contents were inferred rather than read.

Effect on the person

Sustained under- or over-eating built on an error. Independent testing published in 2026 found leading photo apps underestimate meal energy by roughly 250 to 345 calories with macronutrient error rates of 48 to 66 per cent.

• Tested
  Energy is returned as a range, never as a single figure.foodlens.logic.ts — energy
• Tested
  Every nutrient states its basis: label, calculated, estimate, reference or unmeasured.foodlens.logic.ts — frontOfPackFrom
• Tested
  A nutrient nothing established is shown as not measured, never as zero.foodlens.logic.ts and the ledger entry mapping
• Tested
  An intelligence score states how much of the plate was actually known.foodlens.service.ts — intelligence

Cause

Condition guidance drifting into dose, timing, escalation, or whether to continue.

Effect on the person

A person alters a prescription on the basis of software that has never seen their results.

• Tested
  Every condition card carries a clinicianOnly section naming the medication as the prescriber’s, and a test scans all cards for dose, timing and escalation language.conditions.ts — clinicianOnly; conditions.test.ts
• Tested
  The appetite-suppressing medication card is additionally scanned for injection, titration and missed-dose language.gaps.test.ts
• Tested
  A declared medication carries its own notice stating that nothing here comments on it.conditions.ts — MEDICATION_NOT_ADVICE

Cause

A write that failed silently, or a stale read presented as current.

Effect on the person

Decisions taken on an incomplete record — a week that looks lighter than it was, a condition believed declared that is not.

• Tested
  A failed conditions write is surfaced rather than swallowed; the picker says so and does not claim to have saved.conditions.service.ts and conditions.tsx — save state
• Untested
  A failed conditions read throws rather than returning an empty list, so nobody is handed general advice their condition exists to override.conditions.service.ts — forUser
• Untested
  A failed strength-check read throws rather than restarting somebody at a level they have outgrown.falls.controller.ts — history

Still owed. Food ledger writes remain best-effort by design: a ledger that cannot be written must not take down the analysis somebody is waiting for. A missing row is a gap in a total rather than a failed scan, and that trade is deliberate.

Cause

Group aggregation including special-category data, or a small group size.

Effect on the person

Identification of a person’s health status by somebody with power over them, with the discrimination that follows.

• Tested
  Group reporting enforces a k-anonymity floor of 8.groups.logic.ts — K_ANONYMITY_FLOOR
• Tested
  No module outside the conditions service references the conditions table at all, asserted by scanning the source.conditions.test.ts
• Tested
  Conditions never enter the ordinary draft autosave, which refuses anything clinical.state.logic.ts — FORBIDDEN

Cause

An allowance exhausted between one action and the next.

Effect on the person

A decision taken on a partial reading, believing it whole.

• Tested
  The allowance is checked and held before any provider is called, so an action either runs completely or does not begin.ai-gateway.service.ts — hold, before the provider chain
• Tested
  Exhaustion returns 402 with the wallet’s own explanation of what is paused and what still works, never a generic failure.allowance.filter.ts
• Tested
  No caller dresses an empty allowance as an outage.mova, foodlens, blog and growth services — AllowanceExhaustedError rethrow