Governance pack

What a Department of Health reviewer would ask for, mapped to the Abu Dhabi Responsible AI Standard (DoH/ST/DDGO/RAI/V1/2025, October 2025). Where we fall short, the gap is written down next to the clause.

Risk tier: high

Clause 3.3.1.2.2.2

The explainer talks directly to patients about results that can shape reproductive decisions, in two languages, and could cause harm if it reassured wrongly or missed distress. Even after the controls below, we rate the residual risk high, so we treat it as high risk, which means a conformity assessment with the DoH Data and Digital Governance Office before the pilot and again after it.

The private matching and the counsellor desk are not AI. They fall under the health-data and genetic-testing laws (Decree-Law 49/2023, Federal Law 2/2019) and ADHICS, and are covered by the same DPIA.

Clause by clause

Clause	Requirement	What Two Keys does	Evidence	Gap
3.1.1.1.1	Co-designed with clinicians and patients	Wording follows published counselling practice (NSGC non-directive counselling, ACMG reporting, Mackenzie’s Mission couple reports). 17 people (Arabic and English) tried it; their answers confirmed the couple-only default and the opt-out to a person.	User study	The sample is friends and family, not representative. Phase 0 runs co-design sessions with the operator’s counsellors and with couples recruited through screening centres.
3.1.1.2.1–2	Human oversight and escalation protocols	Every clinical step goes through a named genetic counsellor. Distress in the explainer shows 999, 998 and the UAE Mental Support Line (800 4673) and offers a one-tap same-day call. Desk clocks: same day (4 hours) for distress, for pregnancy from week 9 or with the weeks unknown, and for a possible Hb Bart’s or severe HbH match in any pregnancy; 1 working day for earlier pregnancy and for a possible Bart’s, severe HbH or SMA match; 2 working days otherwise.	Counsellor desk Crisis path in the phone	The person must tap to book: nobody is contacted without their consent. Clock targets need staffed counsellors in a pilot.
3.1.2.1.2	Graceful degradation and fallback	If the model fails or an answer breaks a check twice, the person gets a safe fixed answer and a counsellor button. If the intent check itself can’t run, the explainer fails closed and shows help. The rest of the app works with the explainer off.	Route counts in the evaluation	None known
3.1.2.1.3	Safety testing and failure-mode analysis before deployment	Ablation evaluation on 60 development questions and a new frozen held-out set for every version (146 in v4 and v5, 178 in v6, written by three different model families), graded by three language-model judges, with a majority and a strict count; misses, their fixes and every run published. A failure-mode table is below.	Evaluation Failure modes Every answer	Judges are language models, not clinicians; each set is spent once its misses are fixed, so every version needs a new one.
3.1.2.1.4, 3.1.3.1.3	Post-deployment monitoring	Daily counts of how each answer was produced (guard, intent, model, fallback), which check caused each fallback, Arabic wording repairs, answers per explainer version, escalations, crisis same-day offers, language, model id and “report a problem” taps, without storing any question.	Live counts below	One review rule: review when the weekly fallback rate is 5 points above the latest evaluation’s. It is read from these counts by hand; automated alerts are not built yet.
3.1.3.1.4	Performance decline triggers review	Monitoring counts fallbacks, failed checks, crisis escalations and problem reports daily.	Monitoring	Review when the weekly fallback rate is 5 points above the latest evaluation’s, on any report about an urgent answer, or on a new model version; each starts a re-run of the held-out evaluation. Checked by hand from monitoring; automated alerts are not built yet.
3.1.2.2.1	Feedback mechanisms	Every explainer answer has “report a problem”; reports are counted in monitoring and reviewed.	Monitoring	Reports carry no text yet, so review starts from counts.
3.1.3.1.1	Validation against established benchmarks	The risk engine is checked against every published UAE figure (Dubai, Abu Dhabi programme and genome study), all shown, including the one it misses.	Calibration	Gene-level fit is shown but not yet tuned; the CYP21A2 frequency is classic-only from this version.
3.1.3.1.2	Testing across diverse contexts	Held-out questions in English, Modern Standard Arabic, Gulf dialect and Arabizi, results reported per dialect.	By dialect	Each held-out set now has 23 to 51 questions per dialect, still too few for tight parity bounds. Dialect and speaker labels are re-derived by rule from the text, not checked by a native speaker; that review is a phase-0 task.
3.1.4.1.2	Threat modelling	Per-party threat model: partner, modified phone, relay, lab, counsellor, analyst, outsider.	Who could learn what	None known
3.1.4.2.1	Role-based access, least privilege	Signed identity for people; the lab issues tokens only after the two seated people confirm each other by name; the desk queue shows only names, urgent or not, overdue / due today / later, and counts; desk sign-in locks one address (as the platform sees it) after 20 failures an hour, and past 300 failures an hour overall every check is slowed but never refused, so nobody can shut the escalation path.	Threat model	Demo: one shared desk passcode with a chosen name, and a judge account that opens without one (synthetic people only), so attribution is not individual. Production: per-clinician sign-in with MFA (DoH identity provider).
3.1.4.3.1	Secure code review and vulnerability scanning	Open source, typed, tested (unit and end-to-end), input validation and rate limits on every route, strict security headers.	Repository	Independent crypto audit and penetration test before any pilot.
3.1.4.4.1	Privacy by design, data minimisation	Couple-only by default. The lab computes the match from results it already holds and keeps who paired with whom, and the genes it named, for one day. A booked case keeps only a keyed code of its pairing (so the desk can see whether the partner booked too), erased on withdrawal. A counsellor sees only what was ticked; the queue shows no genes and no exact clock. Programme counts take each person once a year, under a pseudonym key that changes every year.	How it works	The keyed pairing code links two partners’ bookings for as long as the cases are kept (60 days in the demo; 2 hours for demo identities). Phase 0 decides with the operator whether to compute “partner booked too” at booking time instead and keep no link.
3.1.4.4.2	Production data not used for training	Nothing is trained. The model is called through Amazon Bedrock, which does not use inputs to train models.	—	None known
3.1.4.4.3	Secure multi-party computation, differential privacy	Private set intersection on the two phones: the lab names genes only when both phones’ comparisons agree with its own records, and labs never need to exchange results. Programme counts use exact discrete Laplace noise from a keyed generator, per-person markers under a pseudonym key that changes every year and deleted when the year ends (a person’s first booking and teach-back once a year, at most 5 notes a year), each week released once into an append-only ledger, ε ≤ 3 per person per year.	Protocol Programme view	In the single-lab setting the lab already holds both results, so the private comparison protects partners from each other; its cross-lab role starts in phase 2.
3.1.4.5.1	Compute, storage and remote access inside the UAE	Designed for in-country hosting (AWS me-central-1 offers Nova Pro and DynamoDB).	—	The demo runs in Sydney on synthetic data, and the developer is outside the UAE. Phase 0: move and re-test in the UAE; vendor access only through the operator’s UAE jump host; UAE-based support.
3.1.5.1.1	Diverse test data (age, gender, other factors)	Held-out questions are asked by women and men, in four language forms, at three reading levels.	Evaluation	Age and education are not yet varied on purpose; the pilot reports by both.
3.1.5.1.2	Representativeness and subgroup gaps	Understanding (teach-back) and explainer safety are reported by language and reading level.	Understanding by language By dialect	In v4, Gulf-dialect and Arabizi questions got a checked model answer less often than English ones (most were Arabic answers our own wording checks refused). The fixes after v4 target this, and each run reports helpfulness by dialect.
3.1.6.1.1	Tell patients when AI contributes	The question screen says an AI writes the answers, that they are checked, and that they can be wrong.	Ask a question	None known
3.1.6.1.3	Right to opt out of AI	“I’d rather ask a person” on the question screen books a counsellor instead. Nothing else in the app uses AI.	Ask a question	None known
3.1.6.2.3	Traceability of inputs, outputs and versions	The model id is pinned and counted in monitoring; every desk action is in an HMAC-keyed, sealed audit chain.	Audit trail Monitoring	Question text is deliberately not logged, for privacy. A pilot needs consented, access-controlled logging; this trade-off goes to the DoH conformity assessment.
3.1.6.3.3	Plain-language patient outputs	Simple, standard and detailed versions in Arabic and English; readability measured on every answer in the evaluation.	Readability	Readability is measured by formula, and Arabic formulas are less established than English ones; no reading level has yet been tested with couples for comprehension. Phase 0 tests each level with couples recruited through screening centres.
3.1.7.2.2–3	Clinicians keep final authority; override and audit	Options are unranked; no clinical step without a counsellor; withdrawal erases shared data and seals notes.	Desk	A counsellor can’t yet see or correct an explainer answer a person was given (question text is not stored, for privacy), and where the language-model judges disagree in an evaluation no person decides yet. Human adjudication of evaluation disagreements is planned in phase 0.
3.1.7.1.1–2	Named owners for monitoring, review and reporting	Interim owner for every risk and role: the founder.	Risk register	Clinical lead, operator and DoH reporting owners are named in phase 0.
3.2.3.1.1	Data clinically validated by domain experts	Every fact and condition card cites its source and is versioned, ready for sign-off. In phase 0 the operator’s genetic counsellors sign off each version, and no version reaches patients without that sign-off.	Data card	Clinical sign-off of every fact, condition card and Arabic string by the operator’s genetic counsellors is a phase-0 gate before launch; 131 panel genes have short cards generated from the panel data until then. We are looking for a UAE genetic counsellor to work with us on it.
3.2.5.3	Datasheets or data cards	Data card below; sources and rights on the Proof page.	Data card Sources	None known
3.2.4.1	Versioned, traceable datasets	Facts, condition cards and the gene panel are versioned in git; the evaluation’s held-out questions are frozen with a published SHA-256 before each run.	Repository	None known
3.3.1.1.2	Risk register with owners	Register below.	Risk register	None known
3.3.1.2.2.2	High risk: conformity assessment before and after deployment	We classify the explainer as high risk and plan the assessment with the DoH Data and Digital Governance Office.	Risk tier	Assessment not yet done; it is a gate before the pilot.
3.3.1.4.1	Risk communication to stakeholders and DoH	This page, the deck and /proof publish the tier, register, evaluation and misses.	Proof	Formal reporting to DoH starts with the conformity assessment.
3.4.1	AI literacy for staff	The desk tells counsellors what the explainer can and can’t do.	Desk	A short counsellor guide to the explainer’s limits and failure modes, in phase 0.

Model card: the explainer

Intended use: Answer a couple’s questions about genes they both carry, from vetted facts, in English or Arabic, at three reading levels.
Out of scope: Diagnosis, recommending a decision, religious rulings, anything about a partner beyond shared genes, emergencies (handed to people).
Model: apac.amazon.nova-pro-v1:0, pinned; temperature 0.1
Safety layers: Keyword guards (English, MSA, Gulf dialect, Arabizi), model intent check, grounded prompt with 21 facts and a card for every panel gene, code checks on numbers, odds, relatedness, cover, persona, language and framing, fixed fallback. Arabic answers get deterministic wording repairs (plan names in Arabic script, the dual for the couple, agreed terms) before the checks; each repair is counted in monitoring and the evaluation.
Held-out result: safe and helpful 156 of 178; safe 169, strictly safe 137; 9 misses published
Judges: au.anthropic.claude-sonnet-4-5-20250929-v1:0, deepseek.v3-v1:0, qwen.qwen3-235b-a22b-2507-v1:0 (language models)
Held-out author: moonshotai.kimi-k2.5, neither the product model nor a judge; set frozen with its SHA-256 before the run
Cost: about 1966 input and 95 output tokens, ≈ $0.0019 per answer at list price
Known limits: Graded by language models; matches genes and change severity, not exact variants; demo hosted outside the UAE.

Data card: what the explainer and result screens say

Contents: 21 bilingual facts; 22 condition cards at three reading levels; a 153-gene panel with carrier frequencies.
Sources: NSGC, ACMG, MedlinePlus Genetics, Decree-Law 49/2023, Thiqa ART guideline v3.6 (last updated 26 November 2025), Jain et al. 2025, gnomAD v4.1. Each item cites its own.
Version: 2026-10-18, in git; every change is a commit with its tests. Independent code review starts in phase 0.
Clinical review: A phase-0 gate: the operator’s genetic counsellors sign off each version before any version reaches patients.
Personal data: None. All people in the demo are synthetic.
Known gaps: Gene-level and severity-level, not exact variants.

Data protection impact, in one table

Data	Where	Who can read it	Basis	Kept for	Location
Carrier results	The screening lab, as today	Lab staff	Decree-Law 49/2023 Arts. 6, 7	Lab’s existing policy	Must stay in the UAE (Art. 7)
One-time tokens	Phone memory, one pairing	Nobody can read them	Part of screening	Gone when the page closes	None
Locked lists (relay)	Relay, encrypted	Nobody: key never reaches a server	Part of screening	Unreadable after 10 minutes; deleted within 48 hours	Demo: Sydney. Production: UAE
Who paired, that both confirmed, and the genes the lab named to them (with what each match means)	Lab store (in the demo, Two Keys’ own database)	Lab	Lawful basis: both partners’ explicit consent to the comparison (Decree-Law 49/2023 Art. 6). Prevents reuse and impersonation; a booking copies the named genes from here	1 day; then only a used-link marker with no names, 30 days. A failed comparison leaves one record with the day, the seat and a pseudonym (key changes yearly), no genes, 1 year	Demo: Sydney. Production: UAE, lab-operated
Choice to see everything	Lab store	Lab; partner’s results released only when both chose	Lawful basis: both partners’ explicit choice (Art. 6)	1 day, with the pairing	Demo: Sydney. Production: UAE
Booked case (ticked items only; own results only if ticked), with a keyed code of the pairing, never the pairing itself, so the desk can see whether the partner booked too. A shared gene is the booker’s own result too; the partner is never named on the case	Desk store (operator’s system in production)	Named counsellors, every view logged; the queue shows no genes and no exact clock	Lawful basis: explicit consent (Art. 6), withdrawable (Art. 8), for the booker’s own care; consent consent-v2-2026-10-17	Demo 60 days (2 hours for cases booked by shared demo identities); production per health-records law. Withdrawal erases what was shared and the pairing code at once	Demo: Sydney. Production: UAE
Family notes	Store, encrypted on the sender’s phone; no sender kept with the note (the server sees the signed-in sender only while handling the request; pseudonymous per-person counters: 5 notes a day in the demo, where identities are shared; only a person’s first 5 notes of the year enter programme counts)	Only someone with the link; read and booked acknowledgements need a token made from the link	Lawful basis: the sender’s choice to tell relatives about their own result (Art. 6); a relative consents when tested	30 days; the per-person counters end with their day or year	Demo: Sydney. Production: UAE
Explainer question	Sent to the model, not stored	Model provider, processing only	Person’s request	Not stored	Demo: Amazon Bedrock APAC cross-region profile (may route within Asia-Pacific). Production: UAE region
Programme and monitoring counts	Store	Health authority (noisy weekly aggregates)	Lawful basis: the health authority’s oversight of the screening programme; only noised aggregates leave the store	Counts only, 1 year. Released weeks (an append-only ledger, with any correction notes beside it) are kept permanently, so no week is released twice. Pseudonymous “already counted” markers use a key that changes every year and are deleted when the year ends, so each person is counted once a year and no marker outlives its year	Demo: Sydney. Production: UAE
Desk queue reads	Desk store	Operator audit	Accountability	60 days	Demo: Sydney. Production: UAE

Risk register

Risk	Controls	Likelihood (1–5)	Impact (1–5)	Residual	Owner
Explainer gives a wrong or falsely reassuring answer	Grounded facts; number, odds, X-linked and milder-match checks; fallback; counsellor button; held-out evaluation	3	4	High (sets the tier)	Founder (interim); clinical lead
Distress is missed	Keyword and model crisis checks in English, Arabic, Gulf and Arabizi; fails closed if the check can’t run; help line and same-day call offered. v4 measured 7 of 146 held-out answers missing distress, v5 5 of 146 and v6 3 of 178, which sets the likelihood	3	5	High (sets the tier)	Founder (interim); clinical lead
Someone else joins a pairing, or blocks it	Atomic seats; the creator confirms the joiner by name first, and a “no” frees the seat for the right person; no tokens until both confirm; relay writes need the link’s write key, so seeing a mailbox id isn’t enough to fill or block it	2	4	Low	Founder (interim)
Partner or family sees a result through the phone itself	Couple-only default; results sealed until opened; decoy-padded tokens; nothing in notifications	3	3	Medium	Product owner
Health data leaves the UAE	Synthetic data only in the demo; in-country hosting and UAE-only access are a pilot gate	5	4	High until moved	Operator
Counsellor over-access	Consent per item; queue without genes; logged case views and queue reads; compare-and-swap writes so a withdrawal can’t be undone	2	3	Low	Operator
Audit trail rolled back by an insider	Keyed, sealed chain detects edits and truncation by anyone without the audit key; production anchors the chain head outside the database (write-once storage)	1	4	Medium until anchored	Operator
Server keys compromised	Demo: one root key on one server, with a separate HKDF subkey for each purpose (tokens, identity, audit, lab signing, noise, limits). Production: separate keys in a KMS/HSM held by the lab and operator; rotation	2	5	Medium	Lab and operator
Teach-back overstates understanding	Counted as first-try scores only; validated instrument in the pilot	3	2	Low	Evaluation lead
The desk store doesn’t scale	The demo store keeps one partition per record type and reads the whole queue with a full scan, paged to the end, that refuses past 20,000 items rather than truncate silently. Phase 2: an index on status and due time (DynamoDB GSI) and paged queue reads	3	3	Medium until indexed	Founder (interim)
Script injection in the web app	Strict security headers; no third-party scripts; every input validated. The Content-Security-Policy still allows 'unsafe-inline' scripts and styles (the framework’s inline bootstrap); phase 0 moves to per-request nonces and drops it	2	4	Medium until nonces	Founder (interim)

Failure modes

What can fail, what the person sees when it does, and how we would know.

Failure	Effect on the person	Detection	Response
Model unavailable or slow	A fixed safe reply and the counsellor button; the rest of the app works	Fallback count in monitoring	Retries with backoff; review when the weekly fallback rate is 5 points above the latest evaluation’s (read from monitoring by hand; automated alerts are not built yet)
Intent check can’t run	Retried once; then a neutral message and the counsellor button (help numbers too if the person sounds distressed), never an unchecked answer	Counted as a check failure	Fails closed by design; not marked urgent, so an outage can’t flood the same-day queue
Answer breaks a check twice	A fixed safe reply	Fallback count; over-refusal in each evaluation	Review the check or the facts; re-run the evaluation
Wrong odds pass every check	A wrong number on screen	Held-out evaluation; “report a problem”	Fix the fact or check, add a regression test, re-run on a new set
Distress phrase not recognised	No crisis card; the counsellor button is still on every answer	Held-out misses; reports; counsellor feedback	Add the phrase and a regression test the same day
A phone tampers with the comparison	Nothing is named; both are asked to pair again	The lab refuses and logs the mismatch: a daily count, and one record per pairing with the seat and a pseudonym, no genes	Investigate repeated failures for one person
Partner never confirms	Nothing issued or named; the pairing expires	Timeout on the phone	Start a new pairing
A partner stops or says no	Nothing is named; the other phone is told “Your partner stopped this comparison”	A sealed stop message in the relay, and the lab answers “stopped”	Start a new pairing; a creator who said no can wait for the right person on the same link
Desk store write conflict	Retried automatically; a 409 asks to try again	Conflict responses	None needed unless frequent
Counsellor misses a clock	The case turns overdue on the desk	Overdue count in the programme view	Operator escalation rota

Monitoring, live

How explainer answers were produced over the last 30 days on this demo. Only counts are kept: never a question, an answer or a person.