Scallion

Uncover your biological age through three key factors—molecular aging, biomarkers, and everyday lifestyle choices—to extend your healthspan.

Comment

Inspiration

Most longevity markers remain invisible despite the data being readily available. Scallion combines blood panel analytes, smartphone optical pulse and basic vitals, and privacy-preserving messaging frequency to measure biological age.

Instead of overwhelming users with another passive health dashboard, Scallion unifies these layers into a single age score measured in years. It pairs that score with one concrete, actionable step users can take today to improve it.

What it does

Scallion processes health data through a privacy-first architecture across five core modules. Lab PDFs are scrubbed client-side using 17 redaction rules, then Gemini extracts structured values for a client-side Levine PhenoAge calculation and biomarker waterfall chart, with critical results directing users to a clinician. A 30-second webcam scan using Presage SmartSpectra captures pulse and breathing to estimate fitness age via the HUNT VO2max equation, with a questionnaire fallback.

Lifestyle inputs drive SimBiology models for glucose-insulin responses, personalized exercise timing, and caffeine cutoffs, with medication safeguards. Social data is processed locally from WhatsApp, iMessage, and Gmail exports using only hashed contacts, timestamps, and message lengths to track relationship patterns without reading messages. All modules feed a deterministic engine that converts hazard ratios into risk-equivalent years using Gompertz mortality doubling time. ElevenLabs provides voice coaching with Backboard memory, while a validator blocks AI-generated numbers not produced by the core engine. Persona verification enables accessibility features and safely gates circle sharing.

How we built it

MATLAB engine. PhenoAge with the exact affine waterfall, NHANES 2017–2020 weighted norms from 8,521 adults, HUNT fitness-age lookup, sourced risk-years table, caffeine PK, and a Cobelli/Dalla Man SimBiology meal model configured for body weight, three ADA-based insulin-sensitivity variants, and a Buffey 2022-calibrated walk. A 144-cell sweep produced 432 simulations in 24 seconds, alongside a Gaussian-process surrogate, validation console, MATLAB project, and live script that runs the pipeline and writes six JSON files.

Social engine. A dependency-free TypeScript package supporting WhatsApp iOS/Android exports, Gmail metadata with outgoing fan-out per recipient, salted contact hashing, length buckets, strength tiers, and iMessage chat.db conversion into the same hashed event format.

Product. Expo with expo-router and strict TypeScript, deployed to Vercel at scallion.us. It includes a validated TypeScript PhenoAge port, browser redaction, source-line review, waterfall, circle map, 30-second capture, interpolated meal curves, ElevenLabs sessions with client tools, and Supabase sign-in.

Platform. FastAPI on Vultr behind Caddy at api.scallion.us, with Tiger Data hypertables and daily connection aggregates. Gemini 3.6 Flash handles structured lab extraction with upload-hash caching. Persona provides hosted verification with one-time links and signed webhooks. ElevenLabs agents are created from code with six client tools, Backboard provides per-user coach memory, and a Node worker bridges phone capture requests to the Presage SDK running on a laptop.

Challenges we ran into

Gemini extracts, MATLAB computes, and a validator gates the coach. When the coach felt “dumb and repetitive,” the fix was not a bigger model: its system prompt became 767 characters of prohibitions with no capability instructions.

MATLAB was not installed at hour zero, so we built a line-for-line Python mirror for provisional exports, then installed MATLAB with mpm and turned the mirror into a crosscheck. It caught a real bug where MATLAB’s max converted missing CRP into the 0.1 floor. The implementations now agree on 970 norm values to 1e-13.

The waterfall had to close exactly. Because PhenoAge is affine in its linear predictor, the cohort offset must use the user’s exact age rather than a band midpoint. Reference vectors caught a one-character error in the published constant, 0.09165 versus 0.090165, that could have shifted the TypeScript result by up to a year.

We also had to make the post-meal walk look physiologically plausible. The first calibration reset glucose uptake instantly, creating a dip-and-rebound curve. Replacing that with a multiplier on insulin-independent uptake with a 60-minute decay, then bisecting to a 15% peak drop, produced a curve within Buffey 2022’s 10–20% range.

Reading pulse headlessly on Windows exposed another failure mode: the SDK waited for a face, streamed continuously, ignored its duration cap, and could hang on its blocking stop call. Captures also failed when the laptop browser held the webcam for the phone’s camera preview. The fix became a protocol: the phone arms, the laptop watches, and the laptop reports failures back to the phone.

Auth failures were equally concrete. Supabase issued ES256 tokens while the API expected HS256; Microsoft 365 link detonation consumed shared sign-in tokens; and the default sender allowed only two emails per hour. Each issue was diagnosed from logs rather than guessed.

Vendor drift added more failures: Gemini model keys returned 404s, a planned ElevenLabs voice disappeared, Persona sandbox links were misconfigured, Tiger Cloud defaulted continuous aggregates to materialized-only, Backboard rejected memory metadata, and Metro could not resolve a symlinked sibling package. Each now has a fallback in the demo runbook.

Accomplishments that we're proud of

  • The math reconciles. Age plus cohort offset plus analyte years equals PhenoAge, exactly, on every screen. The TypeScript port reproduces the MATLAB vectors, and Home refuses to show drivers that do not add up.
  • A validated in-silico model, not a picture of one. 432 SimBiology simulations, a surrogate with peak RMSE of 1.2 mg/dL (R² 0.9997) under 5-fold cross-validation, and a console that overlays the full model on the grid within about 1 mg/dL.
  • A real pulse with no wearable. Captures of 68.5, 72.6, and 74 bpm from the demo laptop's webcam, stored in Tiger Data, retrievable by the phone.
  • A lab PDF to nine analytes in about 35 seconds, each with its source line, its SI value, and a derived lymphocyte percentage when needed, redacted before it left the browser and never stored.
  • A coach that cannot make up a number. Ask it anything; every reply passes through the validator first.
  • Privacy we can defend line by line. Five fields per event, 17 redaction rules, per-contact forget, delete-all, uploads held in memory only.
  • Tested and deployed. 233 API tests, 77 web tests, 42 social tests, 15 worker tests, 11 MATLAB tests, a TLS API and a web app on a real domain, and a fallback for every live step that produces the same numbers.

What we learned

  • Metadata is enough to see a trend. Content adds nothing to the metrics and everything to the risk.

What's next for Scallion

  • More fitness inputs. Apple Health, Fitbit, and Garmin resting heart rate and VO2max alongside the camera reading.
  • Native builds with on-device redaction on Android and iOS, beyond the web export.

Built With

Share this project:

Updates

Submission history