FirstLight

FirstLight recruits, consents and retains trial participants over iMessage, and Trial Ops gives the study team one agent to act on what FirstLight finds, with the safety rules built into the database.

Comment

Inspiration

Clinical trials rarely fail for lack of science. They fail for lack of people. Industry studies from Tufts CSDD find that about one in ten trial sites never enrolls a single participant, more than a third under-enroll, and timelines routinely stretch to nearly twice their plan to hit enrollment targets. Every day of delay costs sponsors on the order of $800,000 in lost sales and tens of thousands in direct trial costs.

Look at where people actually fall out, and it isn't the science. It's the paperwork. A phone screen during office hours. A consent form averaging 22 pages, read alone and signed at the end. Phone tag to book a visit. A missed reading or a new symptom that sits unseen until the next appointment. On the other side of the table, coordinators and investigators juggle portals, spreadsheets and inboxes to work out who needs them next.

Nearly everyone already carries the answer in their pocket. 98% of U.S. adults own a cellphone, and the one app they open without thinking is Messages. So we asked: what if a clinical trial fit in a text, for the participant and for the study team?

What it does

FirstLight is two AI agents in iMessage, on one consent-first trial platform: Sage for participants, Trial Ops for the study team.

Sage, for participants. Someone texts FirstLight about a study, and Sage, its study assistant, takes it from there. No app to download, no password. Every step arrives as a card in the thread that opens a mini-app inside Messages:

  • Prescreen: 9 or 10 questions generated from the study's own eligibility rules, one per screen. Tap the answer or say it.
  • Informed consent: the key points come first, each confirmed before Continue unlocks, then a short comprehension quiz, then the signature. Face ID signs it, as a WebAuthn passkey in Safari or the Secure Enclave in our iOS Messages extension, with a typed full name as the fallback. Every signature records the form version, signer, time, verification method and a fingerprint of exactly what was read. The site investigator is emailed the moment it's signed.
  • Scheduling: site, day and time in one card, booked in the thread, with what to bring and a calendar invite.
  • Daily check-ins in under a minute, by tap or by voice: with xAI's Grok Voice, Sage asks each question out loud with live captions, reads blood pressure back ("124 over 79"), and saves nothing until the participant reviews what it heard. Voice notes in the chat work too, and Sage answers in its own voice.
  • Safety: if someone reports chest pain or trouble breathing, Sage tells them to call 911 right away and raises a critical alert with a safety review for the investigator.

Trial Ops, for the study team. Trial Ops is the investigator's and trial manager's own agent, on its own iMessage line:

  • Answers from the live platform: alerts, decisions, enrollment pacing, check-in adherence, data quality, staff workload.
  • Mini-app cards for every view: today, decisions, alerts, a study, a participant, the pipeline, data quality, analyses.
  • It texts first: escalations from Sage within seconds, new high-severity alerts, and a morning briefing at the time each person picks.
  • Prepares decisions; a person confirms: confirming enrollment, safety sign-offs, activating a participant, acknowledging or resolving alerts. Nothing changes until someone confirms with Face ID or their typed name, and every step lands in an audit log. Confirming an enrollment activates the participant, schedules two weeks of check-ins, and has Sage welcome them in.
  • Hands work to Sage: "Ask P012 to finish signing," and Sage writes to that participant in their own thread.
  • Heavy analysis on Daytona: for questions too big for a chat, Trial Ops spins up a Daytona sandbox (standard, large or GPU). An analyst model writes and runs Python on a de-identified snapshot (codes, not names; no message text, contacts or signatures). The card in Messages streams every step live, and a report comes back with a summary, findings, charts, tables and files.

The ops website. Classic mode puts every study on one calm page: what changed overnight, who has the next move (timed against what's typical), where enrollment is slowing, and patterns no alert rule caught, with pages for studies, sites, participants, alerts, journeys, the calendar and reported data. One toggle to Agentic mode, and the same Trial Ops agent works beside every view, with Face ID decisions, ⌘K to go anywhere, live analyses and escalation toasts.

How we built it

  • Messaging: Photon Spectrum (spectrum-ts) iMessage lines for Sage and for Trial Ops, with mini-app cards and voice notes. On Sage's shared line, a TypeSafe typed-model router decides per conversation which agent answers.
  • Agents: Claude Haiku 5.5 runs Sage, and Claude Opus 5.5 runs Trial Ops (19 tools) and its analyst. Every tool call goes through the platform's own rules, under each agent's own Postgres role, so the model can ask for anything but only allowed actions happen.
  • Voice: the xAI Grok Voice Agent API (realtime) for spoken prescreens and check-ins with live captions; Grok speech-to-text and text-to-speech for voice notes.
  • Platform: PostgreSQL 18 with a consent-first schema: participants, consents, events, alerts, workflow tasks and study staff, with row-level security and append-only evidence. Sage adds an assistant schema, and Trial Ops adds an ops schema of read views, Face ID approvals and audit events.
  • Identity: WebAuthn passkeys (SimpleWebAuthn) and a native iOS Messages extension that signs one-time challenges with a Secure Enclave key.
  • Compute and email: the Daytona TypeScript SDK for sandboxes sized standard, large or GPU; Resend to email the investigator.
  • Web: React + Vite for the ops website (Classic and Agentic modes), backed by Trial Ops' internal API so the website and iMessage are one agent.
  • Infrastructure: every service runs in Docker behind Caddy on a single server. All data is synthetic: 5 studies, 10 sites and 40 seeded participants.

Challenges we ran into

  • Face ID inside Messages: the mini-app webview can't use passkeys. We built a one-time Safari hand-off, then fixed a loop where Safari kept handing off again, added a "set up Face ID on this phone" path, and kept a typed-name fallback that the record labels honestly.
  • Agents talking to receipts: an early build answered read receipts and spammed a tester. We now answer only real message types, and a loop guard caps replies per person.
  • Two agents on one line: a typed router keeps each conversation with the right agent, sticky per chat.
  • Letting an AI near a clinical record safely: the agent can prepare any decision, but only a human confirmation executes it, as that person's staff identity, through the database's own functions.
  • Heavy compute without leaking data: analyses get a de-identified snapshot, and idle sandboxes stop on their own.

Accomplishments that we're proud of

  • It's live, end to end. In our demo, a participant texts Sage, prescreens, signs consent and books a visit. The investigator approves the enrollment, the participant does a real voice check-in with Grok, and when they report chest pain, the investigator's iPhone gets the critical alert in the same minute.
  • Real safety routing: symptoms reach the right person right away, and the investigator acts from iMessage or the website.
  • Daytona analyses with live status, real Python and a finished report.
  • One agent across iMessage and the website, plus a design system that holds from mini-app to dashboard.

What we learned

  • The best interface for a trial participant is the one they already use, so meet them in Messages.
  • Consent works better as a conversation with checkpoints than as a wall of text.
  • AI agents become trustworthy in healthcare when they prepare and a person confirms: Face ID, audit trails and database-enforced rules.
  • Voice is an accessibility feature, not a gimmick, as long as people can see and correct what was heard.

What's next

  • A pilot with a real study site, under IRB review, with validation toward 21 CFR Part 11 for e-consent and e-signatures.
  • EHR integration (FHIR), multilingual voice, and SMS/RCS for participants without iPhones.
  • Adverse-event workflows, and sponsor-level dashboards across studies.

Built With

Share this project:

Updates

Submission history