Profinity  ·  For Arpit Jacob

The five things
you asked for.

Nothing new built — this is what already exists. Every number was read directly out of our own records on 27 July 2026: the App Everything Doc and our FY26 headcount forecast. Three corrections to the brief you read are flagged where they arise.

27 July 2026 Dr Tim Pearce Answers only — the brief is unchanged
← The original strategy brief, if you need it again
Before the five

One thing that shouldn't wait for the call.

I found this while pulling your answers together. It is on production now.

Live privilege escalation · nobody assigned

Any member can grant themselves premium — or full admin

The row-level-security policy on public.users has no column restriction and no WITH CHECK. Any authenticated user can PATCH their own record and set is_premium: true, bypassing every paywall in the product — or set user_type: "admin", which grants app-wide administrative access across every admin policy, including the records of all 650 members.

It is pre-existing and app-wide, not introduced by recent work. Mo found it himself during self-review, wrote it up accurately and proposed a correct three-step fix. It isn't a one-line change, because the current purchase flow sets is_premium from the client.

Mo's own severity rating: blocker Nobody assigned to fix it Raised 22 July 2026 Still open today

I'm not raising it for drama. An urgent, correctly-diagnosed, business-critical defect that nobody has been assigned to for five days is the ownership problem expressed in a single ticket — and it is probably the most useful evidence I can give you for the read you offered.

i
Your first question

The roadmap, as it stands.

Our planning lives in one place — a Google Sheet Mo maintains called the App Everything Doc. It holds the feature roadmap, the launch timeline, the tier definitions, the data model and the financial model. Last updated 22 July. I'll share it with you directly.

What's in it

Around 45 features spanning March to November 2026. Each row carries: user type, the feature, why we want it, back-end / web / mobile status, a deployment date, estimated build hours (8 to 400), a priority, a named developer, and links to Figma prototypes and engineering blueprints. It is more structured than I expected to find when I went looking.

Then I sorted it by priority and by date, and this is what came out.

Marked High or Urgent — every date already passed

  • Legacy database migration — Urgent · due 30 Apr · Vaclav
  • Host live virtual events — High · due 30 Apr, now showing July · Vaclav
  • Purchase online → redirect to platform — High · due 1 Apr · Vaclav
  • Free download → redirect to app — High · due 30 Apr · Vaclav
  • Conference e-ticket — High · due 30 May · Rob
  • Consultation → protocol → booking tool — High · due 30 May · Vaclav
  • Marketing assistant agent — High · due 30 May · Dalia
  • Membership coach AI — High · due 30 May · Vaclav
  • 1-1 and group DMs — High · June · Rob
  • Webinar registration → app — High · June · Vaclav

Everything scheduled from August onward — all marked Low

  • Health Passport · Aug · Low
  • React and comment on content · Aug · Low
  • Phone call agent · Aug · Low
  • Patient analytics page · Sep · Low
  • Connect to wearables · Sep · Low
  • Gamification / Olympics · Sep · Low
  • Search and book clinicians · Oct · Low
  • Food photo macro tracking · Oct · Low
  • AI coach and notifications · Oct · Low
  • AI CFO · Nov · Low  ·  AI consultations · Nov · Low
The pattern, stated plainly

Every item we marked important is late. Everything that isn't late, we marked Low.

Ten features carry High or Urgent, and not one of them made its date — several by three months or more. The twelve features scheduled between August and November are, without exception, priority Low. There is no item anywhere in the roadmap that is both important and on time. That is your sequencing hypothesis, in our own spreadsheet, in our own handwriting.

Three more things about how the sheet is kept

The status columns hold due dates, not statuses. "Due Live 30 Apr", "Due Live 30 May" — written once as intentions and never updated as the dates went by. So the roadmap cannot tell you what state anything is actually in.

The "revenue opportunity" and "reach" columns are empty for every single row. They exist, which means someone intended to rank by value. Nobody ever filled them in.

"Sign off by" is blank on everything current. It is only populated on older items that already shipped.

Two things in the sheet I had not registered until today

We planned to move 750 paying members onto the app. The sheet records: "15 APR — only 50 users moved to app".

Written in our own hand against the launch timeline, and I don't believe it was ever treated as the emergency it was. It is the same adoption problem I described to you as 650 members and roughly 100 weekly actives — recorded early, recorded honestly, and nothing in the roadmap sequence changed in response to it.

The second: the sheet carries a financial model projecting 11,894 paying members and £1.15m of monthly revenue by month 12, on £36k a month of ad spend at 15% monthly churn. We are at 650 members. I am not troubled by a model being wrong — they always are. What matters is that nobody went back and reconciled the plan to the outcome, and the roadmap is still sequenced as though the model held.

A correction to the brief you read

I told you the patient side was unbuilt. Not quite right — Health Passport and the Flora AI coach have working code written and sitting in unmerged pull requests. Arguably a worse position than unstarted, and I'd rather correct it than have you find it.

ii
Your second question

How the team runs, week to week.

The company rhythm is well defined. The engineering rhythm inside it is much less so, and I think that gap is the honest answer.

What is defined

  • EOS — quarterly Rocks, a Level 10 leadership meeting, Monday scorecards
  • A written 13-week cycle — 3 days data, 5 decide, 5 reorganise, 9 weeks ship, 3 review
  • A recurring "Tech Sprint Planning" meeting in the calendar — next one 29 July
  • A ten-stage board with PR review, stage and production steps already modelled

What is not defined

  • No sprint length I can point to, and no sprint boundary visible in the data
  • No standup on any calendar I can find
  • No release train — deployments appear as one-off tasks ("STAGE Deployment", "PROD Deployment", "PR Checkpoint") created as needed
  • The sprint planning meeting has no agenda and no attendee list
  • Planning is split three ways — Mo writes specs, Bruno scopes and estimates, Rose writes stories. Nobody owns the resulting order
  • No single answer to "what are we shipping this week" — the roadmap holds dates that have passed, so nothing tells you current state
The encouraging reading

The roadmap is well made. It is the keeping of it that has lapsed, not the making of it.

Columns for priority, build hours, named developer, revenue opportunity and sign-off all exist — someone thought carefully about what ought to be tracked. They then stopped being filled in. That suggests the fix is a cadence and an owner rather than a new process or a new tool. Mo should confirm what actually happens each week, because what a document records and what a team does are not always the same thing.

iii
Your third question

There is a design document. It describes a different system.

No system or data-flow diagram exists. But my first answer — "we have nothing" — was wrong, and the truth is more useful to you.

What actually exists

Inside the same Everything Doc there is a full tooling and compliance table — hosting, database, backend, AI, auth, notifications, video, wearables, analytics, payments, security — each with a recommended tool and HIPAA/GDPR notes. And a 14-entity data model: User, Profile, Protocol, Comment, ScienceArticle, HealthPassport, WearableData, Subscription, AIConversation, Folder, Consultation, ShopOrder, Notification, Referral, with attributes, types and relationships.

That is closer to an architecture document than I credited. It is also, on the evidence, a design from early 2025 that was never reconciled with what got built.

The correction that matters most

The design doc specifies MongoDB and Python/FastAPI. The system that exists runs on Supabase and Postgres.

My brief repeated the doc, which is where I got it wrong. Everything the developers are actually writing says Postgres — edge functions, pg_cron, row-level security, SQL migrations. The doc's own documentation column even links to Supabase docs while the tooling column recommends FastAPI, so the drift may have started early. Around it: Flutter for mobile and web view, Stripe, Firebase Cloud Messaging and APNS, BigQuery for reporting, PostHog for analytics.

The practical consequence: the only written data model we have is MongoDB-shaped and describes a database we don't run. If you were to reason from it you would reason about the wrong system. Mo should confirm, but I would treat that part of the doc as historical.

Also worth knowing

The three-surface problem is not static — migration off WordPress and GoHighLevel into the app is an active workstream, largely owned by Vaclav. Content, subscriptions and media are being moved. So the honest framing is "mid-migration, taking a long time" rather than "three surfaces and no plan".

One more artefact you may want to ignore: the sheet also holds an MVP task list, T1 to T15 — infrastructure, auth, profiles, protocols — with every row still marked "Not Started", even though the app has been live since March and most of those things demonstrably exist. It is abandoned rather than accurate, and it is a fair illustration of the wider point: we create planning artefacts and then stop maintaining them.

iv
Your fourth question

What the team costs, all in.

From our FY26 headcount forecast. Actuals run to April 2026; from May onwards these are forecast figures, so treat them as the shape rather than this month's invoice.

PersonTitle on the booksEngagement£ / month
Rob TribianaFull Stack DeveloperContractor2,857
Bruno GiacometTechnical Product OwnerContractor · end date "Speak to MR"2,256
Vaclav Skarka"3rd Party App Tester"Via Health3 AG · end "Speak to MR"2,195
Rose Lim HonglayProject ManagerContractor1,570
Dalia RaafatFull Stack DeveloperContractor566
Kateryna ZashalovskaMobile App DevelopmentContractor · end "Speak to MR"50 → nil
Everyone building the productAll contractors≈ 9,500

Mo is the only employed person here — about £10k a month all in, split between technology and growth. We don't record the ratio.

Floor£9,500

Contractors alone — everyone who writes or ships code or design.

Realistic≈£14,500

Contractors plus half of Mo, our best guess at his technology share.

Ceiling£19,500

Everything, with all of Mo allocated to the app.

Roughly £115k–£235k a year for the entire product function. Total company payroll for context is about £90.7k a month.

Which makes your hiring question concrete

A full-time CTO at market is around £12–16k a month loaded. That isn't an addition to what we spend on product — it's close to a doubling.

It would also make that person the largest single line in the function, sitting above a build team that amounts to perhaps two people's worth of time. Which is why I'd rather have your view on shape than on salary: "hire senior leadership" and "make the people we already have actually present" are competing uses of roughly the same money.

v
Your fifth question

Contractor or employed, and how present.

You were right to ask this one, and I hadn't seen it clearly until I went and checked.

The direct answer

Mo is the only employed person. Everyone else building the app is a contractor.

Three of those contracts — Bruno, Vaclav and Kateryna — have their end date recorded in our own finance file as "Speak to MR". Vaclav is contracted through a company, Health3 AG, so he is almost certainly serving other clients.

6People on the team

Named, active, carrying features on the roadmap.

~1.5–2Full-time equivalents of build

What those six plausibly amount to, inferred from what we pay them.

The number to look at twice

Dalia is on £566 a month.

She owns the push-notification system, the web-view Rock, gamification, the BigQuery scorecard and a large part of the patient-app build. At any plausible rate that is four to six hours a week. Rose at £1,570 and Rob at £2,857 are clearly part-time too. What I cannot tell you is what share of anyone's week we actually get versus their other clients — we have never recorded it. Mo would have to answer that.

One more thing, which may bear on the ownership question

  • Mo — on the books as Head of Growth, in the Marketing team. Runs technology and commercial.
  • Rose — on the books as Project Manager, in Operations. Does design, releases and business analysis.
  • Bruno — on the books as Technical Product Owner. Does QA, validation and bug triage.
  • Vaclav — on the books as "3rd Party App Tester". Does platform engineering, migration, security and CI.
  • We have a Technical Product Owner who isn't owning the order of work, and a platform engineer filed as a tester.
What I'd most value

Less about salary, more about shape. Given the numbers above, hiring a senior technical leader and making the people we already have actually present are competing uses of roughly the same money.

I don't know which comes first. You'll have seen both go wrong. Whenever suits you for the call — I'll have Mo on it if that's useful.

Dr Tim PearceFounder · Profinity