Health plan benefits at your fingertips.
Aurea is the app, and Sage is the AI agent inside it. I built an employer benefits app designed to let users browse their benefits with the ease of online shopping. I used Figma to design the screens, while Claude helped me publish the live web app. The native iOS build is available on the App Store as of September 2026.
Health benefits apps tend to feel cold and clinical
I took a look at a few benefits apps and noticed they are organized correctly, yet read like a clinical directory. Dense text, little-to-no hierarchy, and no place to define what benefit terms mean. This caused friction for users. For five years as a Care Advocate I saw this firsthand through the user’s experience. Just a few questions could cost a user and a Care Advocate 15 to 30 minutes for something that should be instantly accessible.
The brief: keep what the app does, rebuild everything else around an App Store shopping pattern, by leading with images that have one clear action per screen. The source material was real, a hand-drawn sitemap of 90+ benefits from an actual carrier plan, a journey map, reference screens. Constraints: solo build, no brand to start from, no actual user data. One category people avoid: AI care assistants barely have 15% engagement, only 4% of Americans can define “deductible”, “copay”, “coinsurance” and “out-of-pocket max”, and 60% are uneasy with AI involvement in their care.
Eight decisions shaped the build.
A data model, not ninety screens.
90+ benefits across 8 hubs, each priced differently per plan. Build them as one-off screens and it never survives a second employer. So I split the benefit definitions (a shared catalog) from the per-employer parts (cost, eligibility), and built five templates that read from that model: hub, shelf, benefit card, program card, detail. Adding an employer became configuration, not design, and that is what let the system stretch across three breakpoints and three platforms without redrawing anything.
Image-led over text-led, and knowing where that stops.
A vendor's logo already says its name, so repeating it in text below made the grid read as a directory. I dropped the name from program cards and widened the logo band. Then came a note to strip redundant text everywhere. I checked first: benefit cards use generic icons, not logos, so there the name is the only label, not a duplicate, and removing it would have left nothing. “Redundant” is a property of the component, not of the instruction.
Write the constraint layer before the happy path.
In healthcare, what the agent must never do matters more than what it does. I wrote the hard rules first: no clinical advice, exact dollars only for copays, coinsurance sent to a real estimate, an explicit 911 list, abuse and bereavement handling. Every flow inherited safety instead of bolting it on. Testing it live caught the agent quoting out-of-network coinsurance against the in-network deductible, understating a member's exposure by thousands, the exact surprise bill this exists to prevent. In-network and out-of-network now never mix, enforced in code, not the prompt.
A guided greeting, not a search bar.
A blank input tells an anxious member nothing. Sage opens by naming the member and their plan, offers the human handoff before the first question, and gives four tappable starters for the core tasks. The free-text field is still there. Each chat is bound to one member and their real plan document, so it answers like it knows you and cannot leak another plan's numbers, because it never receives them.
Trust the source document over the summary of it.
Sage told a member their specialist copay was $60; the app's own benefit page said $50. I followed that one number and found four different answers. The cause was not a bug: the cost layer had never been pulled from any document. I had invented the first plan's numbers to make screens look real, then scaled them across eleven more, which spread the guess and gave it the shape of a system. All twelve plans disagreed with their own plan description. The worst was not a copay but an out-of-pocket maximum showing $3,200 against a real $7,900, half the true exposure. I re-grounded all twelve, 612 benefit entries, each tagged with the document its number came from. Two traps nearly shipped silently: the two documents state cost sharing from opposite sides in identical wording, so reading them the same way inverts every coinsurance figure; and the summary packs mental-health costs into one cell, so reading only the first clause quotes a flat copay for testing the plan actually prices at coinsurance.
A third surface on the same backend, not a second product with the same colours.
Figma and the web app both looked right, but neither proves a design system survives a native platform's own rules. I built Aurea as a real SwiftUI app pointed at the same API the web build calls, and ported every token 1:1. A native rebuild with its own content is just a second product in the same colours; sharing the backend makes one system across three surfaces a fact, so a taxonomy fix reaches web and native from one edit. It also surfaced problems the web never faced, like an iPadOS bug that renders a pushed screen's back button as a stray circle off the tab bar.
Design the vendors rather than borrow them.
The app shipped with a real carrier's mark and eight real vendor logos, because that made it read like a product, not a mockup. My disclosure already disclaimed affiliation, which is what impersonation rules care about. Then App Store Connect asked something else: attest that you hold the rights to third-party content. Nine copyrighted logos were in the binary and I held no licence for any of them. A disclaimer disclaims affiliation; it does not license artwork. So I designed the vendor set instead, each a plausible peer in the same category, and deliberately not a near-miss of a real name. The screens read just as convincingly, which is the point: the realism came from the information design, not borrowed logos. The coverage numbers did not change, because published plan terms are facts in a way logo artwork is not.
Let the App Store submission audit the product.
Preparing the first submission meant reading the app the way a reviewer would, not the way its author does. Seven buttons did nothing, including all three “Ask Sage about this” buttons, the most important interaction in a project about an AI navigator. Six tinted squares sat empty where icons belong. Messages quoted an invented provider and a claim that did not exist, frozen from a member who had stopped being the default months earlier. In dark mode the profile switcher was near-black text on a dark list. All of it had been visible for weeks and invisible to me, because I kept opening the same screens on the same device in the same appearance. The one that would have cost a rejection was not a screen: my reviewer notes promise no login, but a flaky cold start left the app on a login screen with no way past it. Reviewer notes are part of the product, and only a full dress rehearsal catches that.
Three surfaces, one system.
One backend, three real clients: a live web app, a native SwiftUI iOS app, and the Figma file the other two stay in sync with. Every screen exists at mobile, tablet and desktop as real reflows, not scaled frames, and a re-audit across all three found and closed seven gaps a prior “no gaps” note had missed. Search matches conditions and treatments, not benefit names, so “CBT” surfaces the therapy visit, the psychiatrist visit and two programs, backed by filling the benefit taxonomy across all eight hubs first.
Same question, two correct and plan-specific answers. The agent isn’t retrieving a generic definition, it’s reading this member’s plan and answering for them.
Status, August 2026: submitted to the App Store, version 1.0, build 6, in review. One disclosure now reads the same across the app, the web app, the privacy policy, the store listing and Figma: the people, claims, providers and conversations are fictional; the coverage terms come from real published plan documents under an invented carrier name; none of it describes a plan you can buy. The precision matters, because the lazy version, “all the data is fake,” hid the most interesting true thing about the project.
Built to a checkable bar, not a metrics claim.
Real, deployed, reachable on three surfaces. A token-level design system verified to WCAG 2.1 AA with computed contrast, not eyeballed. Five templates covering 90+ benefits through configuration. Twelve demo profiles with plan-accurate data, and a cost layer that went from twelve of twelve plans wrong to none. Success metrics are defined, ready for V2 usability testing:
Self-service resolution
Share of conversations resolved without a human handoff.
Time-to-answer
From question to actionable information.
Plain-language comprehension
Whether members can correctly restate what they were told.
Handoff trust
Member-reported confidence in the handoff itself.
“Invented data quietly acquires the shape and confidence of real data, and then nobody thinks to re-derive it.”
The split between shared benefit definitions and per-employer cost is still the right architecture. But I filled that cost layer with invented numbers and scaled them across eleven more plans, and scaling made the guess look systematic, which made it harder to notice, not easier. For months the one part that answered from nothing was the part carrying the numbers the whole product promises are the member's own. A data review didn't catch it; following one reported copay backwards until it stopped matching a document did. The submission taught the same lesson: everything that audit found had been visible for weeks, and I missed it by opening the same screens on the same device in the same appearance. Writing the rules first was the highest-leverage decision. Exercising the behaviour instead of authoring it proved the rest.
Try the web app →