Trust
Every claim on this site, and how to check it
We would rather be checkable than impressive. Each claim below is either enforced by something that runs on every release, or countable from the source.
Nothing you type into a calculator is transmitted
The scoring engine ships to your browser and runs there. What you enter stays in the page and is never put into the address bar, so nothing on the page can read it back out. Pressing Copy link on a calculator builds a shareable link carrying the entered values at that moment, and only then; opening one restores the form and immediately clears the values from the address bar again. This is the one guarantee the whole platform is built around, so it is enforced by architecture and not by policy.
How it is checked: A test fills a calculator with the network disabled, asserts the result is still correct, and fails the build if any request carries data. A second scan fails the build if any file under the calculator routes reads the query string or declares a server action.
25 calculators, 151 citations, none of them decorative
Every score names the publication it comes from, and gives you a way to look it up. Where a value in a score has no published source — or had one that is no longer retrievable — it is marked [NEEDS SOURCE] in the limitations rather than quietly presented as evidence.
How it is checked: Both figures are counted from the score definitions at build time. The build fails if any score carries a reference without at least one locator — a PMID, a DOI or a URL. It checks that a locator is present, not that it still resolves: that would need a live network call, and the test suite is deliberately offline. Locators are re-checked by hand, and a source that has gone missing is said to have gone missing rather than left as a dead link.
The engine cannot merge below full test coverage
Each score is tested against worked examples reproduced from its own source publication, so the tests check agreement with the literature rather than agreement with our implementation.
How it is checked: The coverage gate is set to 100% for lines, branches, functions and statements. It runs in CI, and a pull request that drops below it does not merge.
Clinical validation is pending, and the badges say so
Every calculator carries two reviewer slots. Today they read independent clinical validation: pending, and they will keep saying that until real clinicians have reviewed them. Hiding an empty slot would be the easy choice; showing it is the honest one, because it tells you exactly how much human review stands behind a number.
How it is checked: The validation state lives in each score's definition and is rendered on its page. Nothing shows a reviewer's name until one is recorded.
Accessibility is asserted, not assumed
The target is WCAG 2.2 AA. It is checked mechanically because the alternative is checking it once and hoping: an earlier release shipped a border at 1.056:1 (visually absent), while a hand-maintained test passed, because it was asserting a colour the interface was not actually using.
How it is checked: Colour contrast is computed from the shipped stylesheet in a unit test (every border token against every surface), and layout is checked at 375, 768 and 1440 pixels on every page. Reduced-motion behaviour is tested too.
Where your data is, stated precisely
Anything the platform stores (a pilot request, a message you send us) is stored in Saudi Arabia. Requests travel through a global delivery network before reaching those servers, so while your data is stored in the Kingdom, the request carrying it may be processed outside it in transit. Calculators are unaffected: they transmit nothing, so there is nothing to route.
One thing leaves deliberately, and it is not about you: when something arrives, our own team is emailed a notification through a relay outside the Kingdom. That message says only which kind of enquiry arrived and links to it. It carries no name, no address and none of what you wrote. We do not email you back automatically at all. Any reply comes from a person.
How it is checked: The database runs in Oracle Cloud's Riyadh region, and requests now reach it directly through a load balancer in that same region. The content-delivery network that used to sit in front is out of the path. Email still leaves, and that is disclosed rather than glossed.
Backups exist and the restore has been rehearsed
A backup nobody has restored is a hypothesis. The audit log is additionally append-only at the database level: the application’s own role has UPDATE and DELETE revoked on it, so even a complete compromise of the application cannot rewrite its history.
How it is checked: Nightly encrypted dumps to in-region object storage, and a restore drill that was actually performed: dump restored into a scratch database, table and row counts matched, admin record intact.