A system built to make sure nobody is forgotten could very easily become a system that will not leave anyone alone. We take this seriously.
Why it matters
There is a distinction we think is important and have not yet made precise:
The system may have a responsibility not to forget a person, while the person keeps every right to decline or disengage from any particular intervention.
Holding both halves of that at once is the hard part.
The questions inside the question
- What exactly can someone decline? Everything? A specific screening? All contact?
- How should a decline affect what happens next, if at all?
- Is there any circumstance where something should be compulsory? Communicable disease is a genuinely different case from chronic disease, and we should say why.
- How is a decline represented so that it does not read as failure, non-compliance, or a problem to be solved?
- If a person declines something repeatedly, at what point does continuing to ask become harassment?
Where our thinking currently sits
Some things we are fairly confident about. Declining must be a first-class outcome, not an error state. Disagreement is not non-compliance. The system should know when to leave a healthy person alone. Not every recommendation deserves to become a high priority.
The structural risk we are watching
Once something is a record with a status and an accountable party attached, it starts behaving like a compliance artefact whatever we intended. The gap between "the system thinks this needs attention" and "this person is non-compliant" is uncomfortably small.
We think declining needs to be a proper terminal state with the same standing as completion, rather than an exception path. We have not designed that yet.
Help us with this
Privacy researchers, medical ethicists, and anyone who has watched a well-meaning system become coercive in practice: please tell us what we are not seeing.