How Baseline decides what to tell you — and when to stay quiet.
Every number and every claim in Baseline is produced by deterministic statistical code running on your iPhone. No cloud model, no black box. One optional surface is worded differently: if you turn on “On-device AI” in Settings (it is off by default), the daily score’s one-line explanation can be phrased by Apple’s on-device language model. It phrases; it does not decide. The numbers still come from the statistical code, the output is length-capped and checked against the same banned-vocabulary lists before it is shown, and when the model is unavailable a deterministic template renders instead. Neither path touches the network. This page publishes the methods, the thresholds, and the claims we refuse to make, so you can hold us to them. When the methods change, this page changes — the changelog is at the bottom.
What Baseline refuses to claim
- No causes. Baseline says “moved together,” “appeared alongside,” “was followed by” — never “causes,” “leads to,” or “because of.” Observational data from one person cannot establish causation, so the vocabulary is banned in code, not just in style guidance.
- No diagnoses. Words like “insomnia,” “condition,” or “disorder” are on a hard block list. Baseline describes your numbers against your own history; it does not interpret them medically.
- No predictions. “You will,” “expect,” “next time” are blocked. When Baseline shows your past episodes, it reports what happened before — it does not promise what happens next.
These block lists are enforced twice. Sentences the app generates — analysis prose and the optional AI phrasing — are validated at render time, and a sentence that trips a rule is not shown. The app’s fixed copy is held to the same lists by automated tests that run before every release.
The tests we run
- Welch’s t-test — comparing two windows of a metric without assuming equal variances (Satterthwaite degrees of freedom).
- Mann-Whitney U — rank-based comparison when distributions are skewed, with tie correction.
- Spearman rank correlation — “moved together” relationships, robust to outliers.
- Benjamini-Hochberg correction — when many metric pairs are tested at once, p-values are corrected for multiple testing at a false-discovery rate of q = 0.05. This is what separates “we found a pattern” from fishing.
- CUSUM change-point detection — sustained-shift detection for episodes, resistant to one-day spikes by design.
- Bootstrap confidence intervals — uncertainty bands from 600 resamples (90% coverage), with permutation p-values when samples are small. Experiment verdicts use seeded resampling so the same data always produces the same verdict.
- Autocorrelation is discounted, not ignored. Day-to-day wearable values are correlated — seven days of readings carry less information than seven independent samples. Experiment tests and their uncertainty bands apply an effective-sample-size adjustment for that, which widens the bands and raises the bar for a verdict. Treating correlated days as independent is the easiest way to manufacture confidence; we do not.
- Robust statistics throughout — medians, IQR, and MAD-based z-scores instead of means and standard deviations, so a single bad reading does not move your baseline.
The thresholds that keep us quiet
Most of Baseline’s discipline is in what it does not surface. The exact gates:
Two kinds of numbers appear below. Personal-relative gates compare you to your own history — percentiles, IQR multiples, percent changes — and need no outside reference, because the baseline is you. The few absolute numbers that invoke an external standard are cited where they appear. Everything else is a gate we set deliberately high to keep the app quiet — tuned so Baseline stays silent unless a change is large and persistent, not calibrated to any population norm. The exact numbers behind a claim are not a secret from the person it concerns: every insight carries an in-app evidence ledger (supports / weakens / can’t conclude, with sample sizes), and headline insights additionally show the exact rule they fired on — the observed values and the threshold — right on the claim itself.
- Baselines need minimum history. Every comparison window has a minimum number of observed days below which it is simply not computed — longer windows require more history. No comparison is ever shown from a handful of readings.
- Episodes need two metrics and sustained movement. An episode requires at least 2 metrics shifting together, detected by change-point analysis against a 90-day baseline and clamped so a single day’s spike can never trigger it on its own. Episodes longer than 21 days are not claimed as episodes.
- A pattern needs to recur. One episode is an episode. It only becomes a recurring pattern after repeated occurrences with the same signal signature.
- Early signals need at least 3 episodes. “X moved first” is only claimed when you have 3 or more qualifying historical episodes AND a majority of them agree on the first mover.
- Weak data caps the claim. Every metric carries a reliability label. “Reliable” requires both high day coverage and a data-quality floor; sparse or low-coverage metrics are marked “Limited” and cannot lead an insight. Sleep based on iPhone in-bed time instead of validated stages is labeled as such.
- Experiments need 5 days per window and p < 0.10. A 7-day experiment verdict requires at least 5 observed days in both the baseline and experiment windows, with the test and its uncertainty band computed on autocorrelation-discounted effective sample sizes (above). “Clear signal” requires an effect size of at least 0.5 standard deviations — Cohen’s d ≥ 0.5, his “medium” effect (Cohen, 1988) — AND the 90% confidence interval to clear zero by a margin of at least one third of its own width. A band that barely excludes zero is not a clear signal; on one-week windows that pattern shows up on pure noise, so we require clearance, not a graze. The p < 0.10 / 90% bar is deliberately looser than the textbook 0.05 / 95%: a one-week experiment on a single person carries little data, and we would rather label a real change “weak signal” than miss it. Anything short of the bar is reported as weak or inconclusive, in those words.
- Skin-temperature deviation is a chosen cutoff, not a diagnosis. When a wearable reports overnight skin temperature ≥0.5 °C from your own baseline for at least two consecutive nights, Baseline surfaces it. The 0.5 °C bar and the two-night requirement are set deliberately: a single warm night (a cold pillow, a late workout, a glass of wine) should never trigger it, and the deviation is measured against your own baseline rather than a population norm. It is a conservative wellness signal by design — Baseline makes no illness or diagnostic claim from it. Needs ≥14 nights of temperature data.
- Glucose time-in-range uses a published target. For CGM users, “time in range” is the share of readings between 70 and 180 mg/dL — the general-population target from the international Time-in-Range consensus (Battelino et al., Diabetes Care, 2019). Baseline surfaces a day only when your time-in-range moves ≥10 percentage points from your own 90-day median, and notes that if your clinician uses a different target, the reading is informational only. Needs ≥21 days of glucose data.
- Your feedback retires claims. Mark a claim “felt wrong” and its stable fingerprint is suppressed in future reports. A claim that keeps appearing for 3 report windows is flagged as persistent rather than re-announced as new.
With the cited exceptions above, none of these numbers is a medical cutoff or a population norm. Each is a gate we tuned for restraint — the question behind every one was “how do we avoid crying wolf,” not “how do we sound certain.” When a gate changes, it changes here.
Verify the privacy claim yourself
“Nothing leaves your iPhone” is a checkable claim, not a slogan. Two checks you can run yourself, on the phone in your hand, and one we run for you:
- Ask iOS. Turn on App Privacy Report (Settings → Privacy & Security → App Privacy Report) and use Baseline for a few days. Apple’s own ledger lists every domain each app contacts. Baseline’s network activity stays empty — not short, empty.
- Cut the network. Use Baseline in Airplane Mode with Wi-Fi off. Every feature behaves identically, from first launch on, because nothing in the app ever waits on a server.
- The configuration and the release gate. The app’s Info.plist sets App Transport Security to deny all outbound HTTP and HTTPS — every loosening key explicitly false, no exception domains, local networking denied. On top of that, every release is blocked by an automated scan of the built app and widget binaries for networking symbols — URLSession, NSURLConnection, CFNetwork, Network.framework, and BSD socket calls — and the build fails if any appear. Technically inclined readers with a copy of the app binary can reproduce that check with standard tools such as nm.
- The App Store privacy label says “Data Not Collected” because nothing is collected — there is no server to send it to.
- Optional diagnostics (off by default) are stored on-device only and leave the phone only if you export the file yourself.