Synth: Manufacturing Trustworthy Patients — How an Agent Crew Makes Privacy-Safe Healthcare Data on Demand

Every healthcare AI team hits the same wall, and it is a strange one: the data they need most is the data they are least allowed to touch.

You want to train a model to spot a fall risk in a frail 88-year-old, or benchmark a care-coordination protocol across a long-term-care population, or validate a clinical decision support tool before it ever sees a real chart. To do any of that well you need patients — real-looking ones, with real diagnoses, real medication counts, real frailty, real 28-day care journeys. And those patients are exactly the records that privacy law, ethics boards, and common decency keep under lock and key.

So the project stalls. The team waits months for data-access approval, or it quietly trains on data it cannot legally share, or it gives up and uses a toy dataset that looks nothing like a real ward. The data you need most is the data you can't have. That is the wall.

Synth — the Nightingale Synthetic-Data Engine — is built to walk through it. What if you could conjure a whole long-term-care population — older adults, their case managers, their FHIR records, their 28-day journeys — that behaves like the real thing but contains zero real patients?

Synthetic data is easy. Trustworthy synthetic data is the hard part.

Anyone can fabricate a spreadsheet of fake patients. The trap is that fake data is only useful if you can trust it, and trust has at least four faces:

• Plausibility. Would a clinician believe this record? An 84-year-old with Type 2 diabetes (ICD-10 E11), hypertension (I10), and a history of falls (Z91.81) is plausible. A 19-year-old with end-stage everything is not.
• Fairness. If your synthetic cohort is systematically rosier for one demographic than another, you have manufactured a bias and called it data.
• Privacy. "Synthetic" has to actually mean it — no real person should be re-identifiable from the output, even by accident.
• Provenance. Six months later, when a reviewer asks how this dataset was made, "we ran a script once" is not an answer. Every record needs a traceable lineage.

A synthetic-data tool that ignores those four is a random-number generator with a clinical vocabulary. Synth's entire design is about earning the trust instead of asserting it.

A pipeline that runs as an agent crew

Synth's design intent is to run its pipeline not as a monolithic script but as a governed agent crew — and that is where Agents-as-a-Service comes in. The framing is deliberately plain: an agent crew runs the pipeline, and the crew is built to run as Agents-as-a-Service on Nexus, so every dataset stays governed and auditable. Today the orchestration is done with CrewAI; Nexus is the stated deployment target — the "built to run as," not a "already shipped there." Mapped honestly, four stages line up with four AaaS primitives:

1 · Routing. A Facilitator agent routes work across the pipeline. (CrewAI orchestrates this today; routing-as-a-service on Nexus is the intended host.)

2 · The agent roster — which is the product. A Generator seeds a FHIR R4 cohort into the Bronze layer. Then an agentic care team — a Case Manager, a Physician, a Patient, and a Welfare actor — simulates a 28-day journey. Per the engine's architecture, that simulation is a SimPy + CrewAI hybrid: SimPy runs the event queue and the simulation clock while CrewAI drives the agents, each calling a LangChain tools registry with seeded RNG. A separate Patient / TRiSM Judge (LLM-as-judge) then scores the result.

3 · Memory. Reproducibility is engineered, not hoped for: seeded RNG plus content-addressed decision caching targets the same-seed-same-run guarantee, and a Replay mode that requires cache hits and fails fast on a miss — which is exactly what golden-run regression tests need.

4 · Governance. This is the part most synthetic-data tools skip. Synth's data plane is a real medallion: Bronze is append-only raw events (Apache Iceberg), Silver is normalized features and patient states (PostgreSQL), Gold is materialized analytics. Promotion between layers is TRiSM-gated — Trust, Risk, Security, Management — and the gate refuses to promote data that fails fairness, privacy, utility, or provenance. Every artifact carries lineage metadata, so a dataset is auditable by construction.

That is the whole bet: routing, the agent roster, memory, and the governance gate become auditable primitives rather than hard-coded steps buried in a script. That is what Agents-as-a-Service actually buys here — governance and auditability — not a claim that Synth is running in production on Nexus today.

Walk the pipeline yourself

Below is a faithful, in-browser walk through those four stages on fully synthetic long-term-care data. Pick a seed, choose a cohort size, and step through Generate → Simulate → Judge → Promote. Same seed, same run — every time.

What you're looking at: Generate builds a Bronze cohort of synthetic residents — real ICD-10 codes (E11, I10, F06.7 mild cognitive impairment, I50.9 heart failure), a Katz ADL score, a Clinical Frailty Scale, a derived care setting. Simulate walks one resident across a 28-day horizon, each weekly tick emitting a FHIR resource from a color-coded actor (Encounter, Observation, CarePlan, ServiceRequest). Judge computes a TRiSM scorecard — fairness, provenance, privacy (k-anonymity and re-identification risk), utility — into a weighted composite. Promote runs the medallion gate: PASS promotes Bronze → Silver; HOLD keeps it in Bronze.

The gate is not a rubber stamp

Here is the detail that makes the demo honest. In the scorecard, the fairness floor is deliberately set just below the 0.80 promotion gate. The consequence is that roughly 1 in 5 seeds genuinely HOLD — the gate looks at the cohort, finds the fairness variance too wide, and refuses to promote it to Silver. It stays in Bronze.

Change the seed in the demo and you can watch it happen. At the default cohort size, ltc-42 passes; type ltc-1 and watch a cohort get turned back — its fairness lands at 0.78, just under the 0.80 floor. (The demo always suggests a seed that genuinely flips the result at your current cohort size, because the gate depends on both.) A governance gate that always says yes is just decoration. This one says no often enough to mean something — and that refusal is the point. (In the production engine, the target is a fairness variance under 0.05 across demographics, with privacy and security gates landing in a later sprint.)

What is actually built — and what isn't

It would be easy to dress this up as a shipped clinical product. It isn't one, and saying so plainly matters more than the pitch.

Synth is research-stage, mid-build. The engine's privacy posture is explicit: fully synthetic, no PHI in development. Every record you generate above is fabricated by a seeded PRNG in your own browser. The ICD-10 codes are real codes; no real patient carries them. There are no named providers, no real charts, and no deployed clinical system anywhere in this article or in the demo.

The figures in the visualization are honest about themselves too. The TRiSM scores are computed in-browser, on the synthetic cohort — they are illustrative. There is no SimPy clock running, no LLM being called, no network request leaving the page. The production engine — SimPy plus the agentic care team, real FHIR R4 / ILCore conformance with Hebrew localization and Kupot Cholim insurance, and real TRiSM judges — is mid-build and lives outside this site.

And the internal status is itself actively evolving, so we'll say it straight rather than smooth it over: a repo README stub still reads "Sprint 0 closed," the PRD describes the current work around Sprint 3 with the full fairness/privacy/security judges landing in Sprint 6, and the workspace notes say Sprint 5. Read that as a project in motion — actively-evolving research — not as a finished, generally-available product. The Agents-as-a-Service deployment on Nexus is the intended host for the crew; CrewAI is the orchestrator doing the work today.

The payoff is structural

Strip away the framing and what's left is a single, useful inversion: turn "we can't get the data" into "pick a seed and generate a governed, lifelike cohort — in your browser, or in your pipeline."

• Realistic, privacy-safe data on demand. A frail long-term-care population, FHIR-shaped, with zero real patients behind it.
• Reproducible by construction. Same seed and cache, same run — so a result is something you can replay, not something you got lucky with once.
• Trust you can audit. A medallion gate that genuinely refuses to promote unfair or untraceable data, with lineage on every artifact.

The data you need most has always been the data you can't touch. Synth's answer is to manufacture a trustworthy version of it — lifelike patients, zero real ones, and a gate that means it.

---

SynaptixLabs · the harness above the vendors. Synth is research-stage; synthetic data only, no PHI.