OpenAI's ChatGPT Health puts a walled-off product inside an existing app

A space, not a separate app

ChatGPT Health is introduced as "a dedicated experience" that "lives in its own space within ChatGPT." You reach it by selecting 'Health' from the sidebar menu. That framing matters: OpenAI didn't ship a separate health app, and it didn't just add a health mode to the existing chat surface. It carved out a compartment inside the product people already use.

The compartment is defined by where data is stored, not just what the interface looks like. Conversations, connected apps, and files in Health are "stored separately from your other chats," and Health has "separate memories." The announcement even describes a nudge across the boundary: "If you start a health-related conversation in ChatGPT, we'll suggest moving into Health."

So the same chat text box behaves differently depending on which side of the wall you're on. The frontend is doing the work of signaling and enforcing a data boundary that users can't see directly.

The memory rule is deliberately one-way

The most specific design decision in the announcement is the asymmetry of context flow. Health can reach out: "When helpful, ChatGPT may use context from your non-Health chats—like a recent move or lifestyle change—to make a health conversation more relevant." But nothing comes back the other way.

Health information and memories never flow back into your non-Health chats, and conversations outside of Health can't access files, conversations, or memories created within Health.Montana Labs

This is a one-directional membrane. General context improves health answers, but health data can't leak into your ordinary chats. OpenAI also gives users a place to inspect and undo it: Health memories can be viewed or deleted "within Health or the 'Personalization' section of Settings." Custom instructions are scoped to the space too—they "only apply to Health chats," including instructions to "avoid mentioning sensitive topics."

A curated connector list, gated per space

The grounding story runs through connectors: medical records via b.well (US only), Apple Health (iOS required), plus Function, MyFitnessPal, Weight Watchers, AllTrails, Instacart, and Peloton. You invoke them the way you'd expect in a chat UI—"start your question with it, select it from tools (+)," or accept a suggestion.

The consent model is where the frontend gets strict. Apps "may only be connected to your health data with your explicit permission, even if they're already connected to ChatGPT for conversations outside of Health." A connection you granted in the main product does not carry into Health. Every app in Health must pass "additional security review specific to inclusion in Health," and disconnecting one means it "immediately loses access."

That means the connector picker inside Health is a different list, with different permissions, from the connector picker elsewhere in the same app—even for identical integrations.

The design bet: a boundary users can trust without seeing it

Everything distinctive here—the separate sidebar entry, the one-way memory flow, the per-space custom instructions, the re-authorized connectors—exists to make a promise legible in the interface: this compartment is treated differently. The claim that "conversations in Health are not used to train our foundation models" is a policy statement, but the space is the thing users actually touch.

The hard part of shipping this isn't the model. It's building a bounded surface inside a general-purpose one and making the boundary obvious enough that people believe it. When context crosses in but never crosses out, and when a familiar app has to be re-permissioned to enter, the frontend is carrying the weight of the privacy commitment. For teams building sensitive features inside existing products, that's the pattern worth studying: the compartment, its asymmetric flows, and its per-space controls are the product, not decoration on top of it.