The Compliant Healthcare Quiz Funnel: Why I Refused AI

Everyone Wanted an AI Quiz That Tells You What to Buy

Here is the pitch I get at least once a month. A founder, usually in health or wellness, wants a slick AI quiz. The user answers a few questions, the AI reads the responses, and the screen says: "You qualify for [drug]. Click here to start treatment."

For a longevity or telehealth startup, that feels like the holy grail of conversion. No friction. No human gatekeeper. The model does the qualifying and the prospect goes straight to checkout.

I built a compliant healthcare quiz funnel for exactly this kind of business. And the single best engineering decision I made was to keep the AI out of the decision entirely.

Here is why. A quiz that tells someone "you qualify for [drug]" is practicing medicine without a license. It does not matter that a model wrote it. It does not matter that you put a disclaimer at the bottom. The output is a clinical determination, and clinical determinations come from licensed providers, not from a probabilistic text generator running in a browser.

Stack on top of that the FTC's posture on health data, and a "fun AI quiz" becomes a lawsuit and a fine waiting to happen. Two companies you have heard of learned this the expensive way.

So the question this whole build came down to, and the question I want to answer here, is simple. Where exactly is the line where AI stops being helpful education and becomes advice you can be sued for? And once you know where that line is, what do you actually build instead?

Where AI Crosses Into Medical Advice You Can Be Sued For

The difference between education and a diagnosis

There is a bright line, and most founders blur it because they have never had to defend an output in front of a regulator.

Education vs Medical Advice Line

Education is fine. "Here is how this category of treatment generally works" is fine. "People with these kinds of goals often discuss these lab panels with a provider" is fine. That is content, not a clinical act.

A diagnosis is not fine. A drug recommendation is not fine. "You qualify for X" is not fine. The moment your system tells a specific person what is wrong with them or what they should take, you are practicing medicine. That requires a license your software does not have.

Why an LLM is the wrong tool for this output

Even if you wanted to walk right up to that line, an LLM is the wrong tool to do it with.

An LLM is probabilistic by design. You write a careful prompt telling it to only educate, never recommend. On most runs it behaves. But "most runs" is the problem. On run number 4,000 it phrases something as a recommendation. It hallucinates a qualifier. It implies causation you never sanctioned. You cannot guarantee what it says on any single execution, and you cannot test every possible output because the output space is effectively infinite.

"The AI said it, not us" is not a defense. You shipped it. You own it.

This is the broader pattern I use across every system I build: let the model judge the soft, fuzzy things, and let deterministic code make the decisions that move money or carry liability. The output of a healthcare quiz is about as liability-bearing as a decision gets. So it gets pure logic. No model in the loop. I wrote more about why I refused to let the LLM give medical advice here, because the instinct to use AI for this is so strong that it deserves its own argument.

What a Deterministic Goal Self-Assessment Actually Looks Like

Nine steps, plain if/then branching

The thing I actually shipped is a nine-step goal self-assessment. Every branch is hardcoded if/then logic. There is no model anywhere in the decision path.

Deterministic Quiz Architecture vs LLM

The quiz walks the user through their goals, their readiness, and the relevant history a provider will need. Each answer routes to the next question through explicit branching I wrote by hand. There is no inference, no generation, no "let me figure out what this person probably wants." It is a decision tree, and I can read every line of it.

Along the way it captures the full clinical field set the provider will need on the other side. The point is that nothing has to be re-collected later. The prospect answers once, and the data is structured and ready for the consult.

Output: a goal segment and a treatment category, never a diagnosis

The output is deliberately narrow. The quiz returns a goal segment, a set of lab panels worth discussing, and a treatment category. That is it.

Never a specific drug. Never a diagnosis. Never "you qualify."

Here is the part that matters for anyone who has been burned by a vendor. Because it is deterministic, I can read the entire branching tree, test every single path, and prove in writing exactly what the quiz can and cannot say. There are a finite number of outcomes. I can enumerate them. I can hand a compliance reviewer a document that says: these are the only thirty-one things this quiz will ever output, here is the input that produces each one, go ahead and try to break it.

You cannot do that with an LLM. You can only hope.

That auditability is the entire point. It is the same discipline behind the deterministic risk and compliance systems I build for clients in finance and regulated SaaS. When a wrong answer is expensive or dangerous, you do not want clever. You want provable.

Disclosures and the Handoff to a Licensed Provider

Every result screen in this funnel carries an explicit disclosure: this is educational, this is not medical advice. And the result states plainly that the next step is a consultation with an independent licensed provider.

The quiz routes the lead and packages all those captured clinical fields so the provider has what they need before the first conversation. But it never closes the loop itself. It does not prescribe. It does not approve. It hands off.

I want to be clear that this is a feature, not a limitation. The human, a licensed provider, makes the medical call. That is exactly how it should work, and it is the same principle behind every AI system I ship stopping for a human at the point that matters. The software does the heavy lifting of collecting and structuring. The licensed human does the judging.

There is a UX honesty payoff too. The prospect knows they are about to talk to a real clinician. They are not staring at a screen that just told them a vending machine approved them for a prescription. That builds trust instead of triggering the gut feeling that something is off.

In a category where people are already skeptical, "a real doctor reviews this next" converts better than "an algorithm says you're good to go." It feels legitimate because it is legitimate.

The Data Leak Nobody Thinks About: Opaque Tokens vs ?goal= Params

Why a human-readable URL param is a HIPAA-style leak

Here is the engineering detail buyers underestimate, and it has nothing to do with the quiz logic.

When the quiz finishes, it has to pass the selected treatment category to the intake flow. The obvious, lazy way to do that is a query parameter. Something like ?goal= followed by a sensitive health intent, right there in the URL.

That is a leak. That readable health intent now flows into referrer headers, server access logs, your analytics, and any ad pixel that fires on the page. You have just scattered a person's private health intent across half a dozen systems you do not fully control.

This is the exact failure mode that put GoodRx and BetterHelp in front of regulators. Sensitive health information ending up in places it should never have been, often through tracking that nobody on the team thought hard about. I broke down how that tracking pixel cost two health companies $9M, and the pattern is always the same: health intent leaking through a channel the team assumed was harmless.

Passing the category via an opaque server token

My fix is straightforward. The treatment category gets passed as an opaque server-side token. A meaningless string that maps to the real category only inside our own system.

The URL carries nothing readable. The logs carry nothing readable. If a referrer header leaks, it leaks gibberish. The sensitive mapping never leaves the server.

And the second decision: zero ad or analytics pixels on the result screen or the intake handoff. No Meta pixel. No Google Analytics. Nothing that fires on any screen tied to health intent. You lose some attribution data. You also lose the single most common way these cases start.

The tradeoff is not close. A slightly blurrier marketing dashboard is nothing next to a federal complaint.

When to Use Deterministic Logic Instead of an LLM

Let me generalize this so it is useful outside of telehealth.

Deterministic vs LLM Decision Checklist

The rule I use is simple. If the output carries legal, financial, or medical liability, or if you need to prove exactly what the system is allowed to say, make it deterministic. Period.

Use an LLM for the fuzzy, low-stakes, language-heavy work. Summarizing a long document. Drafting a first version of an email. Classifying free-text feedback into buckets. That is where models shine, and even then I wrap the output in deterministic guardrails so it cannot go somewhere it should not.

The mistake I see constantly is reaching for an LLM because it is impressive, when a decision tree is both safer and cheaper. AI is the expensive, unpredictable answer to a question that plain logic answers for free.

Here is the checklist I run before deciding:

• Could a regulator's question be answered by reading the code? If the answer is "we'd have to hope the model behaved," it is logic, not a model.
• Can every possible output be enumerated and tested? If you cannot list them, you cannot defend them.
• Is a wrong answer expensive or dangerous? If yes, do not gamble it on a probability distribution.

If any of those point toward "this matters," you write the logic.

And to be clear, "deterministic" does not mean dumb. The quiz I built is sophisticated. It captures a full clinical field set, segments goals, and routes leads cleanly. Deterministic just means accountable. It means I can stand behind every output because I wrote every output.

The Conversion Cost Is Smaller Than You Think

I know the objection, because it is always the next thing out of a founder's mouth. "But the AI version converts better."

Risk Tradeoff: Attribution Data vs FTC Action

I do not buy it. An honest deterministic quiz that captures the full clinical field set and hands off cleanly to a provider converts plenty. The leads arrive pre-segmented, the provider has everything they need, and the prospect's trust is intact because nobody lied to them about talking to a robot doctor.

But even if the AI version did convert a few points higher, you are comparing the wrong things. The real comparison is not "conversion versus no conversion." It is "a slightly different funnel" versus "a regulatory action, a fine, and a brand you cannot recover." One bad quarter of attribution data against an FTC complaint that follows you for years.

That math is not hard.

This is the kind of work I do for regulated businesses, where one wrong output is not a bad customer experience, it is a lawsuit. The quiz, the opaque token handoff, the no-pixel discipline, the deterministic branching, all of it designed in from day one rather than bolted on after legal panics.

If you are building anything in telehealth, longevity, or any regulated category, and someone is pitching you an AI that gives advice, that is the conversation to have before you ship. Not after the complaint lands. By then your options are expensive and few.

I would rather help you find the line before you cross it.

Want to explore what AI could do for your business?

Book a free 30-minute strategy call. No pitch deck, no sales team, just a real conversation about your operations and where AI actually fits, including where it absolutely should not go.

Book a Discovery Call