Purpose: a Product-Owner-verifiable list of business requirements for every user workflow, each with its intent (the "why"), and a check that web + apps deliver the nine capabilities from slide 7 of the deck.
As of July 2026, most of the core product is built and running on real data across both the native mobile app (Expo SDK 54) and the live web app (Cloudflare Pages, wired to the same Supabase backend). This rewrite keeps every workflow and the capability matrix, but each requirement now carries a Built? signal reflecting reality — so POs verify against what actually ships, not against a plan.
How to use: POs review each requirement, confirm the intent is right, and mark the Verify column (✅ met / ⚠️ partial / ❌ missing) per surface. The Built? column is our current honest read; the Verify column is the PO's sign-off. The companion business-requirements.csv is the tracker.
Surfaces: M = mobile app (iOS/Android), W = web app, Mk = marketing/entry, Ad = admin/MIS.
Built? legend: ✅ shipped (mobile + web unless noted) · ⚠️ partial · 📄 documented-only (design/roadmap, not built).
Intent of workflow: turn a new visitor into an activated, consented user whose cycle is set up — lawfully (C2) and on the science (C1).
The onboarding flow (Welcome → Auth → multi-step Wizard) is built and wired on both mobile and web; wizard answers persist to users and cycles. The formal, unbundled consent record layer is the remaining gap (part of Epic D).
| BR | Requirement | Intent | Surfaces | Built? | Verify |
|---|---|---|---|---|---|
| BR-1.1 | Capture cycle data (last period, avg cycle & period length) | Personalize phase model from day one [C1] | M, W | ✅ | |
| BR-1.2 | Capture goals, dietary preferences, allergies, activity level | Tailor nutrition & movement plans [C3,C4] | M, W | ✅ | |
| BR-1.3 | Capture health condition & hormonal contraceptive use | Adapt phase logic & safety for non-ovulatory users [C1] | M, W | ✅ | |
| BR-1.4 | Granular, unbundled consent before any health data is stored | Lawful processing of special-category data; refusal of optional scopes still allows core use [C2] | M, W | ⚠️ consent record layer pending | |
| BR-1.5 | Role selection (e.g. individual vs employer-invited) | Route B2C vs B2B journeys [C6,C8] | M, W | 📄 | |
| BR-1.6 | City/region selection | Localization & residency (EU launch) [C2] | M, W | ⚠️ | |
| BR-1.7 | "All set / beta welcome" confirmation | Confirm activation; reduce drop-off | M, W | ✅ | |
| BR-1.8 | No health row persists without a matching consent record | Auditable compliance [C2] | M, W | 📄 pending consent service |
Intent: every day, tell her what phase she's in and what to do — the core daily value (C1, C3, C4).
Built on both surfaces: phase ring + cycle day, week strip, the live Sync Score on the home header, and Edit-Period / Edit-Health entry points. The daily "Before we Sync" mood/energy gate shows once per day.
| BR | Requirement | Intent | Surfaces | Built? | Verify |
|---|---|---|---|---|---|
| BR-2.1 | Show current phase + cycle day with the phase ring | Orient her in her cycle at a glance [C1] | M, W | ✅ | |
| BR-2.2 | Per-phase color system (menstrual/follicular/ovulatory/luteal) | Instant, consistent phase recognition [C1] | M, W | ✅ | |
| BR-2.3 | Daily focus card: nutrition, training, wellbeing for today | Actionable cycle-synced guidance [C3] | M, W | ✅ | |
| BR-2.4 | Cycle Sync Score surfaced on home | Motivate via a single progress signal [C1,C9] | M, W | ✅ | |
| BR-2.5 | "Edit period" and "edit health" entry points | Keep the model accurate over time [C1] | M, W | ✅ | |
| BR-2.6 | AI-personalized recommendations (meals/actions) for today | Relevance beyond static content [C4] | M, W | ⚠️ rules-based MVP | |
| BR-2.7 | Week strip / quick navigation to other days | Review & plan around the cycle [C3] | M, W | ✅ |
Intent: log food and learn phase-appropriate nutrition, backed by science (C1, C3).
Built: NutriLog with per-phase tips, the Nutri Basics nutrient list and library, and Today's Meal logging (writes meal_logs). Clinical evidence-tagging of all content is a content-ops task still in progress.
| BR | Requirement | Intent | Surfaces | Built? | Verify |
|---|---|---|---|---|---|
| BR-3.1 | Daily Tip / Body Insight per phase | Educate with phase-specific science [C1] | M, W | ✅ | |
| BR-3.2 | Nutri Basics nutrient list (e.g. Salmon→Omega-3, Pumpkin Seeds→Zinc) | Concrete, phase-relevant food guidance [C3] | M, W | ✅ | |
| BR-3.3 | Nutri Basics full library ("Nurturing Essentials") with search | Reference depth; discoverability [C3] | M, W | ✅ | |
| BR-3.4 | Today's Meal logging (free text + structured) | Build the habit + data for insights [C9] | M, W | ✅ | |
| BR-3.5 | Phase-synced meal plans / recipes with macros + "why it fits" | Integrated nutrition plan, explainable [C3,C1] | M, W | ⚠️ | |
| BR-3.6 | Recommendations respect allergies/dietary prefs | Safety & personalization [C4] | M, W | ✅ | |
| BR-3.7 | All nutrition content evidence-tagged & clinically reviewed | Trust & medical credibility [C1,C7] | M, W | ⚠️ content-ops |
Intent: phase-appropriate movement guidance + logging — the "fitness" leg of integrated plans (C3).
Built: the Movement Log with per-phase tips and workout logging (writes movement_checklist). Pulling activity from wearables is documented but requires a native dev build (Epic E, roadmap 2028).
| BR | Requirement | Intent | Surfaces | Built? | Verify |
|---|---|---|---|---|---|
| BR-4.1 | Per-phase movement tips (e.g. steady-state in luteal) | Train with the cycle, not against it [C1,C3] | M, W | ✅ | |
| BR-4.2 | Log movement / workouts | Habit + data for scores [C9] | M, W | ✅ | |
| BR-4.3 | Pull activity from wearables/health apps (when connected) | Reduce manual logging; richer data [C3,C9] | M | 📄 native build needed |
Intent: show progress over time so she stays engaged and improves (C1, C9).
Built: the Cycle Alignment Score (5-component CAS in src/lib/cas.ts, 34 tests) recomputes in real time as she logs and writes daily_scores; Progress shows current/last/best, trends, per-phase averages, contributors, and mood/energy. The score formula spec is documented for clinician validation.
| BR | Requirement | Intent | Surfaces | Built? | Verify |
|---|---|---|---|---|---|
| BR-5.1 | Cycle Alignment Score: current, last cycle, best | Single measure of how well she's syncing [C1,C9] | M, W | ✅ | |
| BR-5.2 | Daily / weekly / monthly / yearly trends (charts) | See improvement; sustain motivation [C9] | M, W | ✅ | |
| BR-5.3 | Average score by phase | Pinpoint weak phases [C1] | M, W | ✅ | |
| BR-5.4 | Top positive contributors / areas to improve | Actionable feedback loop [C4,C9] | M, W | ✅ | |
| BR-5.5 | Mood Score & Energy Score tracking | Connect nutrition/cycle to felt outcomes [C1,C9] | M, W | ✅ | |
| BR-5.6 | Define & document each score's formula (inputs, range) | POs/clinicians can validate the IP [C1] | (spec) | ✅ documented |
Intent: a cycle calendar to see the past/upcoming phases and logs (C1).
Built: the phase-coloured month grid with predicted period, day detail, and edit/log period from the calendar.
| BR | Requirement | Intent | Surfaces | Built? | Verify |
|---|---|---|---|---|---|
| BR-6.1 | Cycle calendar with phases + predicted period | Plan life around the cycle [C1] | M, W | ✅ | |
| BR-6.2 | Day detail: logs (meals, movement, mood, energy) | One place to review a day [C9] | M, W | ✅ | |
| BR-6.3 | Edit period / log period from calendar | Keep predictions accurate [C1] | M, W | ✅ |
Intent: peer support & expert content — the social capability (C5) and a retention driver.
Community is documented/roadmap, not built. It remains an MVP-plus surface; nothing here is wired to live data yet.
| BR | Requirement | Intent | Surfaces | Built? | Verify |
|---|---|---|---|---|---|
| BR-7.1 | Community trending posts | Social proof & engagement [C5] | M, W | 📄 | |
| BR-7.2 | Clinically-reviewed articles feed | Credible education; SEO for entry [C1,C5] | M, W | 📄 | |
| BR-7.3 | Search topics / articles / people | Discoverability [C5] | M, W | 📄 | |
| BR-7.4 | React / save / share; comment (MVP read+react) | Lightweight participation [C5] | M, W | 📄 | |
| BR-7.5 | Community privacy controls | Safe participation [C2] | M, W | ⚠️ settings screen exists | |
| BR-7.6 | Sponsored expert content slots (labeled) | Revenue stream from the model [C6,C8] | M, W | 📄 |
Intent: bring her back at the right moments (C4, C9).
Built: a live Notification Center — a feed computed from real cycle/phase/logging state (phase tip, check-in nudge, today's score, milestones), reached via the 🔔 on the home header. A Notifications & Reminders settings screen exists. True OS push delivery and quiet-hours scheduling are the remaining pieces.
| BR | Requirement | Intent | Surfaces | Built? | Verify |
|---|---|---|---|---|---|
| BR-8.1 | Daily focus / phase-change notifications | Timely, relevant nudges [C4] | M, (W) | ⚠️ in-app feed built; OS push pending | |
| BR-8.2 | Mood & energy check-in prompts | Capture felt-state data [C9] | M | ✅ (in-app) | |
| BR-8.3 | Logging reminders (configurable) | Sustain habit without nagging [C9] | M | ⚠️ preferences UI; delivery pending | |
| BR-8.4 | Notification preferences & quiet hours | Respect the user; reduce churn [C2] | M, W | ⚠️ |
Intent: visible trust — "your data is yours" as a feature (C2).
Built: the Settings hub with Personal Information, Sign-in & Security, Data Privacy (in-app JSON export + delete account), Community Privacy, Notifications & Reminders, Choose Your Nutri, App Preferences, and Nutritional Preferences. In-app data export and delete work today. The known gaps: full auth-record deletion needs a service-role Edge Function (pending), and 2FA/passkeys are intentionally deferred. Connector-scoped erasure depends on connectors, which aren't built.
| BR | Requirement | Intent | Surfaces | Built? | Verify |
|---|---|---|---|---|---|
| BR-9.1 | View/manage/revoke all consents | User control = trust [C2] | M, W | ⚠️ consent layer pending | |
| BR-9.2 | Data export (machine-readable) | GDPR/FADP right; trust [C2] | M, W | ✅ in-app JSON export | |
| BR-9.3 | Account deletion / erasure incl. connectors | Right to be forgotten [C2] | M, W | ⚠️ in-app delete built; full auth-record deletion needs service-role Edge Function | |
| BR-9.4 | Sign-in & security (password, 2FA) | Protect sensitive data [C2] | M, W | ⚠️ password ✅; 2FA/passkeys deferred | |
| BR-9.5 | Edit cycle, goals, health, dietary settings | Keep personalization current [C1,C4] | M, W | ✅ | |
| BR-9.6 | Send feedback | Continuous improvement [C9] | M, W | ⚠️ |
Intent: convert and retain paying users; fund the business (C6).
Monetization is documented/roadmap — the value ladder and pricing are defined but billing (RevenueCat/store IAP) is not yet wired.
| BR | Requirement | Intent | Surfaces | Built? | Verify |
|---|---|---|---|---|---|
| BR-10.1 | Free vs Premium €5.99/mo feature gating | Clear value ladder [C6] | M, W | 📄 | |
| BR-10.2 | In-app purchases | Secondary revenue (€0.81/user/yr) [C6] | M, W | 📄 | |
| BR-10.3 | Manage/cancel subscription; restore purchases | Compliance & trust [C6] | M, W | 📄 | |
| BR-10.4 | Cross-platform subscription state (one entitlement) | Pay once, access everywhere [C6] | M, W | 📄 |
Intent: richer, automatic data → better scores & plans (C3, C9).
Documented only (top-8 platforms specified — see doc 09). Connectors require a native dev build, not Expo Go, so nothing here ships until that build exists; roadmap 2028 (Epic E).
| BR | Requirement | Intent | Surfaces | Built? | Verify |
|---|---|---|---|---|---|
| BR-11.1 | Connect Apple Health / Health Connect / Samsung Health | Native phone data, broadest reach [C3,C9] | M | 📄 native build needed | |
| BR-11.2 | Connect Garmin / Fitbit / Strava / Oura / Xiaomi / Huawei | Wearable & fitness ecosystems [C3,C9] | M | 📄 | |
| BR-11.3 | Just-in-time consent before each connector syncs | Lawful sync; user control [C2] | M | 📄 | |
| BR-11.4 | Disconnect purges tokens & stops sync | Revocability [C2] | M | 📄 | |
| BR-11.5 | Dedup across overlapping sources | Accurate data for scores [C9] | M | 📄 | |
| BR-11.6 | (Future) Apple Watch / Wear OS phase surfacing | On-wrist daily value [C3] | M | 📄 |
Intent: a single entry point that markets to visitors and serves the app to users (C6, C8).
Built (Epic F, DONE): one Cloudflare Pages deployment (nutrisync-collective) serves the marketing site at the root and the wired web app at /app.html, with session-aware routing (no session → login, session without cycle → onboarding, else → home). Funnel analytics / A/B is not yet instrumented.
| BR | Requirement | Intent | Surfaces | Built? | Verify |
|---|---|---|---|---|---|
| BR-12.1 | One domain: public marketing + authenticated app | Unified DTC experience [C6] | Mk, W | ✅ | |
| BR-12.2 | Session-aware entry routing (anon→marketing, user→app) | Frictionless return [C6] | Mk, W | ✅ | |
| BR-12.3 | Waitlist → onboarding handoff (no re-entry) | Convert demand [C6] | Mk, W | ⚠️ | |
| BR-12.4 | SEO-friendly marketing + article pages | Organic acquisition [C8] | Mk | ⚠️ | |
| BR-12.5 | Shared design tokens & auth across surfaces | Consistent brand & one identity [C6] | Mk, W, M | ✅ | |
| BR-12.6 | Funnel analytics & A/B | Optimize acquisition; feed MIS [C9] | Mk | 📄 |
Intent: the distribution flywheel — clinician-partnered + institutional outreach (C7, C8).
Documented/roadmap — the B2B and clinician distribution flows are not built.
| BR | Requirement | Intent | Surfaces | Built? | Verify |
|---|---|---|---|---|---|
| BR-13.1 | Employer/seat model: invite & activate eligible women | B2B revenue (€35–50/employee/yr) [C8] | W, Ad | 📄 | |
| BR-13.2 | Clinic/clinician referral & distribution flows | Clinician-partnered distribution [C7] | W, Ad | 📄 | |
| BR-13.3 | Aggregate, non-individual org reporting | Value to employer without exposing cycle data [C2,C8] | Ad | 📄 | |
| BR-13.4 | University/medical partner pilots instrumentation | Validation + credibility [C7,C9] | Ad | 📄 |
Intent: run the business on data — the insight loop (C9).
Partial (Epic G): an admin console page exists but is static/mock — not yet wired to live Supabase data.
| BR | Requirement | Intent | Surfaces | Built? | Verify |
|---|---|---|---|---|---|
| BR-14.1 | KPIs: access, signups, retention (D1/D7/D30) | Operate on facts [C9] | Ad | ⚠️ mock UI | |
| BR-14.2 | Subscriptions: free/premium, MRR, churn, conversion | Track monetization [C6,C9] | Ad | 📄 | |
| BR-14.3 | Business-case actuals vs plan (revenue/cost/profit, users) | Manage to the financial model [C9] | Ad | ⚠️ mock UI | |
| BR-14.4 | Connector & ops health | Reliability of the data loop [C9] | Ad | 📄 | |
| BR-14.5 | Content/clinical review queue | Governed, credible content [C1,C7] | Ad | 📄 | |
| BR-14.6 | RBAC + admin audit; no individual cycle data exposure | Compliance & trust [C2] | Ad | 📄 |
Intent: secure access to the pitch & data room (C8 fundraising support).
Built (Epic H, DONE): the gated hub lives in the marketing site footer under Team access (code 123456) and holds the business-case materials. The earlier Cloudflare Access email whitelist was removed to make the site public; it can be re-added via Zero Trust for a stricter, per-visitor allowlist.
| BR | Requirement | Intent | Surfaces | Built? | Verify |
|---|---|---|---|---|---|
| BR-15.1 | Full business case (problem→financials→ask) | Inform investors/advisors [C8] | W | ✅ | |
| BR-15.2 | Real access control (SSO/allowlist), not placeholder | Confidentiality [C2] | W | ⚠️ team code live; Cloudflare Access re-addable | |
| BR-15.3 | Gated document vault (deck, model, one-pager, Canva) | Controlled data room [C2] | W | ✅ | |
| BR-15.4 | Per-visitor view analytics | Track investor engagement [C9] | Ad | 📄 |
| # | Capability (slide 7) | Where it's delivered (workflows) | Mobile | Web | Status to verify |
|---|---|---|---|---|---|
| C1 | Science-backed cycle-sync framework | WF-1,2,3,4,5,6 (phase model, scores, content) | ✅ | ✅ | Built; content evidence-tagging + clinician sign-off ongoing |
| C2 | Ethical data & privacy design | WF-1,9,11,13,14,15 (consent, export/erase, RBAC) | ⚠️ | ⚠️ | Export + in-app delete + RLS done; consent service + full auth-record deletion pending |
| C3 | Integrated cycle, nutrition & fitness plans | WF-2,3,4,11 (NutriLog + MovementLog + plans) | ✅ | ✅ | Core built; wearable enrichment is roadmap (native build) |
| C4 | AI personalization | WF-2,3,5,8 (recommendations, contributors) | ⚠️ | ⚠️ | Rules-based MVP live; richer AI later |
| C5 | Social & community features | WF-7 | 📄 | 📄 | Community not built (roadmap) |
| C6 | Direct-to-consumer | WF-10,12 (subscription, unified web entry) | ⚠️ | ⚠️ | Unified web entry DONE; billing (RevenueCat/IAP) to build |
| C7 | Clinician-partnered distribution | WF-3,13,14 (clinical review, clinic referrals) | 📄 | 📄 | Clinic flows + review queue to build |
| C8 | Institutional ATL outreach | WF-12,13,15 (SEO, B2B seats, investor site) | – | ⚠️ | Investor hub DONE; B2B/admin + SEO to build |
| C9 | TTL data & insight loop | WF-3,4,5,8,12,14 (logging → scores → MIS) | ⚠️ | ⚠️ | Logging → CAS → daily_scores live; admin MIS is mock-only |
Reading the matrix: the daily-value spine of the product — cycle home, NutriLog, MovementLog, Progress/CAS, Calendar, Notification Center, the unified web entry, and the gated investor hub — is shipped on live data across mobile and web. The remaining work is concentrated in three areas: the privacy/consent completion (Epic D), monetization and B2B/admin surfaces, and the wearable connectors (which need a native build). The "Status to verify" column is where POs focus — turning a designed or partial capability into a fully delivered one.
/app.html) and an installed mobile build, then mark Verify per surface (✅/⚠️/❌) in business-requirements.csv.backlog.csv) so it's scheduled.