Memory Is a Safety Feature: Typed Memory for Health AI Agents

Health assistants built on language models increasingly remember what users tell them, yet their memory is rarely designed for safety and almost never evaluated on real users. Only 5% of health language-model studies use real patient data, and in an audit of real ChatGPT users, 96% of memories were created without the user asking. We test whether memory designed around explicit guarantees, with safety-critical rules enforced in code, makes a deployed health assistant more useful and safer. Typed memory was built into a pet-health assistant used by 2,026 registered owners in India and the United States, and evaluated in eight studies on real production data: randomly drawn owner messages; real messages that tempt a memory to store what it must not; real changes of fact replayed through memory; a controlled twin experiment in which the same real message reached two pets differing only in memory, judged blind in both answer orders; a blinded veterinarian review; and complete audits of production memory and alerts. Memory captured 89% of the facts owners stated and stored 0 of 54 forbidden items. With memory, replies were preferred in 73% of cases (p < 0.001), replies judged less safe fell by 80%, and replies never re-asked what the owner had already said. A blinded veterinarian also preferred replies with memory. Memory added no false alarms, applied 90% of real changes of fact, and 95% of production alerts warranted the owner's attention. Across all 5,153 values in production memory, not one listed drug name appeared. In a deployed health assistant, memory designed around explicit guarantees was both more useful and safer than no memory, and its safety-critical rules held across the full production record. Memory should be treated as a safety feature of health agents, and designed before the model is chosen.