Why the US consumer needs a context vault

By 2030 an agent booking a doctor in New York, hiring a cleaner in Austin, or buying groceries in Seattle will need context from its user: allergies, ZIP, preferred doctor gender, dietary restrictions, budget, payment preference, calendar availability. Today that context is strewn across dozens of apps, each with its own privacy policy. The consumer has no one place to say “share X with agent Y for purpose Z, for 24 hours.”

GeraMind US is the proposed answer: a vault the consumer owns, hosted under US data residency where elected, with consent scopes that agents can query. The agent never sees the raw data; it issues a purpose-bound query; the vault returns only what the purpose requires.

How US privacy law shapes the design

CPRA ADMT rules (California): consumers have rights over automated decisions. Vault queries log what was shared, with whom, for what.
VCDPA, CPA, CTDPA, UCPA, TDPSA, OCPA, and peers: right to access, delete, correct. Vault exposes these as a single panel.
HIPAA: PHI lives in a separate HIPAA-compartment vault when applicable; Business Associate Agreements with any agent accessing it.
GLBA: financial institution data is handled under Safeguards Rule equivalents.
COPPA: under-13 vaults require parental consent and restricted scopes.
Proposed federal APRA: if adopted, would create a national floor; the vault is architected to absorb it.
State DELETE Act (California): vault integrates with single-deletion mechanisms.

The protocol sketch, US lens

Scopes are purpose-bound, not permission-bound. “Can read delivery address for this one GeraEats order on 2026-04-21” ≠ “can read all addresses forever.” Audit records are consumer-accessible under CPRA-style right-to-know and retained per data-minimisation principles. Identity binding uses NIST Digital Identity Guidelines (SP 800-63) where appropriate.

Competitors and fellow travellers

Apple Data Vault / Apple Privacy — strong but Apple-ecosystem locked
Solid / Inrupt (Tim Berners-Lee's project) — pod-based, open but early
ChatGPT Memory / Claude Projects / Gemini Memory — model-specific memory, not portable
MCP memory servers — read-oriented; not consumer-owned

What the next 48 months look like

Q3 2026: public spec v0.1, reference implementation for five Gera verticals
2027: pilot with one non-Gera US partner (healthcare or finance)
2028–2030: consumer-facing vault with US-resident option, HIPAA compartment

US cross-links

US sources

California Privacy Protection Agency — CPRA & ADMT rulemaking
IAPP — US state privacy law tracker
NIST SP 800-63 — Digital Identity Guidelines
HHS OCR — HIPAA BAA guidance