Doing the Right Thing Is Not a Business Model: Diabetes Device Openness at DTM 2026

Should diabetes CGM apps and data be 100% open? In this Diabetes Technology Meeting debate, Shahid N. Shah argues for usable patient access while separating five decisions that need different answers: personal readings, software interfaces, device control, source code and research data.

The presentation examines who funds validation, cybersecurity, support and accountability over a product’s lifetime, and how to distinguish legitimate constraints from patient lock-in. It proposes a practical test for restrictions: name the concern, show the evidence and define what would earn a yes. Includes opening remarks and rebuttal slides.

Presented at Diabetes Technology Meeting, October 27, 2026.
https://shahidshah.com

Transcript

1. DEBATE · SHOULD DIABETES CGM APPS AND DATA BE 100% OPEN? Doing the right thing is not a business model It's the reason to do the work. It doesn't pay for validation, years of support, or a legal defense. When you ask “why doesn't company X just do Y?”, the answer usually sits in one of these five questions: Patient benefit Does the person wearing the device get real, usable access? Business model Who pays for support for as long as patients use it? Competition What do competitors get for free if everything is open? The book behind this argument Regulation What exactly is the released product, and who owns it? Legal risk Who investigates and pays to defend when someone is hurt? Shahid N. Shah · Arguing that less than 100% open makes more sense · shahidshah.com
2. Why should you listen to me on this? I've built companies, devices and open code, so I see both sides Companies Medical technology • Decades in digital health • Medical-device CTO • Founder and operator • Clinical systems that connect devices to hospital systems • I've paid for validation and support, not only asked for data • I know what a released, supported device takes Open source and research • Hundreds of thousands of lines of code • Dozens of GitHub repositories (github.com/shah) • Co-author, 2026 paper on sharing research code Who I'm arguing for Good-faith builders who want to improve patients' lives and will change when we bring them real openness with a business model that lets them survive. Patient benefit is a condition, not a marketing claim. shahidshah.com 2
3. Why don't they just open everything? “100% open” bundles five decisions that need different answers THE DECISION WHAT I SUPPORT THE BOUNDARY WHERE I LAND Patient data access Readable export and a documented interface. Share with clinicians, caregivers and the apps the patient picks. Real consent and identity. Caregiver access the family can turn off. No company blocks the patient's choice. Open to the patient Interfaces and standards Documented, tested interfaces for the apps a patient authorizes. Patient-directed access is not a free data feed for every competitor. Open to their apps Device control Validated combinations of sensors, pumps and algorithms from different companies. Reading a glucose value and sending an insulin command get separate validation. Open with validation Source code Open code helps inspection and reuse. Commercial and nonprofit models can both work. Code alone doesn't prove the version on a patient's phone was tested. Open, with an owner Research data Share as widely as consent and law allow. Publish methods and results. Controlled access often fits better than posting records publicly. Open with controls Rayhan is right: the person wearing the device should get usable access to their own readings. The first question about “100% open” is: open for which data, to whom, and for what use? shahidshah.com 3
4. Why won't they just give it away? Open to patients also means open to competitors WHERE 100% OPEN SENDS THE DATA The sensor company pays for Collecting the data, validating it, getting it cleared and supporting it for years WHY THAT DOES DAM AGE Rivals skip the cost and undercut on price They get validated data without paying for collection, testing or clearance. The next sensor gets harder to fund The patient A competitor Their own readings, to share with the apps they pick All of it, without paying for any of the work Should get it shahidshah.com Investors fund what the company can earn back. Less to earn means less to invest. Big companies absorb small ones A large company can turn a smaller company's data into a rival product faster. The sensor maker gets the blame When a rival's app misreads the data, the complaints and lawsuits still come back. Closed data is a moat. It keeps competitors from taking what the company paid to build, and that's how the company earns back its investment. Gets it free A moat should protect the company's investment. It shouldn't trap the patient. 4
5. Who pays after launch? Someone has to pay for the product for years after launch WHAT A CGM PRODUCT COSTS OVER ITS LIFE Build Validate Release What a company can still sell Support Respond • Validated devices and apps • Paid support and integration work the code testing and the quality system clearance and labeling patches, security, help desk complaints, insurance, lawyers Openness debates focus on the first step. The other four keep costing money for as long as patients use the product. The question that separates investment from lock-in Which advantage is this restriction protecting: a better product, or the patient's inability to leave? Then separate the numbers: added cost (validation, security, insurance, support) versus lost exclusive revenue. shahidshah.com • A share of a common fund (consortium, public or philanthropic money) Open work can reach patients Tidepool Loop came from open-source work and is FDA cleared. The clearance covers a defined product, not every fork. Someone still sponsors and maintains it. Open-source licenses allow commercial use. Open code with a competitor ban isn't open source. 5
6. Why can't they just ship the community's fix? The FDA regulates the released product, not the repository WHAT HAPPENS BETWEEN A COMMUNITY FIX AND A PATIENT'S DEVICE Assess the change Community fix A good idea in a public repository Does it affect safety, effectiveness or intended use? Verify and test New 510(k)? Ship and maintain Units, stale data, missing data, failures, versions Only if the change could significantly affect safety or effectiveness Patches, complaint intake, reporting, for years A cybersecurity-only fix often needs no new 510(k), but it still needs analysis and testing. Open means regulators see more than the company chose to show Publish the boundary TODAY 100% OPEN Intended use Where complaints go What the rules require, with the company's own analysis and context Raw data, early analyses, unconfirmed signals and forks, without that context Supported versions Which limits are law Who owns each change Which are preferences Any public signal can become a question to answer on the regulator's schedule. Required reports were never optional. shahidshah.com 6
7. Why are they so careful about disclosing and fixing problems? Doing the right thing doesn't protect anyone from a lawsuit WHY A US RISK COMMITTEE IS CAREFUL State-law claims on top of FDA rules Discovery of internal records PICTURE A TEAM THAT IMPROVES AN ALARM 1 2 A patient is hurt Civil cases can go to juries Contingency fees: no cost to sue up front Each side usually pays its own lawyers Punitive damages in some cases Product liability exists in many countries. This is the US mix, not a measured lawsuit rate for open data. Being sued is not the same as being liable. FDA clearance isn't a universal shield either (Riegel and Wyeth came out differently). shahidshah.com The team ships a better alarm 3 A lawyer argues it should have existed earlier 4 The company pays to investigate and defend, even if it wins The safeguard: Federal Rule of Evidence 407 A later fix generally can't be used to prove negligence, a defect or the need for a warning. It doesn't block every use, and state rules differ. The answer is a funded process Fix the hazard Keep the decision records Report what must be reported Never hide a known problem 7
8. So how do we tell a real reason from an excuse? Make every restriction specific enough to test A TEST FOR ANY “NO” A first pilot we could run 1 Name the exact data, user and use 2 Say which kind of reason: law, safety, resources or a business choice 3 Show the evidence, with a confidential reviewer if it's sensitive • Thresholds set with patients and engineers before testing 4 Try a smaller test first, like read-only access or a short pilot 5 Agree before the test what earns a yes, who decides and by when • Measure: time to useful access, missing data, delay, revoked permissions, support work, and whether a rival qualifies • One read-only CGM pathway the patient authorizes • Two receiving apps run by independent teams • Named funder, decision owner and review date 6 Apply the same test to the company's own app, partners and rivals An honest business no is better than a false safety reason. Hiding harm, or changing the criteria after a test passes, deserves scrutiny. Disagreement alone doesn't prove bad faith. I'm defending real constraints, not giving anyone an excuse. Name the concern, show the evidence and tell us what would change the answer. If nothing would, say so. shahidshah.com 8
9. REBUTTAL We agree on the patient. The disagreement is about who else gets the data. Decide each audience separately Open source works when someone owns it Protect the investment, not the readings Answer each objection with a question The line to return to: I'm defending real constraints, not giving anyone an excuse. Name the concern, show the evidence and tell us what would change the answer. Shahid N. Shah · shahidshah.com
10. Isn't 100% open just good for patients? We agree on the patient and disagree about who else gets the data WE AGREE: OPEN TO 100% OPEN ALSO MEANS OPEN TO The patient Caregivers and clinicians Apps the patient picks Competitors Regulators Plaintiffs' lawyers Their own readings, in a form they can use Access the patient grants and can turn off No company should be able to block that choice Everything, without paying for any of the work Raw data and unconfirmed signals, without context The same records, read with hindsight Required safety reports always go to the FDA. The concern is unchecked raw data without context, not hiding anything. Decide each audience separately instead of saying 100% for everyone. Caring about competition, investment or liability doesn't make anyone evil. shahidshah.com 10
11. Doesn't open source already work? Open source works when someone owns and funds a defined product CREATE TRI AL · NEJM 2022 TIDEPOOL LOOP +14 points FDA cleared more time in range with open-source automated insulin delivery than with a sensor-augmented pump Open-source work became a regulated product 97 people, ages 7 to 70, 24 weeks. It tested one specified system. It doesn't validate every fork or prove open beats current commercial systems. The clearance covers a defined controller and compatible components, not every fork or combination. What it took One defined, supported release A sponsor who paid for the submission Money to maintain it after launch A named owner for complaints and fixes The same evidence standard as commercial systems These examples help my side as much as Rayhan's. Open code reached patients when an organization took responsibility for it and found a way to pay for it. shahidshah.com 11
12. Aren't companies just locking patients in? Protect the company's investment, not the patient's own readings Inside the moat: fine to protect • Dosing algorithms • Manufacturing know-how • Clinical evidence and submissions • Software and validated releases • Support and services Outside the moat: the patient's • Their glucose readings, with units and timestamps • Sharing with their clinicians, caregivers and apps • Leaving with their full history A real contract to examine: Dexcom's Stelo app terms, dated April 23, 2026 §1.4 Glucose readings count as “Dexcom Data” §6.2 Dexcom asserts ownership of that data §2 Limits outside AI use and unauthorized research Allowed Clinician reports and some selected third-party sharing Protecting software and limiting model training is a business choice a company can explain. An ownership label on the patient's own measurements is a claim, not the final word on their rights. shahidshah.com 12
13. What about the other arguments? Answer each objection with the question it skips “Companies use the FDA as an excuse.” Sometimes they do. Ask which change and which requirement. A cybersecurity-only fix often needs no new 510(k). “You're defending vendor profits.” A return that funds the work isn't evil. It isn't permission for lock-in either. “Many eyes make software safer.” They find problems. Someone still has to triage, validate and ship the fix. “Public money paid for the science.” The public deserves access and fair terms. That doesn't say who pays to maintain the product. What would earn a yes One read-only feed the patient authorizes, two independent apps, thresholds agreed before testing, a named owner and decision date. shahidshah.com “Open is cheaper.” The license is free. Families still pay with setup time, troubleshooting and lost sleep. “An app might cause harm, so lock it down.” Define each party's promise and keep records. Don't deny every patient because someone might sue. I'm defending real constraints, not giving anyone an excuse. Name the concern, show the evidence and tell us what would change the answer. If nothing would, say so. 13