Ketonia ($KTN) — Tokenomics Litepaper

Contents

1. Executive Summary

Ketonia operates a functional-medicine platform for reversing metabolic disease (primarily Type 2 Diabetes) through lifestyle intervention. Its decisive, non-replicable asset is not its brand, its community, or its token — it is a structured, longitudinal clinical database: 1,700+ complete clinical records of fully tracked patients (1,701 as of September 2026, growing daily) spanning multi-year metabolic trajectories (HbA1c series, medication tapering histories, fasting protocols, anthropometrics, lab panels).

Longitudinal outcome data of this kind is among the scarcest inputs in metabolic research, Health-AI model training, and payer-side risk modeling. Cross-sectional datasets are commoditized; multi-year per-patient trajectories with documented intervention outcomes are not.

$KTN is the access and settlement token for this data economy:

• Demand side: pharmaceutical companies, longevity researchers, Health-AI developers, insurers, and DeSci DAOs must acquire, lock, or burn $KTN to license anonymized cohorts, query the data layer, or train/validate models against it.
• Supply side: patients mint $KTN through Data-to-Earn — informed consent to share anonymized longitudinal records, and verifiable clinical milestones (documented HbA1c reduction, insulin reduction/discontinuation). Minting for raw activity is deprecated.
• Trust layer: zero-knowledge proofs and a consent registry allow clinical outcomes and data quality to be proven without revealing patient identity, supporting GDPR-grade compliance posture from day one.
• Two layers: a non-transferable Soulbound reputation layer (health credentials, governance weight, data-access tiers) and the liquid $KTN token (settlement, staking, governance).

2. Strategic Pivot: From Loyalty Points to Data Infrastructure

2.1 What is being retired

The previous model (Ketonia Points on Bale) was a closed-loop loyalty system: points for daily check-ins, glucose logging, and challenge completion, redeemable for consultation discounts. Its structural limits:

2.2 What replaces it

A data-asset-backed token economy. The clinical database is treated as the reserve asset; $KTN is the instrument through which access to that reserve is priced, paid for, and governed.

1. Supply is capped by biology and time. No competitor can retroactively create five-year metabolic trajectories. New entrants must recruit patients and wait years; Ketonia already holds the asset.
2. Demand is non-discretionary. A Health-AI developer training a hypoglycemia-prediction model, or a DAO funding an RCT on fasting protocols, needs real outcome data. There is no synthetic substitute that passes clinical review.
3. The token is the toll. All institutional access routes through $KTN acquisition, staking, or burn — creating structural, recurring demand proportional to the commercial value of the data.

2.3 Continuity with Ketonia philosophy

The pivot changes the economic engine, not the values. The 4P framework (Preservation, Cultivation, Connection, Inquiry) maps cleanly onto the data economy: Preservation becomes longitudinal data continuity; Inquiry becomes research access and validation; Connection becomes the consent-based data cooperative. Rewards remain sized to avoid crowding out intrinsic motivation — patients are compensated as data producers and research participants, a dignified framing, not a gamified one.

3. System Architecture Overview

Three layers, strictly separated:

4. Demand Side: Institutional Access Economics

This is the core of the redesign. Demand mechanisms are non-negotiable: there is no institutional access path that does not require holding, locking, or burning $KTN.

4.1 The Data Access Marketplace

Four product tiers, all priced and settled in $KTN:

• Cohort definitions are parameterized by an on-chain Data Product Registry; each registered product has a scope, consent-coverage check, and a $KTN price band set by governance.
• T2 staking creates a persistent demand floor: query rights scale with stake size, so serious buyers keep capital locked rather than transacting once.
• T4 locking converts research urgency into time-locked demand — the mechanism institutional DeSci allocators already understand from VitaDAO/AthenaDAO-style grant staking.

4.2 API & Data Oracle Access

For Health-AI developers, the Data Vault exposes a metered API: aggregate endpoints (cohort statistics, outcome distributions) and, under stricter tiers, feature-level access for model training. API subscriptions are denominated in $KTN, purchased on a rolling basis. A future path — Ketonia as a verified metabolic-data oracle for other protocols (insurtech DAOs, underwriting models) — uses the same staked-access contract, with oracle fees settled in $KTN.

4.3 Token Sinks (structural, not discretionary)

The burn share of B2B revenue is a governance parameter with a hard floor of 40% (of the token-denominated B2B revenue pool) — it cannot be voted below this, ensuring deflationary pressure is structural rather than political.

4.4 Utility summary (beyond any internal discount)

1. Data licensing settlement — the only accepted payment for cohort access.
2. Staking for query rights — stake size meters API/query throughput.
3. Locking for priority research access — time-locked capital buys queue position for prospective studies.
4. Governance — staked $KTN (weighted by Soulbound reputation) votes on price bands, consent-scope templates, burn/lock ratios, new data-product registrations, and Data Treasury grants.
5. Collateral for research grants — DAOs can post $KTN as milestone-based escrow for funded studies on Ketonia cohorts.

Internal patient-facing discounts (the old points use case) are explicitly removed from the token’s utility set. Patients receive value via the Data Dividend Pool and milestone minting (§4.5, §5), not via subsidized consultations — keeping the demand side institutional and the supply side clinical.

4.5 Data Dividend Pool (patient revenue share)

40% of T1 license fees and 20% of T2 query fees flow to a Data Dividend Pool, distributed pro-rata to patients whose consented data was actually used in the licensed cohort/query, weighted by their Data Quality Score (§6.3). This is not a mint — it is revenue sharing. It creates a direct, legible link for patients between consenting to data use and receiving income — the honest framing of a data cooperative and a significant consent-rate driver.

5. Supply Side: Data-to-Earn Minting

5.1 Primary minting paths

Minting is reserved for events that create or certify data value:

* All figures are initial parameters subject to governance calibration and the emission schedule (§8.2). Rewards are modified by the patient’s Soulbound tier multiplier (×1.0 – ×2.0).

M2 is the flagship: a verified diabetes-reversal event is exactly the outcome datum that pharma outcome studies, payers, and DeSci DAOs pay for. The milestone mint is Ketonia purchasing its own most valuable inventory with newly issued token, funded by the community treasury emission (§8).

5.2 What is explicitly NOT minted

• Daily check-ins, streaks, log frequency, likes, invites, or any engagement metric.
• Content production or promotion. Knowledge contributions migrate to Soulbound reputation and Data Treasury grants, not token issuance — this removes the farming surface entirely.
• Device-data volume (steps, sleep scores). Device integration (§12) upgrades data quality scores and oracle tier, not raw mints, until governance approves device-verified milestone equivalence.

5.3 Emission control on the mint side

• Per-category weekly emission caps (M1/M2/M3 capped independently) — prevents supply shock from consent drives or onboarding campaigns.
• Diminishing marginal rewards within categories.
• M3 sunset clause: the continuity path decays 20% per year from TGE+3 unless governance renews it with evidence. It exists to bootstrap early supply, not to run forever.
• Individual lifetime caps on M3; no caps on M2 (genuine clinical milestones are self-limiting and maximally valuable).

5.4 Anti-sybil and clinical integrity

Health data has a natural sybil defense that open networks lack — you cannot fake a five-year HbA1c trajectory past clinical review:

1. Clinical identity anchoring: mint eligibility requires a Ketonia medical record verified by licensed staff. Wallet↔patient binding is one-to-one, mediated by the clinic, privacy-preserving (only a commitment on-chain).
2. Soulbound tiering: governance weight and mint multipliers attach to non-transferable KSBTs; bought accounts inherit nothing.
3. Expert-oracle + slashing: clinical attestations are signed by credentialed experts; a falsified attestation slashes the expert’s stake and reputation and voids derived mints.
4. Statistical anomaly detection: cohort-level outlier screening on incoming records before acceptance into the Data Reserve.
5. Proof-of-personhood fallback: for future open cohorts, permissioned KYC or government-ID ZK attestation is a prerequisite — no anonymous minting path exists at any tier.

6. Privacy & Trust Infrastructure

6.1 Threat model

The asset is medical data of identifiable patients in a jurisdiction-sensitive context. A single de-anonymization event is an existential risk to both patients and the platform. Privacy is therefore load-bearing architecture, not a feature.

6.2 Stack

6.3 Data Quality Score (DQS)

Every consented record carries an off-chain DQS (completeness, longitudinal span, verification depth, device-oracle backing once available). DQS determines mint scaling (§5.1), Data Dividend weight (§4.5), and cohort inclusion priority. DQS is reputation, held in the Soulbound layer — never tradeable.

6.4 Compliance posture

• Architecture is designed for GDPR-compatible operation: lawful basis = explicit consent (Art. 9(2)(a)), purpose limitation via consent scopes, erasure via vault-level deletion with on-chain revocation witness, data-minimization via ZK/DP outputs.
• Consent text and registry semantics satisfy HIPAA de-identification standards (Safe Harbor + expert determination) for US-facing products.
• A standing Data Ethics Council (medical/ethics members, distinct from token governance) holds veto power over any data product registration — commercialization can never outvote patient protection.

7. Points-to-Token Transition (Bale Pilot Migration)

The existing Ketonia Points balances from the Bale pilot must convert fairly, transparently, and once.

7.1 Principles

1. Honor earned value: pilot participants earned points under published rules; those balances are a liability Ketonia honors.
2. Reprice, don’t invalidate: points were earned under Action-to-Earn logic; $KTN mints under Data-to-Earn logic. Conversion applies a transition exchange rate reflecting the different value basis — not 1:1, published in advance.
3. No speculative windfall: conversion is vesting-gated so migration cannot be dumped at TGE.
4. Reputation carries over fully: pilot ranks, challenge completions, and milestone history map 1:1 to Soulbound credentials and tier multipliers. Reputation migration is generous precisely because token migration is gated.

7.2 Mechanism

• Conversion window: a fixed 12-month window from TGE. Points convert at a governance-published rate (indicative: 100 points → 1 $KTN), calibrated so total pilot conversion draws only from the dedicated 6% Retroactive Allocation (§8.1) and cannot dilute other pools.
• Vesting: converted $KTN vests linearly over 12 months with a 3-month cliff. The same lock logic applies to team and investors.
• Milestone true-up: pilot users with verified clinical milestones receive an additional one-time M2-equivalent mint on migration — recognizing their real contribution was data, not check-ins. This is the single most important fairness lever.
• Soulbound migration: pilot rank history, forum publication record, empathy-circle participation, and peer-validation reputation convert to KSBT tier credits.
• Burned points honored: points already spent in the pilot are not re-converted; their historical purchases are respected as closed transactions.
• One-way, final: after the window, unconverted points lapse. The points ledger is snapshotted publicly (hashed balances) before TGE for auditability.

7.3 Communication frame

For the 35–65 clinical audience, the migration is framed as: “Your health progress and your data now own a share of what they produce.” No airdrop hype, no countdown timers — a plain statement of entitlement, rate, and vesting, delivered through the Bale group and forum.

8. Token Distribution, Governance & Sustainability

8.1 Supply and allocation

Total supply: 1,000,000,000 $KTN (fixed at genesis; all issuance beyond allocation comes only from the emission schedule below, capped within the Community/Data Treasury line).

Combined community-facing lines (Treasury + Research + Migration) total 54% — the data producers and their research ecosystem hold the majority of the token, the structural claim that makes this a cooperative rather than an extraction platform.

8.2 Emission schedule and supply control

• The Community & Data Treasury emits on a decaying schedule: 8% annual decay of the prior year’s emission rate (smooth halving-equivalent; ~50% reduction every 8.3 years).
• Emission is category-capped (§5.3): weekly ceilings per minting path, enforced at contract level.
• Hard supply ceiling: cumulative issuance can never exceed the Treasury allocation; there is no inflation mechanism, ever. Net supply is designed to be deflationary from year ~4.
• Burned tokens go to a provably dead address; quarterly Proof-of-Burn reports publish burn totals against B2B revenue.

8.3 Velocity management

• Slowed by: T2 staking (90-day cooldown), T4 locks (12–36 months), team/investor/pool vesting, Data Dividend distributions with optional auto-restake.
• Sustained by: rolling API subscriptions, quarterly buyback-burn, grant escrows releasing on research milestones.
• The dominant holder class by design is locked or staked institutional capital + vesting-aligned patients — a low-velocity, high-conviction base.

8.4 Governance

• Vote weight = staked $KTN × Soulbound reputation multiplier (capped ×3). Quadratic voting applies to Treasury allocation votes to dampen plutocracy.
• Governance scope: data-product registration and price bands, burn/lock tuning (above hard floors), emission category caps, Research Pool grants, Ecosystem spend.
• Out of governance scope (Ethics Council veto): consent-scope weakening, k-anonymity/DP relaxation, any product involving identifiable data, re-identification research — constitutional constraints.
• Proposal process: all proposals pass a public challenge/review period on the Ketonia forum before on-chain vote — preserving the existing “challenge room” culture as a deliberation layer.

8.5 Legal & jurisdictional note

9. Dual-Layer System: $KTN + Soulbound (KSBT)

Access tiers (buyer-facing and patient-facing, both KSBT-gated):

• Patients: Contributor → Verified Contributor → Senior Contributor → Remission Alumni — tier raises mint multiplier, dividend weight, and governance multiplier. Tier decays slowly (2%/month) without continued data contribution.
• Institutions: Registered → Staked (T2) → Licensed (T1) → Partner (T4-locked) — each tier requires progressively larger locked $KTN and deeper compliance review.

Milestone badges as NFTs: kept deliberately minimal — one Soulbound credential class per verified clinical milestone, optionally rendered as a commemorative badge. Badges confer reputation and rights; never tradeable, never speculative.

10. Key Flows

10.1 Patient consent → mint → dividend

Revoking consent propagates from the Registry to the Vault and voids future use.

10.2 Institutional access (T1/T2)

10.3 Milestone verification (ZK)

Clinical staff verify labs off-chain → sign attestation → circuit proves “HbA1c(t₀) − HbA1c(t₀+6mo) ≥ 1.0 ∧ record authentic ∧ consent active” against the Merkle-committed record → Mint Contract issues M2 reward + Soulbound “HbA1c Reduction” credential. No lab value, diagnosis, or identity appears on-chain at any step.

11. DeSci Investor Positioning (VitaDAO-class thesis)

The pitch to serious DeSci capital, stated without hype:

1. Asset-backed, not narrative-backed. Token demand derives from licensing revenue on an existing 1,700+-record longitudinal reserve — inventory is on hand at TGE, unlike most DeSci protocols promising future data collection.
2. Outcome data, the highest-value class. Documented intervention→outcome trajectories (fasting/ketogenic protocols → HbA1c, insulin dose) serve three concurrent buyer markets: metabolic pharma RWE, Health-AI training/validation, and longevity research — with payer/insurtech as a fourth.
3. Structural sinks with hard floors. ≥ 40% of B2B token revenue is burned by constitutional rule; staking and T4 locks remove further float. Deflation is mechanical, not promotional.
4. Cooperative legitimacy. 54% of supply to community/research lines, consent-registry-gated data use, and an Ethics Council veto give the protocol the social license that institutional buyers and DAOs increasingly require for health data.
5. Compatible with existing DeSci rails. Research Pool grants and T4 priority access are designed for co-funding structures and IP-NFT-style abstraction familiar to VitaDAO, AthenaDAO, and DeSci Nodes; joint cohort studies can be escrowed milestone-wise in $KTN.

12. Modularity & Future Extensibility

Clean hooks, explicitly non-core:

• Device Data Oracles (CGM, smartwatches, health apps): a pluggable Oracle Adapter interface — any verified device feed maps into the DQS pipeline as a higher-assurance source. Device backing raises DQS, cohort eligibility, and (once governance approves equivalence studies) can co-sign milestone attestations. Move-to-Earn and raw device metrics are permanently excluded from minting by §5.2; devices improve proof quality, never activity rewards.
• Prospective data collection: T4 priority access already provides the commercial hook for sponsored prospective studies without new token design.
• Milestone NFTs/badges: the Soulbound credential class is extensible; new badge types are governance-registered metadata over the same ERC-5192 infrastructure.
• Cross-protocol oracle role: the staked-access contract (§4.2) generalizes to selling verified aggregate signals to other protocols — same staking, burn, and privacy envelope.
• L2/chain migration: token is standard ERC-20; vault, registry, and proof layer are chain-agnostic, permitting relocation to a lower-cost L2 as query volume grows.

13. Roadmap

KPIs the token design is judged by (not price): consent rate among eligible patients (%), longitudinal retention (months tracked per consenting patient), B2B licensing revenue ($KTN-denominated), burn-to-emission ratio, cohort product count, and verified milestone count per quarter.

14. Risks & Mitigations

15. Design Principles (recap)

1. The database is the reserve; the token is the toll. Every mechanism prices access to a real, existing, non-replicable asset.
2. Data-to-Earn, never Action-to-Earn. Mints attach to consent and verified clinical outcomes — not engagement.
3. Privacy is load-bearing. ZK + DP + consent registry are prerequisites, not roadmap items.
4. Deflation by construction. Burn floors, staking, locks, and decay make supply reduction mechanical.
5. Serotoninergic economics. Durable rewards, reputation over speculation, governance that cannot outvote patient protection — the token behaves like the medicine Ketonia practices.