From a personal problem to a formula
How an ordinary question — how long can I stay in the sun — became a dosimetric model, and then a product.
Abstract
The full path of the studio's first product: where the question came from, why the usual unit was the wrong one, how the problem was written down mathematically, what went wrong along the way, and what finally shipped.
The problem
This did not start as a company project. It started as a personal question: I wanted to sunbathe and did not know for how long.
The question looks trivial until you try to answer it. Every summer the news repeats the same pattern: people expose themselves generously and carelessly, and the public-health message offered against that is essentially less. Cover up, find shade, cut down. It is correct advice and also incomplete, because sun exposure is not only a risk: it is the main route of vitamin D synthesis, it has documented effects on mood, and it sets the circadian clock.
So the real question was not "is the sun bad?" but a considerably more awkward one: given where I am, at this hour, with the skin I have, how long is it sensible to stay? Nobody answered that. It was answered with generic tables of minutes, which is the same as answering with an average.
If the sun has both benefits and risks, and both depend on dose, then this is not a matter of opinion. It is a constrained optimization problem.
That was the starting point: use mathematics and the available evidence to optimise something most people do by eye.
Why minutes are the wrong unit
The first conclusion, and the one that reorganised everything else, is that "twenty minutes" is not a quantity of exposure. It is a quantity of time during which some exposure happened. The two coincide only if intensity is constant, and it never is: it changes with the hour, the latitude, the season, the cloud cover and the ground beneath you.
The correct physical quantity already exists and is standardised. The Standard Erythema Dose (SED) equals 100 J/m² of ultraviolet radiation weighted by the McKinlay–Diffey erythemal action spectrum. The UV Index published by meteorological services derives directly from that same weighting: a UVI of 1.0 corresponds to an effective irradiance of 25 mW/m².
From that comes the constant that governs the whole model. One minute under a UVI of 1.0 delivers:
25 mW/m² × 60 s = 1.5 J/m² = 0.015 SED
What to maximise, and what constrains it
With the unit corrected, the problem can be written down. There is a quantity we want to grow — accumulated physiological benefit — and one that must not cross a threshold — acute damage. Both depend on the same dose, but not in the same way, and that asymmetry is what makes the problem solvable rather than a plain "less is better".
- Benefit. Vitamin D synthesis saturates: past a sub-erythemal point, further radiation begins to photodegrade the freshly formed previtamin D3 into inactive compounds. Staying out stops adding anything.
- Risk. Erythemal damage does not saturate. It keeps accumulating with dose until it becomes a burn.
In other words: there is a window where the benefit is nearly complete and the risk is still low. Finding that window for a specific person on a specific day is exactly the problem the product solves.
The personal threshold is also defined in the literature: the Minimal Erythemal Dose (MED), the weighted energy needed to induce perceptible redness 24 hours later. Unlike the SED, which is physical and absolute, the MED is biological and highly personal: roughly 2.2 SED for very fair skin up to about 13 SED for very dark skin.
The formulation
Accumulation is an integral, not a counter. The dose received between the start of a session and an instant t is:
D(t) = ∫₀ᵗ k · UVI(τ) · T_SPF(τ) · s · a dτ ⩽ MED(tone)
Written this way, several things that looked like separate features collapse into parameters of one equation. Sun protection is a factor inside the integrand, not a discount applied at the end. A passing cloud is a change in UVI(τ), handled automatically. And the recommendation stops being a number from a table: it is the solution of the equation, the moment the first limit is reached.
Because the stopping condition is explicit, the product can also report which limit stopped it — the benefit target, the risk threshold, or simply the sun going down. Users are told not only how long, but why.
Three corrections that changed the answer
Three details, drawn from the evidence review, moved the result more than any programming decision.
1. The SPF on the label is not the real SPF
Protection factor is measured in the laboratory at 2 mg/cm². In practice people apply between a quarter and a half of that. Because attenuation is roughly exponential in film thickness, applying half does not give half the protection: it gives approximately the square root of the nominal factor. A bottle labelled SPF 50 behaves, in ordinary use, closer to 7.
A model that takes the label at face value confidently reports a protection level off by a factor of seven, in the unsafe direction, for essentially every user. Protection also decays with time, sweat and water, so it is modelled with an exponential decay (τ ≈ 150 min) that resets on reapplication.
2. Sunscreen does not cancel vitamin D
Intuition says that blocking UVB blocks synthesis. The evidence says otherwise. The consensus led by Passeron and endorsed by the British Association of Dermatologists concludes that daily use of broad-spectrum sunscreen does not compromise serum vitamin D status in healthy populations, precisely because real-world application is imperfect and lets through a sufficient sub-erythemal fraction.
So in the model, the transmission applied to the vitamin D pathway never reaches zero. When the evidence contradicts the intuitive adjustment, the evidence wins.
3. Exposed surface does not scale linearly
Crediting body surface linearly badly overestimates whole-body exposures, because each patch of skin photosaturates locally. The model damps surface with a square root.
The mistake that nearly shipped
The first version of the score multiplied accumulated benefit by a penalty that grew with risk:
S(t) = B(t) · (1 − P(t))
Each factor is defensible on its own. Their product, however, is free to fall. And it fell: in real testing the bar read 69% at 61 minutes and 15% at 77. The user had lost nothing; they had simply continued doing the thing the bar was measuring.
The fix was not tuning parameters but changing the definition. The score became a weighted sum of saturating terms, each a non-decreasing function of a quantity that only accumulates:
S(t) = 0.65 · min(1, D_vitD/1.35) + 0.35 · min(1, D_other/4.05)
Risk did not disappear: it moved to its own indicator, with its own scale and warnings. Two distinct facts about the user's state are now shown as two distinct numbers, which is also more honest than folding them into one.
What shipped
The result is Broncea, available on Google Play. It integrates the real hourly forecast for the user's exact location rather than a regional average; it separates benefit and risk into two independent indicators; and it carries a screen listing every mechanism the model depends on, its strength of evidence and its source, so the reasoning can be audited rather than merely trusted.
It has no server. Profile and history live on the device, and location leaves it only to fetch the forecast. That is not a privacy-policy promise: it is a consequence of the architecture.
The full detail is in the other two documents: the evidence review supporting each mechanism, and the algorithm specification with the complete model and its 73 references.