Every tool, in one place
Three layers: the clinic you work in, the engines it calls, the foundation both stand on.
Everything below is built and tested — the same eleven-step patient journey a customer walks through the browser is walked by the test suite against a real database on every change.
The clinic
The screens a front desk and a doctor use all day, in the order the day happens.
Today — diary & queueThe receptionist's screen: the day's appointments, walk-in check-in, and the OPD queue with live wait times. Check-in creates the visit, opens the chart to the desk, and issues the token.tokens · wait-time limits that escalate · follow-up booking
Patients — registry & duplicate preventionRegistration runs the duplicate check before the save, matching across spelling, phonetics and Devanagari transliteration. A strong match must be resolved by a person; a merge keeps the record findable and can be replayed backwards.MRNs with no gaps · Aadhaar and ABHA never stored in full · merge, and undo a merge
Chart & consultConditions, allergies, observations, procedures and notes against the visit. Signed entries are amended, never edited — the database refuses an in-place change. Allergies feed the prescribing safety rule automatically.an entry is never overwritten · every amendment is kept
Prescribing with a safety gateEach line is checked against recorded allergies before it is written. A critical finding blocks the script with no override; a high one demands a typed reason that is stored. Every check — clean or not — leaves a row a dispute can cite.checks the drug, not just the brand · every check kept with the line it checked
Prescription documents & sendingThe prescription renders from a versioned template with the doctor's NMC registration, and goes to the patient by email — consent checked at the moment of sending, decision recorded on the message.by email today · WhatsApp and SMS on the same rules
Billing, cash & day closePrices resolve from effective-dated tariffs — a backdated visit gets that day's price, with the explanation logged. Discounts are bounded by the rate. Cash needs an open shift; close is a blind count with explained variance and a daily summary.every price explained and kept · discounts within limits · a blind cash count
The engines
Definition-driven and versioned. None of these knows what a patient is — which is exactly what lets a new specialty app reuse them unchanged.
SchedulingAvailability templates materialise into bookable slots. Double-booking is refused by a database constraint, multi-resource bookings are atomic, holds expire back into availability, and leave removes time without cancelling what is booked.slots · holds · a double booking refused by the database
Workflow & approvalsMaker–checker with amount slabs, quorum by distinct approvers, delegation with a mandatory end date. Escalation reassigns — it never auto-approves.rules kept by version · who is standing in for whom
RulesOne sandboxed expression language answers every "should this be allowed" question — prescribing safety, form branching, workflow slabs. No eval, a function whitelist, and an evaluation log for every rule, matched or not.no code runs from a rule · every decision is logged
ConsentVersioned consent definitions per purpose, a check logged at every point of use, and withdrawal that cancels queued work — not just the next send.a check kept for every use · withdrawal reaches queued messages
NotificationsTemplates per channel and language, quiet hours in the patient’s timezone, frequency caps that never apply to clinical alerts, retry with backoff and a fallback channel. Every dispatch carries the consent decision that permitted it.the consent decision travels with each message · a delivery report counts once
Trackers & SLADefinition-driven state machines for queues and journeys. SLAs resolve on state entry and are stored, so retuning today does not rewrite last quarter’s report. Dwell time is a column, not a computation.only the moves you declared · the sweep escalates, a person closes
Forms & questionnairesBranching, scoring and red flags. A red flag intercepts submission until a named person acknowledges it with an action. Submitted questionnaires are final; corrections are new submissions.forms kept by version · every red flag acknowledged by name
Search & master patient indexEntity-agnostic search with trigram, transliteration and two phonetic keys. Scoring proposes duplicates; a human disposes.finds Hindi spellings too · a person confirms every match
Print & labelsGS1 element strings with computed check digits, millimetre-positioned label templates, routing by location with an offline fallback. A reprint reproduces the original — not today’s data — and scan verification checks what was actually printed.standard barcodes · a reason for every reprint · verified by scan
AI gatewayEvery model call goes through a registered use, each with a risk level. Anything clinical or financial has to be grounded in records you hold, and a high-risk answer stays a draft until a named clinician accepts it — the database enforces that, not the screen. Refusals are logged and counted too.any model, behind one gate · spending limits · a person decides
The foundation
The part a customer never sees and a regulator always asks about.
Tenancy & isolationEvery table that holds a clinic’s data is fenced inside the database itself: one clinic can never read another’s rows, and the account the application runs as cannot switch the fence off. No screen has to remember to filter by clinic — the database does it.each clinic sealed off inside the database · data kept in one region
Identity & sessionsArgon2id passwords and PINs, refresh rotation, lockout that survives the transaction, shorter idle timeouts on shared clinical devices.two-factor available · shared devices time out sooner
AuthorisationPermissions, scoped roles, and care relationships — a role alone never opens a chart. Break-glass access needs a typed reason, expires hard, and lands in a review queue.a deny beats an allow · two-person rules
Audit chainAppend-only audit rows, hash-chained per tenant per day. Edits, deletions and reordering are detectable; verification runs nightly and before every export.the chain is re-verified nightly · kept month by month
Events & outboxDomain events commit with the transaction that caused them, and a relay delivers with retry and dead-lettering. Nothing escapes its transaction.events saved with the change that caused them · duplicates dropped
Numbering & documentsStatutory series are gapless — a failed save releases the number. Documents render from versioned, effective-dated templates; files upload in two phases behind a scan gate.no gaps in statutory numbers · retention and legal hold
Coming next
Deliberately not built yet — each is on the roadmap with a reason, and none is blocked by anything above. The design gallery shows where several of them are headed.
Insurance & claimsInventory & pharmacy stockIPD / wardsLab & imaging ordersSession packagesTwo-way WhatsAppCampaignsTeleconsultation videoReport builder
Browse the design gallery →You have read what it is. Now go and use it.Every engine above is running in the demo practice right now, with invented patients in it — or create your own in about a minute and put your real ones in instead.