Get started
The clinicThe enginesThe foundationWhere it runsBeyond the browserComing next
Every tool, in one place

Three layers: the clinic you work in, the engines it calls, the foundation both stand on.

The three layers are built and tested — the same eleven-step patient journey a customer walks through the browser is walked by the test suite against a real database on every change. After them: where it runs, and what is still being built, said plainly.

tools, engines and foundations below
22
apps live in clinics
416
apps in design
14
apps in development
630
  1. The clinicThe screens a front desk and a doctor use all day, in the order the day happens.
  2. The enginesScheduling, approvals, rules, consent, messages — definition-driven, versioned, reused by every app.
  3. The foundationIsolation, identity, permissions and the audit chain: the part a regulator always asks about.
Layer 1

The clinic

The screens a front desk and a doctor use all day, in the order the day happens.

Today — diary & queueThe receptionist's screen: the day's appointments, walk-in check-in, and the OPD queue with live wait times. Check-in creates the visit, opens the chart to the desk, and issues the token.tokens · wait-time limits that escalate · follow-up booking
Patients — registry & duplicate preventionRegistration runs the duplicate check before the save, matching across spelling, phonetics and Devanagari transliteration. A strong match must be resolved by a person; a merge keeps the record findable and can be replayed backwards.MRNs with no gaps · Aadhaar and ABHA never stored in full · merge, and undo a merge
Chart & consultConditions, allergies, observations, procedures and notes against the visit. Signed entries are amended, never edited — the database refuses an in-place change. Allergies feed the prescribing safety rule automatically.an entry is never overwritten · every amendment is kept
Prescribing with a safety gateEach line is checked against recorded allergies before it is written. A critical finding blocks the script with no override; a high one demands a typed reason that is stored. Every check — clean or not — leaves a row a dispute can cite.checks the drug, not just the brand · every check kept with the line it checked
Prescription documents & sendingThe prescription renders from a versioned template with the doctor's NMC registration, and goes to the patient by email — consent checked at the moment of sending, decision recorded on the message.by email today · WhatsApp and SMS on the same rules
Billing, cash & day closePrices resolve from effective-dated tariffs — a backdated visit gets that day's price, with the explanation logged. Discounts are bounded by the rate. Cash needs an open shift; close is a blind count with explained variance and a daily summary.every price explained and kept · discounts within limits · a blind cash count
Layer 2

The engines

Definition-driven and versioned. None of these knows what a patient is — which is exactly what lets a new specialty app reuse them unchanged.

SchedulingAvailability templates materialise into bookable slots. Double-booking is refused by a database constraint, multi-resource bookings are atomic, holds expire back into availability, and leave removes time without cancelling what is booked.slots · holds · a double booking refused by the database
Workflow & approvalsMaker–checker with amount slabs, quorum by distinct approvers, delegation with a mandatory end date. Escalation reassigns — it never auto-approves.rules kept by version · who is standing in for whom
RulesOne sandboxed expression language answers every "should this be allowed" question — prescribing safety, form branching, workflow slabs. No eval, a function whitelist, and an evaluation log for every rule, matched or not.no code runs from a rule · every decision is logged
ConsentVersioned consent definitions per purpose, a check logged at every point of use, and withdrawal that cancels queued work — not just the next send.a check kept for every use · withdrawal reaches queued messages
NotificationsTemplates per channel and language, quiet hours in the patient’s timezone, frequency caps that never apply to clinical alerts, retry with backoff and a fallback channel. Every dispatch carries the consent decision that permitted it.the consent decision travels with each message · a delivery report counts once
Trackers & SLADefinition-driven state machines for queues and journeys. SLAs resolve on state entry and are stored, so retuning today does not rewrite last quarter’s report. Dwell time is a column, not a computation.only the moves you declared · the sweep escalates, a person closes
Forms & questionnairesBranching, scoring and red flags. A red flag intercepts submission until a named person acknowledges it with an action. Submitted questionnaires are final; corrections are new submissions.forms kept by version · every red flag acknowledged by name
Search & master patient indexEntity-agnostic search with trigram, transliteration and two phonetic keys. Scoring proposes duplicates; a human disposes.finds Hindi spellings too · a person confirms every match
Print & labelsGS1 element strings with computed check digits, millimetre-positioned label templates, routing by location with an offline fallback. A reprint reproduces the original — not today’s data — and scan verification checks what was actually printed.standard barcodes · a reason for every reprint · verified by scan
AI gatewayEvery model call goes through a registered use, each with a risk level. Anything clinical or financial has to be grounded in records you hold, and a high-risk answer stays a draft until a named clinician accepts it — the database enforces that, not the screen. Refusals are logged and counted too.any model, behind one gate · spending limits · a person decides
Layer 3

The foundation

The part a customer never sees and a regulator always asks about.

Tenancy & isolationEvery table that holds a clinic’s data is fenced inside the database itself: one clinic can never read another’s rows, and the account the application runs as cannot switch the fence off. No screen has to remember to filter by clinic — the database does it.each clinic sealed off inside the database · data kept in one region
Identity & sessionsArgon2id passwords and PINs, refresh rotation, lockout that survives the transaction, shorter idle timeouts on shared clinical devices.two-factor available · shared devices time out sooner
AuthorisationPermissions, scoped roles, and care relationships — a role alone never opens a chart. Break-glass access needs a typed reason, expires hard, and lands in a review queue.a deny beats an allow · two-person rules
Audit chainAppend-only audit rows, hash-chained per tenant per day. Edits, deletions and reordering are detectable; verification runs nightly and before every export.the chain is re-verified nightly · kept month by month
Events & outboxDomain events commit with the transaction that caused them, and a relay delivers with retry and dead-lettering. Nothing escapes its transaction.events saved with the change that caused them · duplicates dropped
Numbering & documentsStatutory series are gapless — a failed save releases the number. Documents render from versioned, effective-dated templates; files upload in two phases behind a scan gate.no gaps in statutory numbers · retention and legal hold
Where it runs

One server, in Boston, United States.

Every clinic's records are stored in the database and object store we run on one VPS: Boston, United States · Hostinger VPS. There is no second region and no failover site yet. Optional features — AI drafting, transcription, message delivery — send data to the sub-processors the trust centre lists by name.

A server in the United States is not HIPAA compliance, and it is not UK GDPR, PIPEDA or Privacy Act compliance either. Each needs agreements with every vendor that touches patient data, and none is signed yet. The trust page for each law says what is in place, what is in progress and what a clinic must do itself.

  • No second region yet
  • No failover site yet
  • Sub-processors listed by name
Beyond the browser

Offline, mobile, your own brand, and other people’s apps.

Each line says what runs today and what is still being built; the chip is read from the catalog.

OfflineLiveHealth camps and the front desk run with no signal: registrations, tokens and cash or UPI receipts wait on the device and go up once when the line returns. A new bill raised offline is not built yet.Read more →MobileIn developmentThe product runs in any phone browser, with web push, and the patient app is live. Native iOS and Android apps for staff are being built.Read more →White-labelLiveA partner’s brand, domains and email sender on the same platform, run from a partner console, is being built. Today every clinic sees the MedAppz name; a clinic can already publish its own page at its own address with SiteFront.Read more →Developer programmeLiveEvery app on this page is built on the same record, engines and permissions a third party would use. Outside developers can now build in a sandbox clinic, pass a checklist and be listed for clinics after MedAppz reviews the app. Paying out the revenue share is not built yet.Read more →AI reportingIn developmentLive boards and AI drafts on every screen run today. Asking your data a question in plain words, and a report builder, are being built.Read more →ScribeIn developmentConsult recording and case notes run today. One note you can type, record or dictate field by field is being built.Read more →
Coming next

What is not live yet, by the job it does.

Counted from the catalog: designed apps that are waiting on review, and apps being built. None of it can be installed until it ships; the roadmap lists every one.

The roadmap →
Front office1 in design5 in developmentClinical8 in design258 in developmentRevenue cycle11 in developmentEngagement67 in developmentOperations4 in design70 in developmentCompliance106 in developmentAnalytics8 in developmentBusiness1 in design105 in development
Browse the design gallery →

You have read what it is. Now go and use it.

Every engine above is running in the demo practice right now, with invented patients in it — or create your own in about a minute and put your real ones in instead.