Three layers: the clinic you work in, the engines it calls, the foundation both stand on.

Everything below is built and tested — the same eleven-step patient journey a customer walks through the browser is walked by the test suite against a real database on every change.

The clinic

The screens a front desk and a doctor use all day, in the order the day happens.

Today — diary & queueThe receptionist's screen: the day's appointments, walk-in check-in, and the OPD queue with live wait times. Check-in creates the visit, opens the chart to the desk, and issues the token.tokens · queue SLA with escalation · follow-up booking

Patients — registry & duplicate preventionRegistration runs the duplicate check before the save, matching across spelling, phonetics and Devanagari transliteration. A strong match must be resolved by a person; a merge keeps the record findable and can be replayed backwards.gapless MRN · Aadhaar/ABHA stored hashed · merge & unmerge

Chart & consultConditions, allergies, observations, procedures and notes against the visit. Signed entries are amended, never edited — the database refuses an in-place change. Allergies feed the prescribing safety rule automatically.append-only clinical record · amendment trail

Prescribing with a safety gateEach line is checked against recorded allergies before it is written. A critical finding blocks the script with no override; a high one demands a typed reason that is stored. Every check — clean or not — leaves a row a dispute can cite.substance-level matching · safety_check_id on every line

Prescription documents & sendingThe prescription renders from a versioned template with the doctor's NMC registration, and goes to the patient by email — consent checked at the moment of sending, decision recorded on the message.email live · WhatsApp/SMS ready behind the same contract

Billing, cash & day closePrices resolve from effective-dated tariffs — a backdated visit gets that day's price, with the explanation logged. Discounts are bounded by the rate. Cash needs an open shift; close is a blind count with explained variance and a daily summary.price_resolution_log · bounded discounts · blind close

The engines

Definition-driven and versioned. None of these knows what a patient is — which is exactly what lets a new specialty app reuse them unchanged.

SchedulingAvailability templates materialise into bookable slots. Double-booking is refused by a database constraint, multi-resource bookings are atomic, holds expire back into availability, and leave removes time without cancelling what is booked.slots · holds · exclusion constraints

Workflow & approvalsMaker–checker with amount slabs, quorum by distinct approvers, delegation with a mandatory end date. Escalation reassigns — it never auto-approves.versioned definitions · acting-for resolution

RulesOne sandboxed expression language answers every "should this be allowed" question — prescribing safety, form branching, workflow slabs. No eval, a function whitelist, and an evaluation log for every rule, matched or not.hand-written parser · evaluation_log

ConsentVersioned consent definitions per purpose, a check logged at every point of use, and withdrawal that cancels queued work — not just the next send.check_log per use · withdrawal propagates

NotificationsTemplates per channel and language, quiet hours in the patient’s timezone, frequency caps that never apply to clinical alerts, retry with backoff and a fallback channel. Every dispatch carries the consent decision that permitted it.consent_record_id per message · idempotent callbacks

Trackers & SLADefinition-driven state machines for queues and journeys. SLAs resolve on state entry and are stored, so retuning today does not rewrite last quarter’s report. Dwell time is a column, not a computation.declared transitions only · sweeps escalate, never close

Forms & questionnairesBranching, scoring and red flags. A red flag intercepts submission until a named person acknowledges it with an action. Submitted questionnaires are final; corrections are new submissions.versioned definitions · acknowledgement table

Search & master patient indexEntity-agnostic search with trigram, transliteration and two phonetic keys. Scoring proposes duplicates; a human disposes.Devanagari transliteration · review queue

Print & labelsGS1 element strings with computed check digits, millimetre-positioned label templates, routing by location with an offline fallback. A reprint reproduces the original — not today’s data — and scan verification checks what was actually printed.GS1-128 · reprint reasons · scan verify

AI gatewayEvery model call goes through a registered use case with a risk tier. Medium and high tiers require grounding in records you hold; high-risk output is a draft until a named clinician accepts it — enforced by the database, not the UI. Refusals are logged and metered too.NVIDIA-powered · budgets · human decision gate

The foundation

The part a customer never sees and a regulator always asks about.

Tenancy & isolationEvery tenant table carries row-level security, forced, with a runtime role that cannot bypass it. No application query filters by tenant — the database does.RLS + FORCE · region pinning

Identity & sessionsArgon2id passwords and PINs, refresh rotation, lockout that survives the transaction, shorter idle timeouts on shared clinical devices.MFA challenge · device-aware

AuthorisationPermissions, scoped roles, and care relationships — a role alone never opens a chart. Break-glass access needs a typed reason, expires hard, and lands in a review queue.explicit deny wins · SoD rules

Audit chainAppend-only audit rows, hash-chained per tenant per day. Edits, deletions and reordering are detectable; verification runs nightly and before every export.verify_chain · monthly partitions

Events & outboxDomain events commit with the transaction that caused them, and a relay delivers with retry and dead-lettering. Nothing escapes its transaction.transactional outbox · inbox dedupe

Numbering & documentsStatutory series are gapless — a failed save releases the number. Documents render from versioned, effective-dated templates; files upload in two phases behind a scan gate.gapless allocation · retention & legal hold

Coming next

Deliberately not built yet — each is on the roadmap with a reason, and none is blocked by anything above. The design gallery shows where several of them are headed.

Insurance & claimsInventory & pharmacy stockIPD / wardsLab & imaging ordersSession packagesTwo-way WhatsAppCampaignsTeleconsultation videoReport builder

Browse the design gallery →