AI FAX INTAKE · AUTO-BOOKING · INTEGRATION READY
A referring practice still faxes. Here the AI reads it and it becomes a booked appointment, or a triage item with the reason stated, without anyone retyping anything.
01 · RECEIVE
Provider webhook fires, the push is authenticated, the document stored. Unconfigured deployments refuse every push.
02 · AI READS
Patient, doctor and session extracted. Output stored verbatim, evidence of what the model said, never acted on directly.
03 · VALIDATE
Exactly one patient, exactly one doctor, one bookable session, against real records. A malformed date fails the whole parse.
04 · BOOK · OR TRIAGE
Booked on the fax channel, booker: system, or queued for reception with the reason written on it. Auto-booking is opt-in.
Where a provider offers webhook signing we verify it; where they don't, the callback carries a secret token. Auto-booked appointments carry a system sentinel as the booker, no human's name is fabricated onto a decision they didn't make.
WORDMARKS AS PLACEHOLDERS · SWAP IN BRAND SVGS
FIVE BOOKING CHANNELS · ONE QUEUE
CH/01
Counter
The patient standing at the desk.
CH/02
Phone
Against their record, or a phone-only guest hold.
CH/03
Portal
Self-service PWA, phone + OTP, no app store.
CH/04
Walk-in
Token on arrival, from the reserved pool.
CH/05 · AI
Fax
Read by AI, booked by the system.
The walk-in reserve. Capacity 30, reserve 5, twenty-five online bookings and the portal says “full” while reception still hands a token to the person standing in front of them. A hard limit enforced in the database, not a guideline.
“The screen never sells the seat your receptionist is standing next to.”
Two booking modes
Token/serial or fixed time slots, set per session template.
Concurrency-safe to the last token
Two people racing for the final slot: one booking, one clean failure with alternatives. Race-tested in CI.
Waitlist, series, guests
Auto-promoting waitlist, recurring series, and OTP guest booking that converts on first arrival.
Honest estimates
A range, presented as a range, a promise you miss is worse than an estimate you honour. Reschedule is an atomic cancel + rebook; history survives.
QUEUE & FRONT DESK
CLINICAL SUITE · EMR · PRESCRIBING · LAB
EMR / ENCOUNTERS
The consult is signed, not just saved.
Vitals, SOAP notes with signing, ICD-10 coding, and a persistent allergy banner. Every read of the record is logged, the treating doctor's included.
note/8817 · SIGNED, dr.n.silva · ICD-10 J06.9PRESCRIBING
The allergy hard-stop is a wall.
Drug master, printable prescriptions, repeat-last for chronic patients, and a prescribing hard-stop on recorded allergies, not a dismissable warning.
ALLERGY · PENICILLIN · SEVERE · HARD-STOPLAB & DIAGNOSTICS
Two people, by design.
Orders, sample tracking, results entry, and pathologist sign-off separated from entry, so no result publishes on one person's say-so.
ENTERED lab.tech.02 → SIGNED dr.k.pereraPatients module underneath: registration with MRN, duplicate-warning search, merge, timeline, and provisional records from guest bookings that convert on first arrival.
BILLING · CASH · PAYOUTS
DAY-END · CASHIER SHIFT 2
LIVE QUEUE · DR. N. SILVA
You're 6th
roughly 18:10–18:35
THE PATIENT PWA
Phone + OTP on a cheap handset with two bars of signal. Offline-tolerant, it shows what the phone last saw, and says that's what it's doing.
A parent manages a child's records; when the child becomes an adult, the parent keeps the history and loses everything after, and the screen says so on every page.
There is no such thing as HIPAA certification, no body issues one, and we won't claim it. What we claim is what ships: technical safeguards mapped to the HIPAA Security Rule, audit trails your compliance officer can actually read, and BAAs with the infrastructure chain on eligible plans. Built to the strictest of PDPA, DPDP, GDPR and HIPAA, then configured down, never the reverse.
WHO SAW WHAT
Append-only audit, actor, action, before/after, IP, device. Every clinical read logged, a doctor's own patients included. Opening a profile raises a named confirmation; declining is itself logged. The patient sees the list too.
FORCED ISOLATION
Row-level security on every tenant table, enabled and forced, binding the database owner too. Zero DELETE grants held by the application: records are retired, never erased. The cross-tenant exit test runs in CI on every change.
IDENTITY & ACCESS
87 permissions across 11 role templates, editable per centre. TOTP multi-factor, compulsory per role if you say so. Shared-terminal idle lock, 60-second session revocation, break-glass with a typed reason and a weekly owner report.
BOOKING CHANNELS
FAX ADAPTERS READY
PERMISSIONS · 11 ROLES
TESTS, EVERY CHANGE
DELETE GRANTS
BUILT ON
ROADMAP · HONEST AND SHORT
Everything above is built and running. These are not, they're on the roadmap, and we'd rather tell you than imply them.