For hospitals
The questions a unit asks before it says yes.
Where the data sits, who is accountable when a plan is wrong, how it reaches your record system, and what a pilot costs you. Answered plainly, including the parts that are built and not yet released.
The doctor signs everything.
Who is accountable when a plan is wrong is the first thing a governance committee asks. Two things settle it.
Every plan is advisory. A doctor reviews it, edits it and signs it, one patient at a time, and nothing is applied without that signature.
Patient identifiers are stripped from the record before it reaches a model. The name, the file number, the national ID and the phone number never leave the hospital.
The safety gate, and what it leaves alone.
What follows is what it catches, and what it deliberately does not.
Orders that conflict with an allergy recorded in the chart are withheld before a doctor reads the plan.
A value nobody measured is not stated, and is not used to calculate a dose.
Only rules whose trigger is a field in the record are enforced. Rules that turn on clinical judgement go to the doctor rather than being guessed at, because a gate that withholds correct orders is a gate clinicians switch off.
Built, not released
Tenancy and isolation.
Who can read a patient, and what enforces it. An isolation rule that lives in application code holds only for as long as every query remembers it.
The isolation boundary is the customer who signs the contract, not the building, and it is enforced by row level security in the database rather than by application code.
Built, not released
The audit trail.
When a plan is questioned six months later, the question is what was proposed, what the doctor changed, and who signed. That is a storage decision, and it has to be taken before anyone needs the answer.
The drafted plan and the plan the doctor signed are written in one transaction and linked, so what was kept, edited, added and dropped can be reconstructed for any patient.
Built, not released
Integration.
Your record system already speaks HL7 or FHIR. How much work an integration is comes down to whether both sides mean the same thing by an admission.
Clinical data belongs to an encounter, one admission from arrival to discharge, which is what HL7 and FHIR call it. Admit, transfer and discharge messages map onto it rather than being translated.
Built, not released
What a pilot involves.
One unit, alongside your existing process, on cases your own consultant picks. If the output does not clear their bar, the pilot has answered the question and it costs you nothing further.
- One unit, one patient population, a fixed period. Small enough to run properly and finish.
- Your consultant chooses the cases and sets the bar, rather than us.
- Output is scored blind, so the person scoring does not know what produced it.
- From you: a consultant intensivist for a few hours, de-identified data for that unit, and one person on the IT side to answer how data reaches us.
The ward works in English, Arabic, or Hebrew, laid out right to left where the language reads that way. Not an English-only interface with a translated menu.
The people accountable for it.
A practising intensivist reviews the clinical content, and the engineers who wrote the safety gate are the ones you will be talking to.
Talk to us
Run it on your own cases.
We will walk you through what the software returns on a real encounter from your unit, including the parts it gets wrong.
Book a walkthrough