Vendor-neutral EMR port
One interface — patient lookup, chart creation, availability, booking, cancellation, messaging. Adapters route per practice. An adapter that doesn't support a capability refuses the call rather than guessing.
For partners and technical evaluators
The governed action layer.
Everyone can generate the conversation. The hard part is writing to the chart safely at a practice with no IT department.
Architecture guarantees
What the system enforces — not what it intends.
Identity before access
At least two matching factors before any chart read. A surname alone is treated as an enumeration attempt, not a lookup. Third-party and pharmacy callers are refused chart access at the tool boundary.
Human release, bound to content
Approval is granted against a cryptographic digest of the exact artifact. If the bytes change between approval and publish, the publish is refused and the refusal is logged.
Enforcement at dispatch, not in the prompt
Tool access is an allowlist checked when the call is made. A model that asks for a tool it doesn't hold is denied, and the denial is recorded.
Tamper-evident audit
Every tool call and state change appends to a hash-chained record. Verification recomputes the chain.
Tenant isolation
Practice scope is carried in the access token. Out-of-scope requests return not-found rather than forbidden.
Configuration, not code
A new practice is a directory of configuration. Onboarding does not require changes to runtime code.
Integrations today
Live where the practices are.
Direct EMR integration with Practice Fusion and eClinicalWorks is in production. Certified FHIR R4 systems are supported through a standards-based path.