An assistant inside the system — with hard limits on what it sees
We added a floating assistant that answers questions about how the system works and about your clinic's numbers today. The hard part was never the answering — it was guaranteeing that no clinic can reach another clinic's data.
The most frequently asked questions in any clinic are not clinical. They are operational: where do I record this payment, why can't I open reports, how many appointments are left today. Each one interrupts somebody else to answer, and most of them have exactly one correct answer.
So we put an assistant inside the system: a floating icon in the corner of the screen that opens into a conversation, and that anyone who does not want it can hide. But the work did not go into the chat window or the quality of the answers. It went into one question: how do we guarantee — not hope — that no clinic ever sees another clinic's data?
What it answers
The assistant answers two kinds of question and declines everything else. The first kind is about the product itself. The second is about your own clinic's numbers, within the permissions of whoever is asking.
- How the system behaves: the invoice lifecycle, the order of lab-order statuses, why nursing cannot open the billing screen.
- Your day's numbers: appointments and their statuses, how many patients are waiting right now, what has been collected today.
- One patient's operational status by MRN: next appointment, last visit date, outstanding balance, open lab orders.
- A billing summary for a period: what was invoiced, what was actually collected, and the gap between them.
Two kinds of question, answered from two places
"How do I take a payment?" has one answer for every clinic on the platform and needs nobody's data, so the assistant answers it from the product's own guide. "What did we collect today?" can only be answered from your clinic's records, so it is looked up live every time, within your permissions.
| Kind of question | Reads clinic data? | Where the answer comes from |
|---|---|---|
| Outside the product and your clinic | No | The assistant declines |
| How the product works | No | The product's own guide |
| Your clinic's numbers | Yes, within your role and branch | Your clinic's records, live |
How one clinic's data stays one clinic's data
The guarantee is not an instruction telling the model not to read another clinic's data. Instructions get broken, and models can be talked round. The guarantee is that the assistant reaches data only through the same access rules as the screens, tied to the signed-in user, so nothing typed into the chat can point it at another clinic. The limits are these:
- Which clinic it reads from is decided by who is signed in, never by anything said in the conversation.
- A request not tied to the signed-in user's clinic is refused rather than answered.
- It can use only what the asker's role allows: a nurse's question cannot reach billing figures.
- Whatever it is asked to look up is checked before anything is read, and anything outside its limits is refused.
Work at one branch, ask about that branch
A staff member assigned to a branch gets an assistant limited to that branch, exactly like every other screen they open. Head office, with no branch assigned, sees the whole clinic.
What actually leaves your clinic
Answers are generated by an external AI model provider named in our privacy policy, which means the question as typed, the last few messages of the conversation, the asker's role and clinic type, and the lookup results all leave our servers. That is the same principle behind how we protect patient records and sign-in: the least data possible leaves, by the shortest path. So we were precise about what is taken from your records, and the rule is that only operational facts travel:
- No clinical content is taken from your records: no diagnosis, no notes, no vitals, no medication, no allergies.
- No contact detail is taken from your records: no mobile number, no email, no national ID, no date of birth. What staff type into the question is sent as written, so search by MRN, not by name or mobile.
- Operational facts do: counts, times, statuses, amounts, and an MRN the staff member uses to open the real screen.
By default, patient names are not sent from your records either: the assistant answers with the MRN, and you open that patient's file to see the name rendered by our own servers. That is one setting for the whole platform, not an option each clinic changes for itself.
Built for a phone at the front desk
The real usage happens on a phone, one-handed, with a patient waiting. So on mobile the conversation opens as a full-height sheet rather than a shrunken desktop popover, the composer stays above the keyboard instead of disappearing underneath it, and every control clears the size a thumb needs. The floating icon sits on the opposite side from the menu button so the two never fight for the same corner.
What it will not do
The limits are part of the design rather than gaps in it, and stating them up front beats discovering them at a bad moment:
- It gives no clinical advice: no diagnosis, no drug dose, no treatment plan. That call belongs to the treating clinician.
- It changes nothing. Every tool is read-only, so it books no appointment, issues no invoice, and edits no record.
- It does not exceed the asker's permissions. What you cannot see in the screens, you cannot see through the assistant.
- It does not invent figures. If a lookup returned nothing, it says so instead of filling the gap with an estimate.
Try the assistant in your own clinic
It ships as part of the system for every administrative and clinical role, right inside the screens your team already works in.
See what the system does