Consent decides what you open.
Two gates on every record: the patient's consent scope, and your clinical role. Every open is audited.
13 clinical roles
Consent-scoped access
Hash-chained audit log
14 languages
Two gates, not one
Your role says what you may open. The patient's consent says how far. A section your role permits but their consent does not cover is never silently hidden: it names the scope that is missing and offers to request it.
- Permission and consent are checked separately, on the server
- Sensitive diagnoses are filtered per role
- A denied open is recorded, not swallowed
Thirteen roles, one matrix
From resident to chief physician, plus nursing, therapy, pharmacy, midwifery and paramedics. Each role carries its own permission set, and the matrix is the single place it is defined.
Sensitive categories, including mental health, sexual health and substance use, are filtered by role before a record renders.
Break glass leaves a mark
Emergency access is not a bypass. It asks for a category, a written reason, and an explicit acknowledgement that the access is audited. The override is time-boxed, and the reason is stored word for word.
A reason of at least 20 characters
A time-boxed override, not a permanent grant
The reason stored verbatim in the audit event
The audit chain checks itself
Chain intactEvery event carries the hash of the one before it, computed over the sequence, timestamp, actor, action, patient and outcome. The audit page recomputes the whole chain on open and names the first sequence number that does not match.
Administrators never see patients
Administration is a flag, not a clinical role. Admin accounts manage people and organisations, and are blocked from patient data in four independent places: the navigation, every clinical route, the data layer, and the assistant.
13
Clinical roles
7
Record sections
14
Interface languages
0
Patient data for admins
An assistant bound by the same gates
Ask about the patients you already have access to, by text or by voice. The assistant reads through tools that re-derive your role and the patient's consent themselves rather than trusting the page that called them.
Read-only: it answers, it does not write
Identity comes from the server session
Informational, never a diagnosis
Built for the record you were trusted with.
Registration is reviewed before access is granted. Patients keep their own record in Aimedis Care Pro.