Clinical records, consent forms and administrative files, searchable to the people who should see them and invisible to everyone else.
In most document systems the question is where a file is. Here it is who was allowed to open it.
Consent forms are signed on paper, referrals arrive by email, and administrative files pass between departments that should not all see the same thing. These five stages make access the default consideration rather than an afterthought.
Scanned and photographed pages are read on arrival, in Nepali and English, so a form that started life on a clipboard becomes searchable text rather than an image nobody can find. Handwriting is not supported — a handwritten note is stored and governed like any other document, but its contents are not read.
Dates, reference numbers and parties are extracted from each document as it arrives, so a record is identifiable by what it says rather than by whatever the file was called. Category, document type and owner are carried alongside, which is what later makes a targeted search possible instead of a broad one.
A document stays private to whoever added it until it is deliberately shared, and viewing, editing and approving are separate rights rather than one. Search respects those rights, so a restricted record never appears in results at all — not even as a title.
Every document carries a draft, active or superseded status. A form that has been replaced stays in the record as history rather than being mistaken for the one in force, which is the failure that repeats itself wherever consent and authorisation are re-signed.
What was opened, changed, shared and approved goes into a tamper-evident history. When someone asks what happened to a particular record, the answer is retrieved rather than reconstructed from memory.
In each of these, a document being findable by the wrong person is worse than it being hard to find. That inversion is what makes healthcare records different from the rest of an organisation’s filing.
Bound registers and old consent forms sit in a room where access control means a key and a sign-in sheet. Reading them in on arrival makes them findable, and permissions decide who they become findable to.
Someone transfers, and the files they could open in their old role quietly stay open to them in the new one. Because viewing, editing and approving are separate rights on each document, what a person retains is something you set rather than something you inherit.
The form on file is the one that was signed three years ago, and nothing about the folder says so. Draft, active and superseded status makes the replaced form visibly history rather than an equally plausible current copy.
The question arrives after the fact, usually about one record and one afternoon. A tamper-evident history means the answer is looked up rather than assembled from what people remember doing.
Different desks, different jobs — from the records storeroom to whoever decides who can see what.
Records
Find a scanned historical record by what it says rather than by which box it was filed in.
Administration
See at a glance that the form on file is superseded, and which version replaced it.
Access control
Change what they can view, edit and approve as an explicit act rather than something they carry with them.
Governance
Read the action history for that one record instead of reconstructing an afternoon from memory.
Referrals
Keep the referral email indexed alongside the documents it concerns, so the decision and its context stay together.
Administration
Search in one language for a record that was filed in the other, and read the answer in your own.
No. Search results respect permissions, so a restricted record does not appear in their results at all — not as a title, not as a snippet, not as a hint that something exists. This matters more than it sounds: a search that returns a locked title has already disclosed that a person has a record.
No. Scanned and photographed pages are read in Nepali and English, but handwriting is not supported. A handwritten note is still stored, permissioned, versioned and part of the audit history — it simply is not searchable by its contents. Where handwritten material has to be findable, the usual approach is to type the key details into the record so the extracted fields carry them, and keep the scan attached as the original.
Only whoever their rights are transferred to. Documents stay private to whoever added them until deliberately shared, and viewing, editing and approving are granted separately, so access to a record is an explicit setting rather than a property of having once worked in a department.
Yes. Actions on a document are written to a tamper-evident history, so the record of who did what and when is retrievable rather than reconstructed. Note that this is a history you can read, not a monitoring or reporting product; access review reporting for auditors is being built and is not available yet.
Yes. Nepali and English are supported throughout — in the documents that are read, in search, and in the interface, which follows the reader’s own language. A record filed in Nepali is findable by someone working in English and the other way round.
Not yet. Retention rules by document type are being built and are not available today. What exists now is status, permissions and a full history, so a document that should no longer be in use can be marked superseded and its access narrowed while retention remains a decision people make.