Your clinic. Your data. Your workflow.

Who can see what

KeepPulsing has three roles: doctor, receptionist and dispenser. They are not cosmetic. A receptionist can run the day — book appointments, take payments, manage the queue — without ever seeing a clinical case note. A dispenser can see what to dispense without seeing why it was prescribed.

This matters in a small clinic, where the person on the front desk is often someone the patient knows personally. Scoping access is not distrust of your staff; it is what lets you hire locally without your patients worrying about it.

• Every staff member has an individual account. Shared logins defeat the entire point of an audit trail.
• Granting and revoking access is an explicit action, and it is recorded.
• Sign-in is a phone number and a password. An email address is optional; if you confirm one it gives you a second way in, and it is how a forgotten password is reset.

Clinic separation is in the database

If your account belongs to three clinics, those three clinics cannot see each other's records. That separation is enforced by the database itself, using PostgreSQL row-level security, not by application code checking a flag.

The difference is not academic. Application-level checks fail when someone forgets one — a new report, an export, a hastily added endpoint. A database-level rule fails closed: a query that does not name a clinic returns nothing at all.

The clinical record cannot be quietly rewritten

A consultation, once finalized, is immutable. If something needs correcting, the correction is appended as an amendment and both versions remain.

This is deliberately less convenient than an edit button. It is also the only way a record means anything months later — if any entry might have been changed after the fact, none of them can be relied on.

What happens when the connection drops

KeepPulsing has an offline-capable core. Clinical writes queue on the device and replay through the same API an online client uses when the connection returns. Nothing is written through a separate, less-tested path.

When two people changed the same thing while apart, the conflict is surfaced for a person to resolve. It is never silently resolved by overwriting one side — in a clinical record, a silent overwrite is a lost fact.

It is offline-capable, not offline-only. Anything that depends on shared data or on messaging resumes once you are back online.

Export always works

You can export patient and billing data in standard formats at any time. That includes while a clinic is suspended and after a subscription has expired.

We are stating this plainly because it is the objection that stops clinics moving off paper: the fear that records go into a system that will not give them back. Export is not a retention lever for us, and we will not turn it into one.

We do not message your patients

When you reach a patient about a follow-up, KeepPulsing opens WhatsApp with the message already written, and you send it from your own number. The product never sends a message itself, and we are never a party to that conversation.

Nothing is hardcoded to one country

Country, currency, date format and phone format are configured per clinic. That is also a data question: a date stored under an assumption about format is a date that will eventually be read wrong.

What we are still building

We would rather say this than imply a certification we do not hold. [Describe here, honestly, the current position on backups, encryption at rest and in transit, incident response and any formal certification — and say plainly which of these are planned rather than in place.]