Virtual urgent care, telehealth, home care, remote monitoring and clinical records on the same member registry. The patient is served in a WhatsApp conversation, with no app to download and no password to create. Your team works in a single system, and your institution's data stays separate from every other institution's.
Modules can be purchased separately, not as a closed bundle. This is the set your institution chooses from.
Virtual urgent care and home care use the same registry, the same national ID and the same history. Clinicians do not retype what a colleague already recorded in the other module.
Four modules are contracted per institution. The member journey is the fifth area: it comes with any contracted module and is not sold separately.
Home visits, team rota, supplies at the patient's home, daily route and remote monitoring.
Risk-classified queue, nurse triage, video visits and follow-up after the encounter.
It cuts across virtual urgent care, home care and the assistant. Contracted separately, and switched on capability by capability by management.
Indicator dashboard for the care operation, so leadership can follow it without requesting a report.
It comes with any contracted module, which is why it is not sold separately: a single registry, identification by national ID or member card on WhatsApp, passwordless sign-in to the member area with a six-digit code, access released by the team, LGPD consent per purpose, the institution's own scheduling page, conversation history, and notifications by WhatsApp, email and browser.
Turning a module on or off is our operation, never the client's. Contracting or cancelling takes effect immediately, with no release to wait for. What was not contracted does not show in the menu, does not open by direct URL and does not respond: in doubt, the system closes instead of allowing.
Three controls stack on the same request, and none replaces another: the person's role, the contracted module, and the data separation per institution.
Doctor-to-doctor second opinion is not a separate module. It comes with virtual urgent care and switches on together with it.
Digital reception, a queue ordered by risk classification, and video visits. All written into the same record the home care team uses.
Identification, consent, pre-triage and the queue ticket all happen inside the conversation. The only screen that opens in a browser is the video room. That removes the app, the password and the portal address from the path, which is exactly where elderly members give up.
The channel runs on the official WhatsApp API, contracted by the institution itself directly with Meta. Each institution serves patients from its own number, and that number is not shared with any other.
About identification. The phone number writing in does not have to match the registry, and that is a product decision: someone who feels unwell may be on a neighbour's or a child's phone, and demanding the registered number would lock out exactly the people who need care most. A phone mismatch is recorded for audit. Only a national ID or member card belonging to a member of that institution, with access released, opens an encounter; the error message is the same for both refusal reasons; and the final control is human: the encounter is on video, with the clinician seeing who they are talking to.
About switching the channel on. Sending and receiving messages are two different settings. With the first one, the system already sends notifications and the member area's access code. The care conversation depends on the second, and the integrations screen reports both states separately, so nobody assumes the whole channel is live.
Every home under care becomes a point on the team's map, with route, rota, supplies and clinical history in one place. Management stops finding out about the missed visit at the end of the month.
Where the active members are, home by home, on screen.
The day's route with visit order and street distance, not straight-line distance.
The team's grid, with shift swaps recorded instead of agreed over text messages.
Home supplies linked to the member, with every movement recorded and no side spreadsheet.
Follow-up by care pathway, with a named owner and the case history in order.
Screens built for phones and poor connectivity, because the visit happens in the patient's home and not at an office desk.
Vital signs and validated scales feed alert rules that management configures on screen. The team is warned before the patient deteriorates, without waiting for the next visit to notice.
Risk type, monitored parameter, cut-off range, severity and message are all defined on screen. A published rule does not change afterwards, every alert stores the version that produced it, and a dashboard shows how often each rule fires. Changing a clinical threshold does not depend on calling the vendor.
Braden, Morse, EVA, PHQ-9 e GAD-7 aplicadas dentro do acompanhamento, sem formulário em papel nem planilha à parte.
Prenatal follow-up with the care pathway controls on the member's own record.
PHQ-9 and GAD-7 with referral from the same record, without starting the history over in another system.
Every clinical edit keeps the previous version. Nothing is erased, and the institution can prove who wrote what and when.
Case coordination leaves the spreadsheet. Team, recommendation, protocol and schedule are all tied to the member, with an author and a validity period.
Each member's role and period, a lead clinician always matching the recorded care relationship, and recommendations with specialty, deadline, owner and a check on who completed them.
Author, date and validity preserved at every publication, linked to diagnoses in ICD-10 and ICPC-2.
Day, week, month and custom range views, with filters by professional, status and type. Editing by management runs on the same core as member self-service.
Operational follow-up, preventive medicine and population health on the same base as the care itself.
Export and import patients, encounters, catalogues, staff and records, and purge old data under the institution's retention rule. All of it recorded in the audit trail.
The team resolves questions and opens tickets without leaving the screen, with or without the AI module contracted.
Seven capabilities, switched on one by one by management. None of them writes into the record on its own: the output comes back to the screen marked as a suggestion and only becomes a clinical entry when the clinician saves it.
AI cuts across the modules and is sold separately. Without the module contracted, AI controls disappear from the screen instead of sitting greyed out, the assistant stops conversing, its panel becomes a support channel, and pre-triage goes back to nursing. Even with the internal switches on: between switch and contract, the contract wins.
The two groups are kept apart on purpose. Selling a finished interface as a connected vendor is the kind of thing that surfaces in the first meeting with your IT team.
About corporate sign-in. The provider is configured per institution, never one for all of them. A single provider would let any directory account into any client, because the sign-in does not say which institution the person works for. With no recognised group in the directory map, access is refused instead of falling back to a default profile.
About the national health data network. Accreditation belongs to the healthcare facility, not to the platform: it requires an active CNES registration and an ICP-Brasil e-CNPJ certificate, filed on the DATASUS service portal, with the platform declared as the system in the request.
Virtual urgent care and home care use the same patient, the same national ID and the same history. Anyone running telehealth in one system and home care in another cannot reach that continuity without merging the two.
Identification, consent, pre-triage and the queue ticket all inside the conversation. It is not a message with a link to a portal the patient will never open.
PostgreSQL row level security, not an application setting someone can get wrong. A query without the filter sees no row from another institution, instead of leaking the data.
It does not show in the menu, does not open by direct URL and does not respond. The check runs on every request, so contracting and cancelling take effect immediately.
The model on the institution's infrastructure, output always marked as a suggestion, and a patient who refuses AI is still cared for.
Each area holds its own business rules and talks to the others only through a defined interface. A change in one module is less likely to break another, and a technical audit finds clear boundaries instead of tangled code.
Communication only through defined interfaces, across 268 API endpoints. New work extends the matching domain, without rewriting the platform.
Frontend in plain HTML, CSS and JavaScript, no framework. A light page is a field requirement, not an optional optimisation: home care works on phones and unstable networks.
It comes up without a complex orchestrator, with a Grafana, Loki and Promtail overlay, Sentry, and runbooks for backup and continuity.
Unit, API and end-to-end tests with Playwright, covering business rules, encryption and isolation between institutions.
Separation guaranteed by the database, an audit trail that exposes a record altered after the fact, and consent that stores the exact text the person read. These are the questions compliance and the data protection authority ask, and the ones that cost dearly without an answer.
Row level security across 60 PostgreSQL tables. A query without the filter sees no row from another institution, instead of leaking the data. The application check stays active on top of it, as a second barrier.
Every entry chains to the previous one, so touching the past becomes detectable. It covers sign-in, records, prescriptions, attachment downloads and recordings. National IDs and clinical text never enter the log detail.
AES-256-GCM, with an HMAC search index so the screen stays searchable. Losing the key makes the data unrecoverable, so it lives in a vault, with its own backup, outside the repository.
Session, role, job title and second factor on internal routes. Consent per purpose that archives the exact text accepted, and record retention under Brazilian medical council resolution CFM 1.821/2007.
WCAG 2.1 AA is the internal target the product works towards, not a certification already obtained. On the member's screen it becomes big buttons, big text and plain language.
No. The AI model runs on the institution's own infrastructure, and the system refuses to start if the model address points outside the local network.
No. The AI suggests and the clinician decides. Every output comes back marked as a suggestion and only becomes a clinical entry when the clinician approves it.
Each institution sees only its own data, and the database is what guarantees it, through PostgreSQL row level security across 60 tables. A query without the filter sees no row from another institution, instead of leaking the data.
No. Identification, consent, pre-triage and the queue ticket all happen inside the conversation itself. The only browser screen is the video room.
No. The conversation starts by asking for the national ID or member card number, checked against that institution's registry, and only an existing member with access released by the team gets in. Five wrong attempts lock the identification. That is a product decision, not a technical limitation.
Yes, against the institution's own directory, over OpenID Connect: Entra ID, Google Workspace, Okta and Keycloak. The provider is configured per institution, and with no recognised group in the directory map access is refused.
There are ready interfaces for Tasy, TISS, PACS, LIS and RIS, and the national health data network already operates with clinical encounter records in FHIR R4. Actually connecting each vendor depends on their address, credentials and certification.
One session with medical leadership, the IT team and compliance, with the product running live: the virtual urgent care queue, a home care visit, the record, separation between institutions, and the audit trail.
LarClínica