From the first tap to the final hand-back.
Home screen anatomy
Click any highlighted control. The specification beside the phone explains its job, four-step route, feedback state, operating owner, management metric and safety rule.
Good morning, Olivia
Tap the labeled controls A–L
Translate a condition, specialty, hospital or support need into explainable result groups.
Suggestions disclose whether they are specialties, providers or services.
No symptom diagnosis and no pay-to-rank clinical result.
Role-based product system
A patient should never see an operations console, and a driver should never see a medical record. Select a role to inspect its authentication route, home workspace, task hierarchy, visible data, hard restrictions and the reason behind the design.
One entry point verifies identity first, then routes by organization, assignment and minimum-necessary scope.
Email, phone or organization directory.
Patient, staff, provider, vendor, sponsor or admin.
Tenant, case, task, consent and time window.
Only the work and data required now.
The account does not choose a more powerful role from a menu. Verified entitlements determine the workspace; privileged changes require approval and enter the audit log.
All names, case IDs, provider labels, deadlines, counts, rates and response times below are fictional design data—not live operations, provider partnerships or historical performance.
●Maya Li · Shanghai care pod
Track response SLA and resolve the record gap.
Session activity is logged · inactivity timeout 14:32
Click any of the three action buttons in the workspace above. Every core role action resolves to a visible four-level path.
Assignment is explained by verified readiness, not an opaque ranking.
Change the case stage to see what each role is told—and what remains hidden. The shared case truth stays consistent while language, action and data depth change.
Named provider accepts scope; consented records unlock.
Primary screen system
Every primary tab has a distinct job, operating owner and measurable outcome. Select a tab to inspect three four-step journeys beneath it.
Understand providers and pathways before sharing sensitive records.
OUTCOMEPatient understands why a provider may fit.
OUTCOMEA considered choice replaces star-rating shopping.
OUTCOMECommercial content stays separate from clinical routing.
Every screen preserves: current case state · visible back path · named owner · next action · data-sharing status · human escalation. Deep links must reopen the same state after sign-in.
Allocation & routing engine
The platform does not “recommend the best hospital.” It checks scope, structures the case, verifies provider readiness and assigns a human owner with a visible reason and SLA.
Clinical purpose · acuity flags · records · language · payer · travel constraints · accessibility.
Emergency exclusion · platform scope · minimum records · consent authority · data-transfer need.
Named provider team · review scope · language support · response window · estimate owner.
Patient route · coordinator · SLA · missing tasks · reason · next decision.
Management scenarios illustrate product logic; they are not medical advice or live operating decisions.
Singapore · English · insurer-sponsored · pathology available
High-complexity, record-led case with payer documentation dependency.
Validate pathology files, name a partner review team, request purpose-based consent.
Product & operating analytics
This management model connects acquisition, record readiness, provider capacity, consent quality and journey delivery. All figures below are illustrative hypotheses—not historical performance or forecasts.
Use for scenario planning and instrumentation design only. Replace with audited operating data after launch.
Referral-led, multilingual and comparatively short-haul.
Visitors
BASEEngaged profiles
38%Fit-checks started
42%Complete files
68%Provider-ready cases
54%Plans issued
62%Journeys activated
61%Sessions reaching a provider profile after a pathway-relevant search ÷ relevant search sessions.
Report sponsored and organic entry separately.
Cases passing pathway-specific record completeness ÷ submitted fit-checks.
Completeness is not clinical eligibility.
Complete cases with named provider capacity and review scope confirmed ÷ complete files.
Exclude unverified availability.
Patients answering purpose, recipient and revocation checks correctly after consent.
Never optimize for faster consent alone.
Owned milestones completed before the committed timestamp ÷ due milestones.
Pause the SLA clock only with a visible reason.
Discharged cases with translated pack, follow-up schedule and confirmed recipient ÷ discharged cases.
No hand-back without patient permission.
The event model avoids collecting clinical free text for analytics. IDs, states, versions and timestamps are enough to manage the funnel while minimizing sensitive data.
provider_profile_viewedProvider ID · source · pathway · evidence version
Understand qualified discoveryprovider_savedProvider ID · shortlist position · entry surface
Measure considered intentcompare_startedProvider IDs · evidence dimensions · corridor
Find decision frictionfit_check_submittedPathway · exclusions · missing-record count
Measure qualified demandprovider_readiness_confirmedProvider team · scope · timestamp · SLA
Prove operational capacityconsent_grantedPurpose · recipient · expiry · notice version
Maintain permission evidencejourney_milestone_completedMilestone · owner · committed/actual time · exception
Manage delivery qualityTechnical architecture
This target architecture explains the technology, bottom-level modules, servers, network boundaries, data systems, clinical integrations, security controls and scale path required to turn the concept into a dependable platform.
React/Vinext HTML experience, bilingual UI state and fictional prototype data. It does not authenticate real users, connect to hospital systems, process payments or store patient records.
The architecture below is a design recommendation for technical validation, threat modeling, privacy assessment, load testing and procurement—not a claim of deployed infrastructure.
A seven-layer request path keeps public discovery fast while clinical case data stays inside private application and data zones.
ARCHITECTURE RULEThe CDN may cache public provider content and static assets—never patient records, clinical documents or authenticated responses.
React Native · Next.js · TypeScriptMobile care journey and responsive workspaces for six roles.
DNS · WAF · DDoS · CDNAccelerate public content and absorb hostile traffic before origin.
OIDC · WebAuthn · API gatewayAuthenticate, rate-limit, version and route every API call.
NestJS · modular monolith · BFFCoordinate cases, consent, provider readiness, pricing and service work.
State machine · outbox · workersRun long-lived, retryable care journeys without losing ownership or deadlines.
PostgreSQL · Redis · object store · searchKeep transactional truth, short-lived cache, encrypted documents and approved indexes separate.
FHIR R4 · HL7 v2 · DICOMwebTranslate partner-specific feeds into a versioned canonical model.
The production target uses managed services and container workloads distributed across three availability zones inside one primary region. A separate recovery region receives encrypted backups; it does not serve live traffic until a declared recovery event.
APP · browser · partner system
Untrusted by default→DNS · WAF · DDoS · public CDN
Static/public cache only→API gateway · identity · rate limit
Only public application endpoint→BFF · domain core · workers
No public IP · least privilege→PostgreSQL · Redis · objects · search
KMS keys · backup vault→mTLS · VPN/private link · zero-trust admin
Allowlisted egress + JIT accessAll internet traffic passes WAF, DDoS controls, gateway authentication and schema validation. Application and data servers have no public IPs.
FHIR, HL7 v2 and DICOMweb adapters use mutual TLS over VPN/private links where available; every partner receives a separate credential and rate policy.
Administrators enter through zero-trust identity access with just-in-time elevation. Outbound connections use NAT, domain allowlists and recorded approvals.
Resource classes are starting hypotheses for load tests, not procurement promises. Managed control planes, databases and object storage reduce undifferentiated operations work.
The proposed stack favors typed interfaces, healthcare standards and managed infrastructure. Versions are selected and pinned during implementation after security and compatibility review.
React Native · TypeScriptShared product logic with native device capabilities and mobile accessibility.
Native module only where camera, biometrics or performance demands it.
Next.js · React · TypeScriptFast, accessible, responsive portals with shared design tokens.
Split BFFs when role release cycles or policies diverge.
NestJS · modular monolithOne typed language, strong module boundaries and lower launch complexity.
Extract a service only for independent scale, ownership or failure isolation.
HAPI FHIR · HL7 v2 · DICOMwebStandards-based canonical exchange with partner-specific adapters.
One isolated adapter runtime per high-volume hospital corridor.
PostgreSQL HA · RedisRelational integrity for cases; short-lived acceleration for sessions and queues.
Read replicas and partitioning before database sharding.
S3-compatible objects · OpenSearchImmutable encrypted documents stay separate from approved search projections.
Dedicated indexing workers when ingestion backlog exceeds SLA.
Transactional outbox → managed event busReliable side effects first; asynchronous scale when consumers multiply.
Introduce Kafka-class streaming for replay, throughput or many consumers.
Managed Kubernetes · Terraform · GitOpsPortable workloads, three-zone scheduling and reviewable infrastructure.
Keep managed PaaS for the pilot if it meets isolation and recovery targets.
OpenTelemetry · SIEMVendor-neutral metrics, logs and traces plus security correlation.
Sampling changes by signal sensitivity and service-level objective.
Select an operating stage. These numbers are planning hypotheses for cost and load-test design—not demand forecasts, performance guarantees or committed limits.
4–8 application replicas; separate worker pool; PostgreSQL HA + read replica; autoscaling on queue depth and latency.
≈ 40 TB encrypted objects with lifecycle tiers; tested cross-region backup restore.
Extract integration and document workers only when independent scaling is proven.
These proposed service objectives set the starting point for resilience tests, vendor contracts and incident exercises. They become commitments only after architecture validation and budget approval.
Multi-zone replicas; queue replay and automated database failover.
Versioned objects, malware quarantine and independent recovery vault.
At-least-once delivery with idempotent consumers and dead-letter review.
Public pages may degrade to dated cache; authenticated data never follows.
Premature microservices would multiply identity, network, deployment and incident complexity before the product has proven its operating seams. The roadmap adds distribution only where scale or isolation requires it.
React/Vinext presentation with bilingual state and local prototype data. No production authentication, EHR connection, payment processing or patient-data storage.
React Native + role portals, NestJS modules, PostgreSQL/Redis/object storage and managed multi-zone runtime.
Separate workers, integrations and search; add an event bus and workflow engine when measured load or SLA complexity justifies them.
Segment tenant/corridor data planes, regional ingress and policy-aware routing while keeping patient data out of edge caches.
Standards and official framework documentation used to frame the recommendation. Final implementation still requires security, privacy, clinical-integration and legal review.
Visual content system
Hospital content needs images, but a rich app cannot rely on façade photography alone. The visual library now covers clinical capability, family support, coordination, arrival and recovery—with transparent concept labels.
CONCEPT VISUAL · NOT ACTUAL FACILITYProvider overview and multi-specialty navigation.
CONCEPT VISUAL · NOT ACTUAL FACILITYExplain advanced specialty capability in patient language.
CONCEPT VISUAL · NOT ACTUAL FACILITYMake interpreter, guardian and companion workflows visible.
AI CONCEPT VISUAL · NOT ACTUAL OPERATIONSShow assignment, SLA and exception management behind the app.
AI CONCEPT VISUAL · NOT ACTUAL PATIENTExplain the transition from entry readiness to in-city support.
AI CONCEPT VISUAL · NOT ACTUAL PATIENTShow translated discharge, remote follow-up and family support.
Official source, date and exact capability claim.
What the capability means for this pathway.
What the platform still needs to confirm.
Save, compare or start a fit-check—with consent later.
Image type · actual/concept status · source or production note · date/version.
Guaranteed outcome · celebrity doctor access · facility endorsement · patient testimonial without permission.
Provider review · medical-claim review · localization review · accessibility text.