How we build for safety.

No language model sits in the clinical decision path.

Triage is deterministic. A reading is scored against thresholds your clinicians set, by code that behaves the same way every time and has its own test suite. Thresholds are data, so a clinician can change them without an engineer. Nothing about the decision is inferred.

Where AI is used, and what gates it.

There is one place in the patient-facing product where a model reads something: the patient’s printed prescription.

Real prescriptions resist naive parsing. Insulin is measured in units and breaks the dose notation the other rows use. The instruction column often carries the recurrence rather than a meal note, so reading “alternate days” as “daily” would tell a patient to take a drug at twice the prescribed frequency. Duration is usually absent, and absence means indefinite. Urdu text on the page can reverse in the file’s text layer, and it does so on exactly the highest-risk rows.

The most dangerous case is the narrative. Prescriptions carry a history section listing drugs the patient was taken off. A parser looking for a drug name followed by a number will match those lines happily, and reminding a patient every morning to take a drug her doctor stopped is a clinical risk created by a software bug.

So the design does four things.

The model is given the rendered page images as well as the text layer, which is what defeats the reversed-script problem. It runs behind an adapter, so it can be swapped or replaced by a direct feed from a records system without changing anything downstream.

Its instructions are non-negotiable: never extract from the narrative, never guess, flag anything ambiguous.

Where a dose line is unambiguous, the system parses it independently in code and compares the two readings. Agreement keeps the model’s confidence. Disagreement forces the row to low confidence with both readings shown. A class of silent model errors becomes a visible review item.

Then a human checks it. Every extracted drug lands as a pending course and a task. The reviewer sees the original document beside the parsed rows and answers one question: does this match the prescription. Low-confidence rows sort to the top. Approval is blocked on the server until every row is confirmed or dropped, not by a disabled button in the interface.

There is deliberately no auto-approve setting in the product, and there will not be one until real accuracy data exists.

When the system refuses to decide.

A new prescription containing a drug already running supersedes it. The new dose wins with no gap, and the old course is marked superseded with a link.

A drug missing from a new prescription is never automatically stopped. Prescriptions are written per indication, so absence does not mean discontinued. The existing course keeps running and a task asks a human to decide.

Two doctors prescribing the same drug at different doses is a hard stop. Neither schedule activates and a conflict task is raised. An algorithm is never allowed to pick a dose.

What we deliberately did not build.

No automated escalation on missed doses. Where that threshold sits is a clinical and commercial decision, not an engineering one, and it belongs to you.

Silence is not treated as a skip and creates no task. A task for every unanswered prompt would generate several per patient per day, bury the board, and hide the real ones.

Adherence is tracked per time of day rather than per drug, because reminders are batched, and the interface is written so it never implies data exists that does not.

Any dosing pattern the system cannot schedule safely is excluded structurally, not hidden behind a flag someone could turn on.

Accountability.

Completing a red alert logs the communication. It does not resolve the patient’s status. A counselor moves the status explicitly, with a reason and a required note, when the patient is actually stable. The record shows a clinical decision rather than a tidy dashboard.

The audit log is append-only and the database itself rejects updates and deletes. Tamper-evident by construction, not by policy.

Role-based access is enforced on the server for every request, and responses are shaped for the audience at the boundary rather than by hiding fields in the interface.

A patient exercising a right to erasure is hard-deleted. That patient’s audit history is deliberately preserved, immutable and decoupled from the patient record, as a compliance trace.

Every message that does not go out records why, and that suppression is visible in the console rather than silent.

WhatsApp, done to Meta’s rules.

WhatsApp is not an open pipe, and most of the difficulty in this product is here rather than in the AI.

The 24-hour window. WhatsApp allows a free-form message only within 24 hours of the patient’s last inbound message. Outside it, only pre-approved templates. Hakeem tracks that window per patient and gates every outbound send against it, as a tested state machine in the core of the product. Your staff never have to remember the rule, and the product cannot break it.

Consent and opt-out. A patient who replies STOP, in English or Urdu, stops receiving everything immediately, and their counselor gets a task. Replying again opts them back in.

Template classification. Promotional phrasing gets a template classified as Marketing, which requires prior opt-in that a “reply to activate” message cannot itself supply. Templates are written and submitted so they classify as Utility, which is the category continuous care actually belongs in.

One eligibility gate governs every automated outbound message. A counselor pausing a patient silences check-ins, dose reminders, appointment reminders and payment nudges at once, rather than four separate switches and one that somebody forgets.

Messages are claimed before they are sent. A crash produces a missed message, never a duplicate one.

None of this is decorative. An account that sends unwanted or misclassified messages has its quality rating cut and its sending limits reduced. For an organization whose entire care channel is WhatsApp, that is not a compliance footnote. It is an outage.