Tunisie
The computerized patient record: your INPDP obligations
Digitizing records brings responsibilities. What health-data protection requires.
6 min read
Clinical AI earns its place on the paperwork, not the diagnosis. It drafts the note, proposes the code, checks the prescription, reads the labs, writes the referral — and a doctor signs every draft before it becomes a record.
Where the AI earns its keep
The time comes back on documentation. Record the consultation and the ambient voice scribe structures it into a full eight-section clinical report, every section ready to read, edit and sign — record to 8-section report in about thirty seconds. The eight sections:
- Chief complaint
- History of present illness
- Past medical history
- Examination
- Assessment
- Plan
- Prescriptions
- Follow-up
Around the note sit the other jobs. Drug-drug and drug-allergy checks run on every prescription, against current medication and allergies, through RxNorm and the Tunisian formulary. ICD-10 codes are proposed from the note, ranked, each with a confidence score and its rationale. Lab panels return as plain-language summaries flagging out-of-range values calmly and surfacing trends. One tap gives a one-page pre-consult brief of the last two years; the referral letter is drafted from the consultation.
We publish no figure for the time this hands back; we have not measured yours. Run the arithmetic on your own diary: minutes per note, times notes per clinic day, times clinic days a month. The inventory is in the model library.
A draft is not a record
Nothing is saved to the record until the doctor signs. Every AI output is a draft — marked in violet, framed as unsigned — until a named doctor approves it. No automatic finalisation, no silent write, no path into a chart alone.
The loop has three steps. The AI drafts: it listens, structures, codes, cross-checks, presents the result in violet, labelled. The doctor reviews: edits any line, sees the rationale and confidence behind each suggestion. The doctor signs: the draft becomes a finalised record under their name. A dangerous combination blocks, and passing it is logged with the doctor's reason.
The design has a cost, better said than discovered: a doctor seeing forty patients still reads forty drafts, because the review is the product and not a formality tacked on the end. We would rather write that limit down than let it be found after signature — the reasoning is in why the AI never signs a note.
What the model never sees
The model sees the clinical picture, not the patient. Identifiers are stripped before any prompt leaves the servers. All AI processing runs on a large language model self-hosted in-jurisdiction, speech-to-text included: dictated audio is transcribed on that same infrastructure.
No personal data and no clinical input — raw audio included — reaches any external artificial-intelligence, speech-recognition or third-party provider. For the Tunisian service, processing, storage and hosting are within Tunisia. Doctopass's INPDP declaration is submitted; per-user and per-tenant budgets apply.
Model improvement uses irreversibly anonymised data only: data that cannot reasonably be re-identified, alone or combined with other data, under a documented process and a re-identification-risk assessment covering free-text notes and images; identifiable data does not train models, nor do images carrying identifying features.
We will not publish a list of what the law obliges you to ask a vendor. Ask for the answers in writing, not in a demonstration, and take the framework question to the INPDP. The product side is in how patient data is protected.
Twelve models, not one oracle
There is no single black box here, but a library: twelve models, one principle. Each is purpose-built and explainable, does one clinical job, and assists rather than decides. They cover imaging, signal, text, voice, lab data, safety and risk, and run through all twenty specialty modules — the AI a cardiologist sees is not the AI a dermatologist sees.
The twelve: chest X-ray detection, ECG pre-read, dermatology lesion triage, retina and fundus grading, dental caries detection, spirometry interpretation, lab result interpretation, ambient transcription, interaction checking, coding assistance, summarisation and brief, risk stratification.
Explainability is the argument. A localised bounding box, a calibrated confidence score and a written rationale can be argued with; "anomaly detected" can only be accepted or refused blind. On lesions, ECGs and X-rays the models return ranked differentials with their reasoning, under an on-screen disclaimer: decision support only, confirm clinically. The chest X-ray model localises and ranks findings, each boxed and scored, feeding the draft the doctor signs — it never diagnoses; it points.
What it does, and what it does not
The boundary decides whether a tool is safe to use fast. No decision producing legal effects concerning a person, or similarly significantly affecting them, is taken solely by automated means; a qualified doctor is always responsible for the outcome.
| It does | It does not |
|---|---|
| Drafts the note | Sign it |
| Ranks differentials with its reasoning | Issue a diagnosis |
| Blocks a dangerous combination, logs the override and reason | Override for the doctor |
| Sees the clinical picture | See the patient's identity |
| Assists the doctor | Speak to the patient, self-diagnose or triage |
Where the AI layer starts
The AI layer starts on Pro. The whole AI and voice block is off on Essential, which runs the practice without it — a reasonable start.
| Essential — 69 DT | Pro — 159 DT | Premium — 269 DT |
|---|---|---|
| No AI layer at all | Voice scribe, 600 min/month | Scribe raised to 2,000 min/month |
| Record, appointments, prescriptions, invoicing | AI reports, ICD-10 picker and ranked suggestions | CNAM auto-coding to insurance nomenclature |
| Patient chat and portal, unlimited patients | Dictation, voice to prescription, allergy block, interaction checker | Handwriting OCR, audit log search |
| 1 secretary seat | Referral letters, full audit trail, 3 seats | Everything in Pro, 5 seats |
Every plan starts with a 14-day free trial: no setup fees, no per-note charges, free migration, unlimited patients. CNAM auto-coding is a Premium gate here and nothing more; the chain is under CNAM billing.
Key takeaway
Clinical AI pays for itself on the paperwork, not the diagnosis. Record the visit, read the eight sections, correct the two that are wrong, sign under your name. The model sees the clinical picture, not the patient; it drafts, it never signs.
Frequently asked
Will it replace me?
A tool that signs nothing replaces no one. No output reaches a chart without a physician's name on it, so the question is not replacement but responsibility — and the answer is whoever signed.
Does it work in Arabic and French?
The interface runs in French, Arabic and English, and Arabic renders right-to-left. Universal dictation puts a microphone on every field, in every language you practise in, from Pro upward; the patient portal is trilingual on every plan; inline chat auto-translation is a platform capability with no plan claim.
What happens when the draft is wrong?
A wrong draft is routine; you correct it as you would a dictation. That is what makes review cheap rather than ceremonial: an error caught in violet is an edit, the same error signed is an error in the record.
What does the AI layer cost?
Essential is 69 DT with no AI. Pro is 159 DT and opens the AI layer. Premium is 269 DT and adds CNAM auto-coding, handwriting OCR and audit log search. Per doctor, per month, billed annually, on the pricing page.
The question was never whether the algorithm is clever; it is who signs. To judge that yourself, request a 30-minute demo — bring one ordinary consultation: record it, read the draft, correct it, sign it.