AI in the clinic
Interaction checks that block, and why overrides are logged
A safety net should slow you down at exactly the right moment, and keep a record when you proceed.
4 min read
Every few weeks someone asks us the same question: if the draft is good enough that the doctor barely changes it, why not let the system finalise it automatically? It would save a click. It would feel modern. And we will never do it.
This is not caution for its own sake. Keeping a person between the AI and the medical record is the constraint that shapes everything else — what the AI may touch, how its output looks, what the trail records, and what happens when it is wrong.
A draft is not a decision
Every AI output is a draft: a proposal that carries no clinical authority until a named physician reads it and signs. Until then it is visually distinct, marked in violet and framed as a draft, labelled in plain words — "AI draft, awaiting signature". The act that ends that state is the doctor's own, and the footnote under it reads: "Nothing is saved to the record until you sign."
The two states are kept apart because their consequences are not comparable. A wrong draft is a routine event: the doctor edits the line and moves on. A wrong signed note is an error in someone's permanent record. Collapsing the two into one automated step trades a small convenience for a category of risk no clinic should accept. There is no automatic finalisation and no silent write.
Review only works if it has something to bite on: the draft opens editable line by line, and each suggestion carries its rationale and its confidence score.
The AI suggests. The doctor decides. There is no version of Doctopass where that order is reversed.
Where the AI moves fast
The AI drafts everywhere the stakes are reversible and stops at one threshold. It structures a recorded consultation into an eight-section report, proposes ranked ICD-10 codes, checks every prescription, drafts the referral letter. Each of those is a draft, and the threshold is the signature.
Speed belongs to the drafting layer, not to the review. What the scribe does with a recorded visit is the subject of the ambient voice scribe; what happens when a prescription check blocks belongs to drug interaction checking. On images — dermatology lesions, ECGs, X-rays — the AI returns a ranked list of differentials with its reasoning. Decision support, to be confirmed clinically. It does not diagnose.
| What the AI drafts | What the doctor does with it | Plan |
|---|---|---|
| Ambient voice scribe: an eight-section report | Reads it, edits any line, signs | Pro, 600 minutes a month; Premium, 2,000 |
| ICD-10 suggestions, ranked, with rationale | Accepts or corrects the code | Pro and Premium |
| Drug–drug and drug–allergy interaction check, and the allergy block | Overrides only with a logged reason | Pro and Premium |
| Smart referral letter | Reads it, edits it, sends it | Pro and Premium |
| CNAM auto-coding to the insurance nomenclature | Confirms or corrects the code | Premium |
Read that as a gate: Essential carries the record, the calendar, prescriptions and manual invoicing, and the AI drafting layer starts on Pro.
Governance you can show
Governance here is something a practice can show rather than assert, resting on three artefacts the software produces on its own. The signed record carries the doctor's name. An override is logged with the doctor's reason. The audit trail records reads and writes of patient data — who viewed it, who changed it, and when.
The product's own audit-log illustration shows it. Beside a doctor viewing a record and a doctor editing a consultation sits a third line: "AI draft generated · unsigned". The unsigned draft is an event in the history, not a step underneath it, and "who saw this record?" has a precise answer.
That trail is gated. The full audit trail is on Pro and Premium; audit log search and the investigation UI are Premium only. Underneath it sit two layers of authorisation on every access to patient data, a role-based guard and then a per-record check in the service layer — the same access discipline that governs the computerised patient record as a whole.
What a correction is worth
Three facts govern what happens to a correction, and they are three, not one. Personal identifiers are stripped before any prompt leaves the servers for AI processing: the model sees the clinical picture, not the patient's identity. All AI processing runs on a model self-hosted by the processor within the applicable jurisdiction, with no personal data transmitted to any external artificial-intelligence provider or third-party model. And model improvement and research use only irreversibly anonymised data, from which no individual can be identified.
That third clause names the delta between AI drafts and clinician corrections as material the anonymised set may include — a processing commitment in the data-processing agreement.
What the rule costs
The rule costs a step, every time, and we would rather write that limit down than let it be discovered after signature. Forty patients in a day still means forty drafts to read. The alternative is not a faster product but a different one: a chart written by something that cannot be asked why.
We will not publish an opinion on what a signature obliges a doctor to — that is for the binding professional authority to state, not for a software vendor to summarise in an article. What we will state is the mechanism, because that part is ours: nothing is written until the doctor signs, and the trail says who signed and who read. The rest of the clinical layer — the library of specialised models, and what the model never sees — is the subject of AI for Tunisian doctors.
Worth remembering
Read the draft, edit any line, sign; at that moment it becomes an ordinary clinical record under the doctor's name, and the trail carries who wrote it and who read it; there is no automatic finalisation and no silent write.
Frequently asked
Can I turn the review step off?
No, and it is a limit rather than a setting. Every AI output is a draft, and nothing enters a patient record until you sign, so forty consultations still mean forty drafts to read. We would rather write that limit down than let it be discovered after signature.
What does the record show after I sign?
The draft converts to a finalised record under your name, no longer marked as a draft. The audit trail separately records who viewed it, who changed it and when; the unsigned draft appears there too, as its own event.
Does my correction train the model?
Three answers, in that order. Personal identifiers are stripped before any prompt leaves the servers. All AI processing runs on a model self-hosted within the applicable jurisdiction, with no personal data sent to any external AI provider. And model improvement uses only irreversibly anonymised data from which no individual can be identified — a set the agreement says may include the delta between drafts and clinician corrections.
Which plan does the AI layer start on?
Pro, at 159 DT. Essential, at 69 DT, carries no AI drafting at all. The scribe, ranked ICD-10 suggestions, the interaction and allergy checks and the referral letter all start on Pro; audit log search and the investigation UI are Premium, at 269 DT. Per doctor, per month, billed annually; the full comparison is on the pricing page.
A signature is not a formality at the end of a workflow — it is the workflow. To see what a spoken consultation looks like by the time it carries a physician's name, request a 30-minute demo — bring one ordinary consultation, record it, read the draft, correct it, sign it.