The patient decides who sees what. Denial always wins.

Wumi is a clinic operating system built on a patient-held, CNIC-anchored record. Every read is a consent event. Every event is written to a ledger no one can edit.

Request access See what's live

Clinic OS · Live — Pharmacy checker · In flight

Consent Ledger / PT-42201-******7-1
Live

Access scopes

Audit ledger

append-only
4 scopes granted · ledger appended

The record was never yours.

01ERR

Paper dies in folders.

fail mode: file not found

Records live in physical files. When the patient moves clinic, the history stays behind — or disappears in transit. There is no version of the truth to reconcile against.

02ERR

Consent is a checkbox.

fail mode: consent ≠ blanket

One signature at registration, treated as blanket, permanent permission. Nothing ties a specific read to a specific agreement at a specific time.

03ERR

Denial doesn't exist.

fail mode: refusal unlogged

Legacy systems grant access at onboarding and never revisit it. There is no way for a patient to refuse one scope — and no record that they did.

Three rails, one loop.

Clinic OS writes the encounter. Labs and pharmacy publish to the record.

No grant, no read.

Everything that crosses a boundary passes through the consent gate. The gate defaults to closed.

The record assembles.

Patient-held. CNIC-anchored. Every event written to an append-only ledger.

Clinic OS ● Live Labs ● Live Pharmacy ◌ In flight

Consent gate

fail-closed · defaults to deny

Patient record
Holderpatient
IdentityCNIC-anchored
Scopesdeclared by the patient
Auditappend-only
PHIencrypted at rest

For your clinic. For your patients.

One system, two sides of the desk — each gets what it actually needs.

For the clinic
  • EHR-grade clinical coreEncounters, e-prescriptions and orders on one patient record — one screen.
  • Labs on railsResults publish straight to the record the moment they're signed. No re-keying, no phone calls.
  • Access that can't leakStaff see only what the patient granted — audited on every entry.
  • Fewer moving partsOne record per patient. No duplicate files, no lost history to chase.
For the patient
  • Own your recordIt follows you to any clinic, for life. Leaving a provider never means leaving your history.
  • One source of truthEvery visit, test and prescription in a single timeline.
  • You decide who sees whatGrant per scope, revoke any time — denial always wins.
  • Your history in your pocketA QR health card anchored to your CNIC.

Next on the rails: scheduling · billing & coding · revenue-cycle tooling · AI-assisted workflows · messaging · analytics · patient app

Real software, not promises.

The visit, on one surface.

Patient header, vitals, visit notes and orders in one working screen. Free-text PHI is encrypted at rest.

IdentityCNIC-anchored patient record
At restfree-text PHI encrypted
Orderslab and pharmacy rails attached

Every read leaves a mark.

The ledger is append-only and hash-linked: each entry commits to the one before it. A removed or altered record breaks the chain on inspection.

Structureappend-only, hash-linked
Coverageevery read, every write
Break-glasslogged and reviewed

One card. Whole history.

The record is keyed to the national identity number, not to a clinic's local ID. The health card carries a scannable QR and a masked CNIC — enough to route a record, not enough to expose it.

AnchorCNIC
Cardscannable QR
Display42201-******7-1
Live
Ayesha S. · CNIC 42201-******7-1 · 41 · F · MRN WU-88214
BP
118/76
mmHg
HR
82
bpm
Temp
37.1
°C
SpO₂
98
%
Subjective: intermittent chest discomfort on exertion, 3 days. Objective: vitals stable, no acute distress. Plan: baseline labs, review in 48h.
saved · 14:02:19 · phi encrypted at rest
Try refusing — the consent playground lives on Security

A medical record should belong to the person it describes

01

Patient-held

The record travels with the patient, not the clinic. Leaving a provider does not mean leaving your history behind.

02

Consent-governed

Access is granted scope by scope and revocable at any time. Denial is a first-class state, not an exception path.

03

Rails, not features

Identity, consent, audit, labs, pharmacy — the infrastructure. Clinics build their practice on top.

04

Anchored to the CNIC

Keyed to the one identity every patient already holds. One record, every clinic, no re-registration.

Denial always wins.
— the one rule the whole system is built to keep.

What's live today.

Six of thirteen phases closed. Scheduling, billing, messaging, analytics come next — not claimed until they ship.

Identity & AuthorizationLive

CNIC-anchored identity with a scannable QR health card. Row-level security on every table.

FHIR-aligned Clinical CoreLive

Encounters, e-prescriptions and test orders land on the patient-owned record with an audit trail.

Patient Longitudinal RecordLive

One record across every clinic — it survives the folder, the city, the decade.

Clinician WorkflowLive

The visit on one surface: vitals, notes, orders — free-text PHI encrypted at rest.

Labs VerticalLive

Results publish straight to the record and notify the patient.

Pharmacy RailIn flight

Fail-closed drug-interaction checker on the same consent gate.

What clinics ask.

A modern browser and an onboarding session. The Clinic OS runs in it; labs and pharmacy rails connect as you adopt them.

The patient holds it. Your clinic writes encounters to it under scopes the patient has granted. The record outlives any single clinic's relationship with the patient.

The read fails closed. No fallback, no override, no silent default-open. The refusal is written to the ledger like every other event. Break-glass exists for emergencies — logged and reviewed.

Onboarding works through your existing paper and records with you directly — clinic by clinic, shelf by shelf. Ask us about yours.

Labs publish results straight to the record — that's live. The pharmacy drug-interaction checker is in flight. Both run on the same consent gate.

Pricing is set with each clinic as it comes on. Talk to us — hello@wumihealth.com.

Run one clinic on Wumi.

If a consent check cannot complete, access is denied. That is the whole product. Denial always wins.

Request access