How it works / Architecture
Architecture and data flow
Every suggestion is assembled from a versioned evidence layer. The language model is one replaceable component in that pipeline.
The stack
The five layers
01 · Access
Web and mobile app
Cense Sidebar · EHR, read-only 2028
Cense API · labs 2027 H2
02 · Intake
Identifier gate
Blocks names, dates of birth, record numbers, contacts Lab-sheet OCR
Extracts text only; no clinical image analysis Normalization
Findings → HPO; labs → LOINC with units
Blocks names, dates of birth, record numbers, contacts Lab-sheet OCR
Extracts text only; no clinical image analysis Normalization
Findings → HPO; labs → LOINC with units
03 · Reasoning core
Rules engine
Evidence retrieval
Model drafting
Citation verifier
Differential + evidence
04 · Evidence layer
28 disease packs
Expert-reviewed, versioned Guideline and literature library
Passage-level, graded Terminology maps
HPO · ICD · LOINC Referral directories
By region Evaluation case bank
Held out from tuning
Expert-reviewed, versioned Guideline and literature library
Passage-level, graded Terminology maps
HPO · ICD · LOINC Referral directories
By region Evaluation case bank
Held out from tuning
05 · Governance
across all layers
across all layers
Version log
Pack · prompt · model, per case Audit log
Who accessed what, when Feedback queue
Reports → expert review → eval set
Pack · prompt · model, per case Audit log
Who accessed what, when Feedback queue
Reports → expert review → eval set
Data flow
What happens to a case, step by step
One step sends data outside Cense: the model call. It carries the de-identified case and the retrieved passages, and nothing that identifies the physician.
| Step | What happens | Data involved | Leaves Cense? |
|---|---|---|---|
| 1 | Submit The physician types, pastes or photographs the case. |
History, labs and report text; a lab-sheet photo for OCR | No |
| 2 | Identifier gate Direct identifiers are screened in the app and again on the server, and blocked. |
Case text | No |
| 3 | Normalize Findings are coded to HPO terms; labs are mapped to LOINC with units converted. |
Coded findings and labs | No |
| 4 | Apply rules Specialist-written red-flag combinations and exclusion criteria run first. |
Coded case, disease rules | No |
| 5 | Retrieve evidence The most relevant passages are pulled from packs, guidelines and literature. |
Graded source passages | No |
| 6 | Draft The model writes the differential from the case and the retrieved passages only. |
De-identified case + passages; no physician identity | Model provider, under BAA; no training |
| 7 | Verify and weigh Each sentence is matched to a passage; unmatched sentences are removed. Confidence is computed from evidence coverage and rule hits. |
Draft, passages, rule hits | No |
| 8 | Return and log The physician sees the differential and its evidence. Pack, prompt and model versions are logged so the output can be reproduced. |
Differential, version record | Stored in region (US) |
The model boundary
What the model is allowed to do
A third-party foundation model turns the retrieved passages into prose. It can be replaced per region, and any replacement re-runs the full evaluation set before release.
The model may
Phrase findings from retrieved passages
Draft up to three clarifying questions
Summarize why a candidate fits
The model may not
Add a claim without a source passage
Override red-flag or exclusion rules
Set its own confidence
See who the physician is
Deployment and data residency
One deployment per region
A physician's account and cases stay in the region where they were created.
2027
United States
English. Serves the US, UK and other English-speaking markets. HIPAA BAAs with every processor.
2028
European Union
English and Spanish. GDPR impact assessments; MDR classification assessed before launch.
2028
China
Chinese. Independent in-country stack; patient data never leaves China.
2028
Japan
Japanese. Independent in-country stack.
Each added language gets packs written and reviewed by specialists in that language, not machine-translated, and its own evaluation set.
Integrations
EHR · FHIR
Cense Sidebar
Reads the open patient's history, labs and report text over FHIR. Prompts when a red-flag pattern appears. Never writes to the record.
REST · JSON
Cense API
A lab's report goes in; clinical next steps for the ordering physician come out, from the same evidence layer and release gates.
Consistency
The same evidence in every channel
The app, the sidebar and the API share one evidence layer and one set of release gates, so the same case gets the same differential.