Riverr Flow

For clinic operations

Automated release layer for clinical reports.

When the result set is complete, Riverr Flow assembles the clinic’s own report. A named doctor signs. Then the patient copy is released.

Hold for a named doctor — SPECIMEN until then. Release the patient copy. Employers receive aggregates only (k≥10).

Not a medical device. It copies laboratory flags and doctor decisions. It does not diagnose, triage, or compute a clinical status.

Talk to Riverr Walkthrough

Private pilot with a Singapore health-screening provider.

From laboratory result to a signed report.

Results arrive by machine. When the set is complete, the clinic template assembles. A named doctor signs — My Health gets the patient copy; Workforce Health gets aggregates only. Missing decision, signature, or source — nothing ships.

Assemble. Prove. Protect.

Complete set in. Named signature and locked source. Patient copy and employer aggregates after release — under-ten stays hidden.

Three pillars: Assemble it automatically, Prove what you released, Protect the people in the data.
Assemble · Prove · Protect

Assemble

When the set is complete, Riverr Flow composes the clinic’s template — cover, wording and cut-offs from the clinic library. No re-keying of the laboratory printout.

  • Machine feeds; unmatched messages quarantined
  • Clinic template, not a Riverr layout
  • Queued when the set is complete

Prove

A named doctor signs before release. The source locks. Unsigned pages carry SPECIMEN. Incomplete test, invalid range, mismatched code, or critical result — hold.

  • Named doctor reads and signs
  • SPECIMEN on every page until then
  • Source locked before release
  • No silent rewrite of an issued document

Protect

Critical results leave the automatic path. Employers see aggregates only; groups under ten are suppressed. Messages go under the clinic’s name.

  • Critical follows the clinic’s protocol
  • Holds and risk tiers clinic-configured and signed
  • Patients read the released copy in My Health
  • Employers: aggregates only; under-ten suppressed (k≥10)

Quarantine to export — ten controls

Each step names the hold that matters before anything leaves the clinic.

  1. 01Results arriveMachine feeds from laboratories and the practice-management system — checked CSV as fallback. Each message binds to a patient and screening; duplicates detect; unmatched quarantine.Quarantine
  2. 02Clinic data joins themVitals and biometrics, the doctor’s typed findings and commentary, imaging and investigation attachments enter the same screening record.Clinic join
  3. 03Completeness and safety are checkedPackage markers, mapping profile, signed plausibility policy. Incomplete, unmapped, critical, or unsigned-policy cases hold — they are not generated.Safety hold
  4. 04Report assembles into the queueA scheduled job composes the clinic’s template into the review queue when the set is complete.Auto compose
  5. 05The source is lockedResults finalise before release. If the source changes later, the platform surfaces the change and requires regeneration — it never silently rewrites what already left.Source lock
  6. 06Doctor reviews at reading widthToday’s queue, the report at reading width, hold reasons, the patient note. Critical cases open a separate protocol screen with the laboratory’s own flag and the verified contact route.Doctor review
  7. 07A named doctor signs and releasesReviewed copy kept as evidence; signature checked against the clinic register; signed copy bound in one step. SPECIMEN on every page until then.Named sign
  8. 08The patient receives itMy Health shows the released report and PDF; email and SMS use the clinic’s sender. Withheld critical stays withheld across web, PDF, export, and message — no delivery until release accepts.Patient copy
  9. 09The employer gets the aggregateOnly signed, released reports enter the cohort. Aggregates compute and suppress in the database at k≥10; every printed number binds to its cell; unapproved content stays empty.Aggregates
  10. 10Statements and export followCorporate statements and invoices stay source-backed. FHIR R4 export covers released reports only — what the clinic signed, nothing more.Export

Connection note. Laboratory and clinic-system feeds are named in the pilot checklist — not as a public supplier list.

Assemble. Prove. Release.

Demo screens: fictional Tembusu Health — not a customer clinic.

At a glance: 01 Assemble, 02 Prove, 03 Release to patient.
Journey at a glance — Assemble → Prove → Release to patient

  1. 01 · Assemble

    Complete set fills today’s queue

    Complete set in — Care Studio queues the clinic’s report. The doctor opens on what is waiting.

    Care Studio today’s queue with summary counters, critical banner area, and review list. Demonstration clinic.
    01 · Assemble — Care Studio queue, ready for doctor review.

  2. 02 · Prove

    Named doctor signs before release

    Named doctor reads at reading width. Source locks before release — unsigned pages cannot pass as signed.

    Care Studio review workspace with page thumbnails, report viewer, and signing bar. Demonstration clinic.
    02 · Prove — reading width, source lock, and signing bar.

  3. 03 · Release to patient

    Patient reads the signed note first

    Patient reads the signed report in My Health. Workforce Health shows aggregates only — under-ten suppressed.

    On the release path

    My Health phone report with greeting, result summary, and signed doctor note. Demonstration clinic.
    03 · Release — My Health signed report on the patient’s phone.

What Riverr Flow refuses

No diagnosis. No invented clinical status. No end-customer portal. Laboratory flags and doctor decisions copy through.

Private pilot. Clinic owns the checklist.

Named owners on a private pilot — sites, brand and senders, laboratory feeds, report design, package mapping, patient sign-in, doctors verified. Commercial terms settle before go-live.

Start a private pilot

Named-doctor release for screening reports. Email who you are and what you run.

Talk to Riverr Walkthrough