Your clinic signs what leaves the clinic

Posture overview

Riverr Flow is the automated release layer for health-screening reports. Care Studio is the review and release surface. My Health is the patient copy. Workforce Health is employer aggregates; any group smaller than ten is suppressed (k≥10). The source is locked before release. Critical results leave the automatic path and follow the clinic’s protocol.

Private pilot with a Singapore health-screening provider.

• Copied statuses, never computedLaboratory flags and doctor decisions are carried through verbatim. The only comparison in the release path is whether a copied laboratory flag appears in a fixed critical list — which drives a workflow prompt, never a clinical conclusion.
• Separate portalsClinical, employer and patient surfaces are separate doors with separate sign-in. A token for one portal is refused by the others.
• Release evidenceAppend-only audit posture for release evidence, consent decisions and export authorisations (mechanism language; no invented completeness claims).
• Employer privacy floorAggregate reporting only, with a minimum group of ten enforced in the database, including complementary suppression and refusal of arithmetic that would undo it.
• Sub-processorsNot listed on this page; disclosed on request in security questionnaires.
• Entity and laneRiverr Flow is sold by Riverr Pte Ltd via the riverr.net lane.
• Clinic ConsoleClinic Console is planned clinic admin above Care Studio. It does not review or release reports. It is not required to assemble, sign, or protect a health-screening report.

PDPA and roles with your DPO

Data for the service is hosted in Singapore. Documented exceptions go to the clinic’s DPO. The clinic owns its patient records and clinical content. Riverr processes that data to provide the product. Personal data follows a Singapore PDPA posture agreed with the clinic’s DPO. This page does not name a cloud host or claim a certification.

• Controller and processorController and processor roles are set in contracting with the clinic’s DPO — not asserted as a fixed slogan on this page. A Data Processing Agreement is likewise set in contracting — not established as a published fact here.
• Clinic owns the dataThe clinic owns its patient records and clinical content. Riverr owns the platform, software, and related intellectual property. Using Riverr does not transfer ownership of clinic or patient data to Riverr.
• Inventory and retentionThe platform provides a DPO with a source-derived table inventory and a proposed retention class for each. Retention periods remain a proposal for the DPO to sign, not a published policy on this page.
• Minimisation defaultsOperational logs and metrics carry no clinical values, patient identifiers, document bytes, email addresses or tokens. Error responses use stable reason codes.
• Employer aggregatesMembership of an employer group never authorises disclosure of an individual’s clinical result. The ten-person floor is a product rule, not a page-level filter.

Not a medical device

Speed for the clinic. Refusals for the medical director. This is the single most important compliance sentence on the page.

• 01No clinical status computedRiverr Flow makes no diagnosis. It copies laboratory flags and doctor decisions. No risk score, no predictive model, no automated interpretation.
• 02Source locked before releaseLater changes never merge silently into a released document. If the underlying results change after generation, release is refused until a clinician regenerates.
• 03Critical results leave the automatic pathThey follow the clinic’s own protocol; never auto-delivered to the patient.
• 04Content signed off before useSPECIMEN watermark until a named doctor signs. We do not claim FDA, CE, SaMD, or “clinically validated.”