For procurement and DPO

Your clinic signs what leaves the clinic

The report holds until a named doctor signs the release record. SPECIMEN on every page until then. Employers see aggregates only.

Not a medical device. It copies laboratory flags and doctor decisions. It does not diagnose, triage, or compute a clinical status.

Talk to Riverr FAQ

Private pilot with a Singapore health-screening provider.

Three doors. One release record.

Care Studio — a named doctor reviews and releases. My Health — the patient copy. Workforce Health — aggregates only (k≥10). Source locks before release; critical results leave the automatic path.

Copied statuses, never computedLaboratory flags and doctor decisions carry through verbatim. A critical-list flag opens a workflow prompt — never a clinical conclusion.
Separate portalsCare Studio, Workforce Health, and My Health — separate doors, separate sign-in. A token for one is refused by the others.
Release evidenceAppend-only audit for release, consent decisions, and export authorisations.
Employer privacy floorAggregates only. k≥10 enforced in the database — complementary cells suppress; arithmetic that would undo the floor is refused.
Sub-processorsNamed in security questionnaires — not on the marketing site.
Entity and laneRiverr Flow is sold by Riverr Pte Ltd via the riverr.net lane.
Clinic ConsoleAdmin above Care Studio — packages and sign-in. Never review. Never release.

Singapore residency

Hosted in Singapore. Named exceptions go to the clinic’s DPO in writing.

Singapore pin

Data-bearing resources pin to a Singapore region. Where a global service cannot pin, the exception is written — audit streams, identity store, hosted sign-in.

Written exceptions

Exceptions stay written. Cloud vendor is named in contracting.

Residency with your DPO. Written exceptions ship with the residency pack. Email, SMS, laboratory, practice-management, and billing transfers settle case by case in contracting.

PDPA with your DPO

Clinic owns patient records and clinical content; Riverr processes that data to run the product. Singapore PDPA posture is agreed with the clinic’s DPO. No SOC 2, HITRUST, or “PDPA certified” claim.

Controller and processorRoles and the Data Processing Agreement settle in contracting with the clinic’s DPO.
Clinic owns the dataClinic owns patient records and clinical content. Riverr owns the platform and related IP. Using Riverr does not transfer clinic or patient data ownership.
Inventory and retentionDPO receives a source-derived table inventory and a retention class for DPO sign-off — periods are signed with the DPO, not published as a public policy.
Minimisation defaultsLogs and metrics carry no clinical values, patient identifiers, document bytes, email addresses, or tokens. Errors use stable reason codes.
Employer aggregatesEmployer-group membership never authorises an individual’s clinical result. The ten-person floor is a product rule, not a page filter.

Claims we refuse

Customer counts, cloud vendor names, and self-serve white-labelling stay off riverr.net. Evidence is in questionnaires and contracting.

01Live production usage or customer countsPrivate pilot only. No live customer count on this site.
02Named cloud vendorNamed in contracting when hosting is settled with the clinic.
03White-labelling as availableSelf-service white-labelling and custom domains settle under contract.

Holds, watermark, then a signature

Four holds on the path. Source locks before a named doctor signs. Laboratory flags and doctor decisions copy through — never computed as a clinical status.

01No clinical status computedNo diagnosis. Laboratory flags and doctor decisions copy through. No risk score, predictive model, or automated interpretation.
02Source locked before releaseLater changes never merge silently into a released document. If results change after assembly, release refuses until a clinician regenerates.
03Critical results leave the automatic pathClinic protocol owns them — never auto-delivered to the patient.
04Content signed off before useSPECIMEN until a named doctor signs. FDA, CE, SaMD, and “clinically validated” are not claimed.

FHIR export and portability

Leave with what was released. Portability covers signed reports — not a clinical record the clinic never signed.

FHIR R4 of released reports

FHIR R4 export of released reports is in the product — consent and release checks at download. Signed inner material is not rewritten or enriched with clinical codes on export.

Connections named in the pilot

No public supplier list. Laboratory, practice-management, and receiving systems are named in the pilot — export acceptance with them.

Send your security questionnaire

Bring the DPO’s list. Residency pack and evidence come back with the answers.

Talk to Riverr FAQ